Threat group ShinyHunters, who recently claimed responsibility for Santander and Ticketmaster breaches, claimed they stole data from cloud storage company Snowflake after hacking into an employee’s account. They have also claimed to gain access to data from other high-profile Snowflake customers. I wrote about Ticketmaster here, and Santander here if you want to get up to speed on those.
I gathered up some commentary from industry leaders on this week’s events:
Glenn Chisholm, Co-founder and Chief Product Officer, Obsidian Security
“This year, we have seen a sequence of breaches that have affected major SaaS vendors, such as Microsoft, Okta, and now Snowflake. The commonality across these breaches is identity; the attackers are not breaking in, they are logging in. In IR engagements we have seen through partners like CrowdStrike, we see SaaS breaches often starting with identity compromises–in fact 82% of SaaS breaches stem from identity compromises such as spear phishing, token theft and reuse, helpdesk social engineering, etc. This includes user identities as well as non-human (application) identities.
SaaS is now a very active space where attacks are occurring across the spectrum, from targeted APTs to financially motivated attackers, and every company needs to carefully review its SaaS security program. Ensure the correct application posture to minimize risk, protect their identities which form the perimeter of your SaaS applications, and secure their data movement. These must be a continuous program since your applications evolve, configurations change, identities get introduced, and attackers change their patterns. In other words, you need automation to scale this across all your SaaS applications.”
Will Lin, co-Founder and CEO, AKA Identity and Author, The VC Field Guide and former Venture Partner, ForgePoint Capital
“This breach is so complicated and simple at the same time. Simple that the attack vector was stolen privileged credentials. ‘Bad actors don’t hack in, they log in.’ Complicated because it involves multiple parties who can only do so much to prevent this from happening. The predicament that the world has today is that credentials have been the number one cause of data breaches since the DBIR started tracking them. The modern world has been set up to fail without good data and visibility into their most important trust boundary: identities and access management.”
Avishai Avivi, CISO, SafeBreach
“The latest Snowflake breach surfaces multiple troubling aspects about the potential impact of shifting to massive data lakes hosted on a cloud provider. Combine this with compromised credentials and a session cookie hijack, and you have the perfect storm. It’s important to understand that we are still in the early stages of identifying the specifics of this incident. Hudson Rock’s insightful blog post provides some understanding. The attacker seems to have gained initial access through a combination of stolen credentials from a sales engineer and session hijacking.
At this point, we have to shift to some educated hypothesis and conjecture. The malicious actor then used a single set of credentials with access to a single backend cloud-based platform, ServiceNow, that Snowflake uses to effect a breach on dozens, potentially hundreds, of Snowflake’s customers.
The ability to leverage this single entry vector to access the data of multiple customers indicated:
- Initial infection by a known malware – It appears that credentials were compromised by the Lumma malware back in October 2023. Indicating the EDR control failed to detect it.
- Multifactor Authentication (MFA) was not deployed uniformly – MFA makes the ability to use stolen credentials in this way very difficult.
- Continuous vs. Just-In-Time (JIT) privileged access – It seems like, at best, the authorized session the malicious actor was able to take advantage of was not following best practices and did not force refreshed authentication.
- A deficient segregation of duties – a single sales engineer should not be able to access dozens of customers’ data.
- The malicious actor was able to exfiltrate customer data – The fact that massive amounts of customer data were exfiltrated indicates lax egress traffic monitoring and control.
Aside from the actual breach, the alarming aspect is that Snowflake appears to have a very robust security program. They claim to have all the proper security certifications their customers may require. This breach reinforces the point that implementing the right technology controls is just the first step; the only way to know the efficacy of those technologies is to continuously test them using a comprehensive security control validation program. Traditional penetration testing programs are not sufficient either. Organizations must test the ability of a malicious actor to move laterally throughout its environment and then leave with the data they were able to access.”
Security Researcher Finds That Microsoft Recall Is A Bigger Disaster Than We All Thought
Posted in Commentary with tags Microsoft, Privacy on June 3, 2024 by itnerdAlong with the release of Windows laptops using the Snapdragon X Elite processor, Microsoft released a bunch of new AI features for Windows 11. Including something called Microsoft Recall which literally takes snapshots of everything that you do on the PC. At the time, I said this:
Here’s where things get sketchy. While Recall apparently encrypts everything that it is taking a picture of, Recall with the default settings is taking pictures of everything. So if you do online banking, enter your SIN number online, or do anything else that is sensitive, Recall will likely know about it. Think of the fun a threat actor could have if they somehow managed to pwn the PC and got access to that data. And don’t think that threat actors aren’t thinking about giving that a shot as they know that it’s a potential gold mine of information that they can sell on the dark web. Never mind use against you. Now at this point a threat actor would likely have to have physical access to the device as this info is stored locally. But the one thing that I have learned over the years is that threat actors are creative and crafty individuals. So if there’s another attack vector out there that will allow them to grab this data, they will find it. And exploit it.
Well, it now seems that this might be worse than previously thought. The Verge has surfaced just how vulnerable Recall actually is:
Despite Microsoft’s promises of a secure and encrypted Recall experience, cybersecurity expert Kevin Beaumont has found that the AI-powered feature has some potential security flaws. Beaumont, who briefly worked at Microsoft in 2020, has been testing out Recall over the past week and discovered that the feature stores data in a database in plain text. That could make it trivial for an attacker to use malware to extract the database and its contents.
“Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder,” explains Beaumont in a detailed blog post. “This database file has a record of everything you’ve ever viewed on your PC in plain text.”
Beaumont shared an example of the plain text database on X, scolding Microsoft for telling media outlets that a hacker cannot exfiltrate Recall activity remotely. The database is stored locally on a PC, but it’s accessible from the AppData folder if you’re an admin on a PC. Two Microsoft engineers demonstrated this at Build recently, and Beaumont claims the database is accessible even if you’re not an admin.
Well that’s just incredibly horrible. Because now that we know that pwnage is possible, threat actors around the globe will be figuring out how to pwn anyone who is running this feature. Even if technical details are being withheld.
But I am not done yet. It actually gets worse:
Beaumont has exfiltrated his own Recall database and created a website where you can upload a database and instantly search it. “I am deliberately holding back technical details until Microsoft ship the feature as I want to give them time to do something,” he says.
You would think a company the size of Microsoft would have had a few security researchers try to find vulnerabilities in this feature before even announcing it? But I guess not. It truly sounds like to me that Microsoft needs to do a recall of Recall, because it’s simply not something that users can trust to be secure. Thus it’s not ready for primetime.
1 Comment »