Cloud knowledge analytics firm Snowflake has discovered itself on the heart of a latest wave of suspected knowledge thefts as its enterprise prospects attempt to perceive whether or not their cloud knowledge shops have been compromised.
The Boston-based knowledge big helps a few of the world’s largest companies, together with banks, healthcare suppliers and expertise firms, retailer and analyze huge quantities of knowledge, similar to buyer knowledge, within the cloud.
Final week, Australian authorities sounded the alarm stating that they grew to become conscious of “profitable compromises of a number of firms utilizing the Snowflake surroundings,” with out naming the businesses. Hackers mentioned on a distinguished cybercrime discussion board that they’d stolen lots of of tens of millions of buyer data for Santander Financial institution and Ticketmaster, Snowflake’s two largest shoppers. Santander confirmed database violation “hosted by a 3rd social gathering supplier” however didn’t identify the supplier in query. On Friday, Reside Nation confirmed that its Ticketmaster subsidiary had been hacked and that the stolen database was hosted by Snowflake..
Snowflake confessed in a brief assertion that he was conscious of “doubtlessly unauthorized entry” to a “restricted quantity” of buyer accounts, with out specifying which of them, however that he discovered no proof of a direct breach of his techniques. Relatively, Snowflake referred to as it a “focused marketing campaign focusing on customers with single-factor authentication” and that the hackers used “beforehand bought or obtained by info theft malware” that’s designed to take away a person’s saved passwords from their laptop.
Regardless of the delicate knowledge Snowflake shops for its prospects, Snowflake permits every buyer to handle the safety of their surroundings with out mechanically enrolling or requiring its prospects to make use of multi-factor authentication, or MFA. in response to Snowflake buyer documentation. Cybercriminals allegedly obtained large quantities of knowledge from some Snowflake prospects, a few of whom configured their environments with out further safety measures, apparently attributable to a failure to implement MFA.
Snowflake acknowledged that considered one of its personal “demo accounts” was compromised as a result of it was not secured past a username and password, however mentioned the account “doesn’t comprise delicate knowledge.” It’s unclear whether or not this stolen demo account performed any position within the latest hacks.
TechCrunch this week uncovered lots of of purported Snowflake buyer credentials accessible on-line for cybercriminals to make use of as a part of hacking campaigns, suggesting that the danger of Snowflake buyer accounts being compromised could also be a lot wider than initially thought.
The credentials had been stolen by way of malware that contaminated the computer systems of workers with entry to their employer’s Snowflake surroundings.
A few of the credentials seen by TechCrunch seem to belong to workers of firms recognized to be Snowflake shoppers, together with Ticketmaster and Santander, amongst others. Workers with entry to Snowflake embody database engineers and knowledge analysts, a few of whom discuss their experiences utilizing Snowflake on their LinkedIn pages.
For its half, Snowflake suggested prospects to right away allow MFA for his or her accounts. Till then, Snowflake accounts that don’t require using MFA to log in expose their saved knowledge to the danger of being compromised by easy assaults similar to password theft and reuse.
How we checked the information
A supply acquainted with the cybercriminals’ operations pointed TechCrunch to a web site the place potential attackers can seek for lists of credentials which were stolen from varied sources, similar to by stealing details about malware on somebody’s laptop or matched to earlier knowledge breaches . (TechCrunch doesn’t hyperlink to the positioning the place the stolen credentials can be found to keep away from serving to attackers.)
In complete, TechCrunch discovered greater than 500 credentials containing worker usernames and passwords, in addition to net addresses of login pages for his or her respective Snowflake environments.
The found credentials seem to narrate to Snowflake environments owned by Santander, Ticketmaster, at the least two pharmaceutical giants, a meals supply service, a government-owned contemporary water provider and others. We additionally noticed uncovered usernames and passwords believed to belong to a former Snowflake worker.
TechCrunch just isn’t naming the previous worker as a result of there is no such thing as a proof he did something flawed. (Finally, Snowflake and its prospects are chargeable for implementing and imposing safety insurance policies that forestall intrusions ensuing from theft of worker credentials.)
We now have not verified stolen usernames and passwords as this could violate the regulation. Subsequently, it’s unknown whether or not the credentials are at present being actively used or whether or not they have immediately led to account compromise or knowledge theft. As an alternative, we labored to confirm the authenticity of the supplied credentials in different methods. This consists of checking particular person login pages into the Snowflake surroundings that had been opened by information-stealing malware and that had been nonetheless energetic and on-line on the time of writing.
The credentials we noticed included the worker’s electronic mail deal with (or username), their password, and a novel net deal with to log into their firm’s Snowflake surroundings. Once we checked the net addresses of Snowflake environments, which regularly include random letters and numbers, we discovered that the listed Snowflake buyer login pages had been publicly accessible, even when they might not be discovered on the Web.
TechCrunch has confirmed that Snowflake environments correspond to firms whose worker logins had been compromised. We had been in a position to do that as a result of each login web page we examined had two separate login choices.
One sign-in technique relies on Okta, a single sign-on supplier that enables Snowflake customers to register with their firm’s company credentials utilizing MFA. Throughout our checks, we discovered that these Snowflake login pages had been redirecting to Reside Nation (for Ticketmaster) and Santander login pages. We additionally found a set of credentials belonging to a Snowflake worker whose Okta login web page continues to redirect to an inner Snowflake login web page that not exists.
One other Snowflake login possibility permits the person to make use of solely their Snowflake username and password, relying on whether or not the enterprise consumer applies MFA to the account, as detailed in Snowflake’s personal documentation.. It seems that these credentials had been stolen by information-stealing malware from workers’ computer systems.
It’s unclear precisely when the workers’ credentials had been stolen or how lengthy they had been on-line.
There’s some proof to recommend that the computer systems of a number of workers who had entry to their firm’s Snowflake surroundings had beforehand been compromised by malware that stole info. In line with an audit of the breach notification service Have I Been Pwned, a number of company electronic mail addresses used as usernames to entry Snowflake environments had been present in latest knowledge dump containing tens of millions of stolen passwords obtained from varied Telegram channels used to trade stolen passwords.
Snowflake spokeswoman Danica Stanczak declined to reply TechCrunch’s particular questions, together with whether or not any of its shoppers’ knowledge was present in a Snowflake worker’s demo account. In its assertion, Snowflake mentioned it “suspends sure person accounts that present clear indicators of malicious exercise.”
Snowflake added: “Underneath Snowflake’s shared duty mannequin, prospects are chargeable for making certain MFA compliance for his or her customers.” The spokesperson mentioned Snowflake is “contemplating all choices to incorporate MFA, however we’ve not finalized any plans presently.”
Reached by electronic mail, Reside Nation spokeswoman Caitlin Henrick had no remark on the time of publication.
Santander didn’t reply to requests for remark.
Lack of MFA led to very large irregularities
Snowflake’s response to date leaves many questions unanswered and exposes many firms that aren’t profiting from the safety supplied by MFA.
One factor is obvious: Snowflake bears at the least some duty for not requiring its customers to allow a safety characteristic, and is now bearing the brunt of it – together with its prospects.
The Ticketmaster knowledge breach impacts greater than 560 million buyer data, in response to cybercriminals who promote on-line. (Reside Nation has not commented on what number of prospects had been affected by the hack.) If confirmed, Ticketmaster could be the most important knowledge breach within the US this 12 months and one of many largest in latest historical past.
Snowflake is the newest firm to be caught in a string of high-profile safety incidents and main knowledge breaches attributable to an absence of MFA.
Final 12 months, cybercriminals extracted roughly 6.9 million buyer data from 23andMe accounts. which weren’t protected with out MFA, which prompted the genetic testing firm… and its rivals – require from customers allow MFA by default to forestall a repeat assault.
And earlier this 12 months, UnitedHealth-owned well being expertise big Change Healthcare admitted hackers broke into its techniques and stole large quantities of confidential medical knowledge. from a system that isn’t protected with MFA. The well being care big has not but mentioned how many individuals had their info compromised, however mentioned it will doubtless have an effect on a “significant slice of individuals in America.”
Have you learnt extra about Snowflake account hacks? Contact. To contact this reporter, contact Sign and WhatsApp at +1 646-755-8849 or by electronic mail. You may as well ship recordsdata and paperwork by way of SecureDrop.