Supply Chain Attack Rocks AWS: Qubole Breach Exposes Third-Party Trust Vulnerabilities

A recent supply chain attack targeting Qubole's data lake platform has sent ripples through the cloud security community, underscoring critical vulnerabilities in trusted third-party access models. Between October 14 and October 26, attackers successfully breached AWS accounts of multiple Qubole customers, exfiltrating sensitive data and secrets. This incident serves as a stark reminder for cloud architects and security teams across Africa to rigorously evaluate their third-party integrations and access permissions.

The Compromise: A Chain Reaction

The attackers leveraged compromised credentials belonging to a Qubole AWS account, which inherently possessed trusted access to various customer environments. Qubole, a data lake platform owned by Idera, operates by assuming specific IAM roles within its customers' AWS accounts. This integration model, while facilitating seamless service delivery, creates a potential attack surface if the third-party’s credentials are compromised.

To establish this trust, customers configure IAM roles with a trust policy allowing Qubole’s designated AWS account to assume these roles. Each `AssumeRole` request, the mechanism by which Qubole accesses customer accounts, typically includes an `External ID`. While intended to prevent unintended access, this ID is not treated as a secret by AWS; anyone with access to the role’s configuration can view it. This characteristic, combined with compromised Qubole credentials, allowed the attackers to successfully assume roles, even those that were unused but still trusted Qubole’s account.

Unveiling the Attackers' Playbook

Once inside customer AWS accounts, the perpetrators systematically sought out and exfiltrated valuable assets. Their activities included reading environment variables from Lambda functions, extracting secrets from AWS Secrets Manager, and retrieving sensitive values from the SSM Parameter Store. They then meticulously tested these newly acquired credentials—including victims' AWS access keys, Entra ID client secrets, and Okta client credentials—using tools like TruffleHog to validate their efficacy. Beyond credential harvesting, the attackers also copied data from any S3 buckets accessible via the compromised roles.

Cloud security firm Wiz, along with Sentra, identified and reported this malicious activity, highlighting the critical need for continuous monitoring of third-party access.

Urgent Call to Action for Cloud Teams

Organisations that have ever integrated Qubole with their AWS environments, regardless of current usage, must act immediately. A thorough review of CloudTrail logs from October 1st onwards is paramount. Security teams should specifically look for `AssumeRole` requests originating from Qubole’s AWS account ID (805246085872) that appear to come from an external IP address – a strong indicator of unauthorized access.

Beyond this immediate response, the incident underscores a broader principle: the critical importance of least privilege for third-party integrations. Regularly audit and, where possible, revoke IAM roles and permissions granted to third-party services that are no longer in active use or whose access scope is overly permissive. Implementing robust identity and access management practices, along with continuous monitoring for anomalous `AssumeRole` activity, is no longer optional but essential.

The South Africa / Africa Angle

As cloud adoption accelerates across South Africa and the wider African continent, organisations increasingly rely on a complex ecosystem of third-party cloud services. This Qubole breach serves as a vital reminder that geographic location offers no immunity to global supply chain attacks. African enterprises, from burgeoning startups to established corporations, are equally susceptible to the risks posed by compromised third-party access.

For cloud architects and security teams in Africa, this incident necessitates a heightened focus on third-party risk management frameworks. It reinforces the need to scrutinize the security posture of every vendor granted access to their cloud environments, implement stringent access controls, and ensure comprehensive logging and monitoring capabilities are in place. Protecting sensitive customer and organisational data, particularly in the context of local regulatory frameworks like POPIA, makes proactive vigilance against such supply chain vulnerabilities non-negotiable.

Source: The Hacker News