Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker confirms access through infostealer infection [withdrawn]

hudsonrock.com

Post reply on HN
Print view View original

21–30 of 235 posts

Re: Hacker confirms access through infostealer infection [withdrawn]

#21

Post by FromOmelas »

abadpoli wrote: post #5

Why in the world would obtaining a Snowflake employee’s credentials allow you to then obtain Snowflake’s customers’ data? Doesn’t this imply that people working at Snowflake can see all of the data that I put in it? Admittedly I don’t have much experience with Snowflake, but as a baseline I expect better from a “cloud storage giant”.

No, that sounds about right. This is a new, agile, cloud-first company that grew very quickly and has faced significant turnover. You don't get such growth by doing everything right.

Looking at linked-in, the unlucky employee could be someone in a sales role, with only 7 months of tenure. Every company has a few sysadmins with a scary amount of reach, but that's not what happened here.

Edit: A ServiceNow access request flow with poor internal controls would explain it.

Re: Hacker confirms access through infostealer infection [withdrawn]

#22

Post by ransom1538 »

NameError wrote: post #3

This article is claiming that the Ticketmaster breach from a few days ago was actually a much broader hack affecting 400+ companies, all through a Snowflake employee's stolen credentials. This seems like a pretty big story that's only being reported on hudsonrock.com now. I haven't heard of Hudson Rock before, does anyone know if they are a reputable source?

Snowflake employees need time to sell off all their shares. This news will hurt the SNOW stock price big.

Re: Hacker confirms access through infostealer infection [withdrawn]

#23

Post by p0seidon »

tomashertus wrote: post #10
skilled wrote: post #7

At least based on the wording of the perpetrator, Snowflake really did have the system designed in a way where a single administrator account gives you carte blanche to everything. > On may 31st, Snowflake released a statement in which they claim that they are investigating an industry-wide identity-based attacks that have impacted “some” of their customers. https://community.snowflake.com/s/question/0D5VI00000Emyl00…

If the threat actor has played it right, there is a high possibility that this will be the largest data breach in history.

So the account was without 2FA protection?

Re: Hacker confirms access through infostealer infection [withdrawn]

#24

Post by BillFranklin »

It sounds like they found a way to bypass MFA on snowflake (because snowflake didn’t expire session cookies), and stole an employees credential, obtained via a “Lumma-type Infostealer” which I guess is just a key logger in browser extensions and fake versions of software…

Re: Hacker confirms access through infostealer infection [withdrawn]

#25

Post by gregates »

skilled wrote: post #7

At least based on the wording of the perpetrator, Snowflake really did have the system designed in a way where a single administrator account gives you carte blanche to everything. > On may 31st, Snowflake released a statement in which they claim that they are investigating an industry-wide identity-based attacks that have impacted “some” of their customers. https://community.snowflake.com/s/question/0D5VI00000Emyl00…

That's what the article implies, but I think it's overblown. They provide enough information (unfortunately) to identify the employee whose credentials were stolen, and she's a Sales Engineer. The data seems to have come from her own Snowflake account, which was used to build demos for customers or prospective customers. It's quite possible that those customers granted her access to some of their actual data, which was used in those demos, but it's a far cry from unfettered access to the customer's Snowflake database itself. It's also quite possible that the hacker exfiltrated fake-but-realistic data used for demo purposes and doesn't know the difference.

Re: Hacker confirms access through infostealer infection [withdrawn]

#26

Post by dralley »

proactivesvcs wrote: post #4
NameError wrote: post #3

This article is claiming that the Ticketmaster breach from a few days ago was actually a much broader hack affecting 400+ companies, all through a Snowflake employee's stolen credentials. This seems like a pretty big story that's only being reported on hudsonrock.com now. I haven't heard of Hudson Rock before, does anyone know if they are a reputable source?

BBC News report of a substantial hack of Santander bank; linked to Snowflake. https://www.bbc.co.uk/news/articles/c6ppv06e3n8o

BBC just linked back to Hudson Rock's allegation FWIW, they don't have any independent confirmation

Re: Hacker confirms access through infostealer infection [withdrawn]

#27

Post by finack »

tomashertus wrote: post #10
skilled wrote: post #7

At least based on the wording of the perpetrator, Snowflake really did have the system designed in a way where a single administrator account gives you carte blanche to everything. > On may 31st, Snowflake released a statement in which they claim that they are investigating an industry-wide identity-based attacks that have impacted “some” of their customers. https://community.snowflake.com/s/question/0D5VI00000Emyl00…

If the threat actor has played it right, there is a high possibility that this will be the largest data breach in history.

[flagged]

Re: Hacker confirms access through infostealer infection [withdrawn]

#28

Post by richbell »

NameError wrote: post #3

This article is claiming that the Ticketmaster breach from a few days ago was actually a much broader hack affecting 400+ companies, all through a Snowflake employee's stolen credentials. This seems like a pretty big story that's only being reported on hudsonrock.com now. I haven't heard of Hudson Rock before, does anyone know if they are a reputable source?

> I haven't heard of Hudson Rock before, does anyone know if they are a reputable source?

I first learned of Hudson Rock after their "CEO" started spamming every security-related subreddit with low-effort blogspam over a period of months alleging numerous breaches. They've had several accounts banned, both by Reddit moderators and administrators.

Personally, I would no consider them a reputable or reliable source.

Re: Hacker confirms access through infostealer infection [withdrawn]

#29

Post by [deleted] »

NameError wrote: post #3

This article is claiming that the Ticketmaster breach from a few days ago was actually a much broader hack affecting 400+ companies, all through a Snowflake employee's stolen credentials. This seems like a pretty big story that's only being reported on hudsonrock.com now. I haven't heard of Hudson Rock before, does anyone know if they are a reputable source?

[deleted]
Post reply on HN