The IT Nerd

Threat group ShinyHunters, who recently claimed responsibility for Santander and Ticketmaster breaches, claimed they stole data from cloud storage company Snowflake after hacking into an employee’s account. They have also claimed to gain access to data from other high-profile Snowflake customers. I wrote about Ticketmaster here, and Santander here if you want to get up to speed on those.

I gathered up some commentary from industry leaders on this week’s events:

Glenn Chisholm, Co-founder and Chief Product Officer, Obsidian Security

“This year, we have seen a sequence of breaches that have affected major SaaS vendors, such as Microsoft, Okta, and now Snowflake. The commonality across these breaches is identity; the attackers are not breaking in, they are logging in. In IR engagements we have seen through partners like CrowdStrike, we see SaaS breaches often starting with identity compromises–in fact 82% of SaaS breaches stem from identity compromises such as spear phishing, token theft and reuse, helpdesk social engineering, etc. This includes user identities as well as non-human (application) identities.

SaaS is now a very active space where attacks are occurring across the spectrum, from targeted APTs to financially motivated attackers, and every company needs to carefully review its SaaS security program. Ensure the correct application posture to minimize risk, protect their identities which form the perimeter of your SaaS applications, and secure their data movement. These must be a continuous program since your applications evolve, configurations change, identities get introduced, and attackers change their patterns. In other words, you need automation to scale this across all your SaaS applications.”

Will Lin, co-Founder and CEO, AKA Identity and Author, The VC Field Guide and former Venture Partner, ForgePoint Capital

“This breach is so complicated and simple at the same time. Simple that the attack vector was stolen privileged credentials. ‘Bad actors don’t hack in, they log in.’ Complicated because it involves multiple parties who can only do so much to prevent this from happening. The predicament that the world has today is that credentials have been the number one cause of data breaches since the DBIR started tracking them. The modern world has been set up to fail without good data and visibility into their most important trust boundary: identities and access management.”

Avishai Avivi, CISO, SafeBreach

“The latest Snowflake breach surfaces multiple troubling aspects about the potential impact of shifting to massive data lakes hosted on a cloud provider. Combine this with compromised credentials and a session cookie hijack, and you have the perfect storm. It’s important to understand that we are still in the early stages of identifying the specifics of this incident. Hudson Rock’s insightful blog post provides some understanding. The attacker seems to have gained initial access through a combination of stolen credentials from a sales engineer and session hijacking.

At this point, we have to shift to some educated hypothesis and conjecture. The malicious actor then used a single set of credentials with access to a single backend cloud-based platform, ServiceNow, that Snowflake uses to effect a breach on dozens, potentially hundreds, of Snowflake’s customers.

The ability to leverage this single entry vector to access the data of multiple customers indicated:

• Initial infection by a known malware – It appears that credentials were compromised by the Lumma malware back in October 2023. Indicating the EDR control failed to detect it.
• Multifactor Authentication (MFA) was not deployed uniformly – MFA makes the ability to use stolen credentials in this way very difficult.
• Continuous vs. Just-In-Time (JIT) privileged access – It seems like, at best, the authorized session the malicious actor was able to take advantage of was not following best practices and did not force refreshed authentication.
• A deficient segregation of duties – a single sales engineer should not be able to access dozens of customers’ data.
• The malicious actor was able to exfiltrate customer data – The fact that massive amounts of customer data were exfiltrated indicates lax egress traffic monitoring and control.

Aside from the actual breach, the alarming aspect is that Snowflake appears to have a very robust security program. They claim to have all the proper security certifications their customers may require. This breach reinforces the point that implementing the right technology controls is just the first step; the only way to know the efficacy of those technologies is to continuously test them using a comprehensive security control validation program. Traditional penetration testing programs are not sufficient either. Organizations must test the ability of a malicious actor to move laterally throughout its environment and then leave with the data they were able to access.”

Recently, threat actors who go by the name of ShinyHunters claimed to have pwned TicketMaster breached and claimed to have compromised 560 million users which is part of a 1.3 TB database. ShinyHunters have claimed to have exfiltrated full names, phone numbers, home addresses, email addresses, payment card info, ticket sales and event information, and order information. The stolen data is being sold on BreachForms for $500,000.

While the threat group has contacted Ticketmaster, they have not yet acknowledged the incident publicly. Ticketmaster has faced cyber incidents in the past, including a bot attack against the ticketing system, disrupting Taylor Swift concert ticket sales. Which makes their problems with the US Justice Department seem trivial in comparison.

Darren Williams, CEO and Founder, BlackFog:

“The breach of TicketMaster shows us how large-scale these operations can be. Now that the data has been exfiltrated from TicketMaster, the threat group can continuously target the individuals through social engineering and phishing attempts. Large entities, especially those such as TicketMaster, must invest in anti data exfiltration technology to ensure no data is leaving their system without proper authorization.”

TicketMaster needs to say something. As in confirming what we already know and what they are going to do to ensure that they don’t get pwned again. They may not think that they have to say anything. But if they don’t, I guarantee that their troubles will multiply.

UPDATE: Ted Miracco, CEO, Approov Mobile Security had this to say:

   “Ticketmaster and LiveNation are not alone. ShinyHunters, a notorious black-hat hacking group, has claimed responsibility for major data breaches at companies including Microsoft, Tokopedia, Wattpad, Pluto TV, Animal Jam, Mashable, and many others. ShinyHunters employ sophisticated techniques like exploiting GitHub repositories, unsecured cloud storage, phishing attacks, and stealing credentials/API keys to gain unauthorized access.

   “The sophistication of these attacks underscores the necessity for robust security practices, including both cloud based API security used in combination with robust edge based security including mobile app attestation and runtime application self-protection (RASP) to defend against such attacks.”