Cloud knowledge evaluation firm Snowflake is on the heart of a latest spate of alleged knowledge thefts, as its company clients scramble to know if their shops of cloud knowledge have been compromised.
Snowflake helps a few of the largest world firms — together with banks, healthcare suppliers and tech corporations — retailer and analyze their huge quantities of knowledge, equivalent to buyer knowledge, within the cloud.
Final week, Australian authorities sounded the alarm saying they had grow to be conscious of “profitable compromises of a number of corporations utilising Snowflake environments,” with out naming the businesses. Hackers had claimed on a recognized cybercrime discussion board that they’d stolen a whole bunch of thousands and thousands of buyer data from Santander Financial institution and Ticketmaster, two of Snowflake’s greatest clients. Santander confirmed a breach of a database “hosted by a third-party supplier,” however wouldn’t identify the supplier in query. On Friday, Stay Nation confirmed that its Ticketmaster subsidiary was hacked and that the stolen database was hosted on Snowflake.
Snowflake acknowledged in a brief statement that it was conscious of “probably unauthorized entry” to a “restricted quantity” of buyer accounts, with out specifying which of them, however that it has discovered no proof there was a direct breach of its techniques. Relatively, Snowflake known as it a “focused marketing campaign directed at customers with single-factor authentication” and that the hackers used “beforehand bought or obtained by infostealing malware,” which is designed to scrape a consumer’s saved passwords from their pc.
Regardless of the delicate knowledge that Snowflake holds for its clients, Snowflake lets every buyer handle the safety of their environments, and doesn’t robotically enroll or require its clients to make use of multi-factor authentication, or MFA, according to Snowflake’s customer documentation. Not imposing the usage of MFA seems to be how cybercriminals allegedly obtained enormous quantities of knowledge from a few of Snowflake’s clients, a few of which arrange their environments with out the extra safety measure.
Snowflake conceded that certainly one of its personal “demo” accounts was compromised as a result of it wasn’t protected past a username and password, however claimed the account “didn’t include delicate knowledge.” It’s unclear if this stolen demo account has any function within the latest breaches.
TheTrendyType has this week seen a whole bunch of alleged Snowflake buyer credentials which are obtainable on-line for cybercriminals to make use of as a part of hacking campaigns, suggesting that the danger of Snowflake buyer account compromises could also be far wider than first recognized.
The credentials have been stolen by infostealing malware that contaminated the computer systems of workers who’ve entry to their employer’s Snowflake surroundings.
A few of the credentials seen by TheTrendyType seem to belong to workers at corporations recognized to be Snowflake clients, together with Ticketmaster and Santander, amongst others. The staff with Snowflake entry embody database engineers and knowledge analysts, a few of whom reference their expertise utilizing Snowflake on their LinkedIn pages.
For its half, Snowflake has advised clients to right away change on MFA for his or her accounts. Till then, Snowflake accounts that aren’t imposing the usage of MFA to log in are placing their saved knowledge liable to compromise from easy assaults like password theft and reuse.
How we checked the info
A supply with data of cybercriminal operations pointed TheTrendyType to an internet site the place would-be attackers can search by lists of credentials which were stolen from varied sources, equivalent to infostealing malware on somebody’s pc or collated from earlier knowledge breaches. (TheTrendyType is just not linking to the location the place stolen credentials can be found in order to not support unhealthy actors.)
In all, TheTrendyType has seen greater than 500 credentials containing worker usernames and passwords, together with the net addresses of the login pages for the corresponding Snowflake environments.
The uncovered credentials seem to pertain to Snowflake environments belonging to Santander, Ticketmaster, at the very least two pharmaceutical giants, a meals supply service, a public-run freshwater provider, and others. We have now additionally seen uncovered usernames and passwords allegedly belonging to a former Snowflake worker.
TheTrendyType is just not naming the previous worker as a result of there’s no proof they did something incorrect. (It’s in the end each the accountability of Snowflake and its clients to implement and implement safety insurance policies that stop intrusions that consequence from the theft of worker credentials.)
We didn’t take a look at the stolen usernames and passwords as doing so would break the regulation. As such, it’s unknown if the credentials are at present in energetic use or in the event that they immediately led to account compromises or knowledge thefts. As an alternative, we labored to confirm the authenticity of the uncovered credentials in different methods. This consists of checking the person login pages of the Snowflake environments that have been uncovered by the infostealing malware, which have been nonetheless energetic and on-line on the time of writing.
The credentials we’ve seen embody the worker’s e-mail tackle (or username), their password, and the distinctive net tackle for logging in to their firm’s Snowflake surroundings. After we checked the net addresses of the Snowflake environments — typically made up of random letters and numbers — we discovered the listed Snowflake buyer login pages are publicly accessible, even when not searchable on-line.
TheTrendyType confirmed that the Snowflake environments correspond to the businesses whose workers’ logins have been compromised. We have been ready to do that as a result of every login web page we checked had two separate choices to sign up.
One option to login depends on Okta, a single sign-on supplier that permits Snowflake customers to sign up with their very own firm’s company credentials utilizing MFA. In our checks, we discovered that these Snowflake login pages redirected to Stay Nation (for Ticketmaster) and Santander sign-in pages. We additionally discovered a set of credentials belonging to a Snowflake worker, whose Okta login web page nonetheless redirects to an inside Snowflake login web page that now not exists.
Snowflake’s different login choice permits the consumer to make use of solely their Snowflake username and password, relying on whether or not the company buyer enforces MFA on the account, as detailed by Snowflake’s own support documentation. It’s these credentials that seem to have been stolen by the infostealing malware from the staff’ computer systems.
It’s not clear precisely when the staff’ credentials have been stolen or for the way lengthy they’ve been on-line.
There may be some proof to counsel that a number of workers with entry to their firm’s Snowflake environments had their computer systems beforehand compromised by infostealing malware. In accordance with a test on breach notification service Have I Been Pwned, a number of of the company e-mail addresses used as usernames for accessing Snowflake environments have been present in a recent data dump containing millions of stolen passwords scraped from varied Telegram channels used for sharing stolen passwords.
Snowflake spokesperson Danica Stanczak declined to reply particular questions from TheTrendyType, together with whether or not any of its clients’ knowledge was discovered within the Snowflake worker’s demo account. In an announcement, Snowflake stated it’s “suspending sure consumer accounts the place there are robust indicators of malicious exercise.”
Snowflake added: “Below Snowflake’s shared accountability mannequin, clients are answerable for imposing MFA with their customers.” The spokesperson stated Snowflake was “contemplating all choices for MFA enablement, however now we have not finalized any plans at the moment.”
When reached by e-mail, Stay Nation spokesperson Kaitlyn Henrich didn’t remark by press time.
Santander didn’t reply to a request for remark.
Lacking MFA resulted in enormous breaches
Snowflake’s response up to now leaves plenty of questions unanswered, and lays naked a raft of corporations that aren’t reaping the advantages that MFA safety offers.
What is obvious is that Snowflake bears at the very least some accountability for not requiring its customers to change on the safety characteristic, and is now bearing the brunt of that — together with its clients.
The info breach at Ticketmaster allegedly includes upwards of 560 million buyer data, in response to the cybercriminals promoting the info on-line. (Stay Nation wouldn’t touch upon what number of clients are affected by the breach.) If confirmed, Ticketmaster can be the most important U.S. knowledge breach of the yr up to now, and one of many greatest in latest historical past.
Snowflake is the newest firm in a string of high-profile safety incidents and sizable knowledge breaches attributable to the dearth of MFA.
Final yr, cybercriminals scraped around 6.9 million customer records from 23andMe accounts that weren’t protected with out MFA, prompting the genetic testing firm — and its competitors — to require customers enable MFA by default to forestall a repeat assault.
And earlier this yr, the UnitedHealth-owned well being tech large Change Healthcare admitted hackers broke into its systems and stole huge amounts of sensitive health data from a system not protected with MFA. The healthcare large hasn’t but stated what number of people had their info compromised however stated it’s prone to have an effect on a “substantial proportion of individuals in America.”
Have you learnt extra in regards to the Snowflake account intrusions? Get in contact. To contact this reporter, get in contact on Sign and WhatsApp at +1 646-755-8849, or by email. You may as well ship recordsdata and paperwork through SecureDrop.
