Wiz says an attacker broke into AWS accounts of multiple Qubole customers between Oct. 14 and 26 using credentials for the AWS account Qubole’s platform uses to reach them. Qubole (owned by Idera) runs inside customer accounts through an IAM role that trusts Qubole’s account.
- Most of the roles were unused, but they still trusted Qubole, so the attacker’s AssumeRole calls worked, External ID and all.
- Once in, it read Lambda environment variables, Secrets Manager and SSM Parameter Store, tested the stolen keys with TruffleHog (AWS, Entra ID, Okta), and copied whole S3 buckets.
- A separate Oct. 8-11 wave used customers’ own AWS access keys set up for Qubole.
- Wiz didn’t say whether the credentials are disabled, and Qubole and Idera hadn’t posted a statement when The Hacker News checked.
What to do
If you ever connected Qubole to AWS, even if you stopped using it, check CloudTrail from Oct. 1 for AssumeRole calls from Qubole’s account coming from outside AWS. Then delete roles you don’t use and rotate anything those roles could read. Garlic because we don’t know yet if the door is actually shut.
God Bless, and Needs Garlic!
