International
The Morning Dev

Only the news worth knowing

‹
 
B47/100

Supply-chain attack · high

Qubole supply chain attack hits over a dozen organizations

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Qubole customers whose secrets and credentials were accessed via compromised IAM

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Secrets exposed · Supply chain

What to do

  1. Rotate any secrets, keys, credentials and environment variables that were accessible through Qubole.
  2. Review Qubole-related IAM and cloud access logs for suspicious activity.

The Brief

  • Attackers used compromised Qubole IAM credentials to access customer environments.
  • Stolen data reportedly includes customer files, secrets, keys, environment variables and credentials.
  • Over a dozen organizations were reportedly hit by the supply chain attack.

Why it matters

Developers using Qubole may have had secrets, keys and credentials exposed through a trusted third-party platform, so any exposed credentials should be treated as compromised.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsQubole is a cloud data platform used by developers and data teams to run workloads.
NoCore infrastructureSingle vendor's platform; not software nearly every team runs like OpenSSH or GitHub.
NoPopular toolQubole is a specialized data platform, not a mainstream framework or tool many teams use.
YesExploited in the wildSecurityWeek: hackers used compromised Qubole IAM credentials to steal customer files and secrets.
NoPublic exploitSecurityWeek describes no published exploit code or proof-of-concept.
NoRemote, no loginSecurityWeek: attack used compromised IAM credentials, so authentication was required.
NoFull takeoverSecurityWeek does not report code execution, root/admin rights or full account takeover.
YesSecrets exposedSecurityWeek: hackers stole customer files, secrets, keys, environment variables and credentials.
YesSupply chainSecurityWeek headline: Over a Dozen Organizations Hit in Qubole Supply Chain Attack.
NoNo fix yetSecurityWeek does not state whether a patch or fix is available.

Timeline

  1. SecurityWeek reports over a dozen organizations hit in the Qubole supply chain attack

  2. SecurityWeek

    Over a Dozen Organizations Hit in Qubole Supply Chain Attack

Source

Over a Dozen Organizations Hit in Qubole Supply Chain Attack ↗ SecurityWeek · 2h ago

First seen · 1 source · Full story page · How tiers are decided