Wiz discloses AWS customer breaches through Qubole access

Wiz disclosed Monday that an attacker used Qubole's trusted AWS access to breach multiple customer accounts between October 14 and October 26, stealing secrets and stored data. The attacker used credentials for the AWS account Qubole's platform uses to reach customers. Most abused customer roles were unused but still trusted Qubole's account. Requests carrying matching External IDs gained their permissions, allowing the attacker to read credentials from Lambda settings, Secrets Manager and SSM Parameter Store, and copy S3 data. Wiz recommends reviewing even dormant Qubole connections. The researchers did not establish whether the credentials had been disabled or the activity had stopped, and missing S3 access logs limited their ability to identify stolen objects.