Hacker confirms access through infostealer infection [withdrawn]

Post by p0seidon » Sat, Jun 01, 2024, 2:10 PM UTC

beardedwizard wrote: post #219

demosthanos wrote: post #215

Earlier quoted context omitted.

@dang is a no-op, consider contacting at the email in the footer. But on the other hand, that they yanked the blog post is interesting and shouldn't be glossed over by just linking to the archive. What changed? Edit: It looks like Snowflake's official response denies essentially all of the claims in TFA. Maybe Hudson Rock got taken in by a dishonest source and pulled the article when they realized their mistake? http…

extremely likely scenario. Hudson tried to write a splashy hit piece and was met with reality.

Post by ExoticPearTree » Sat, Jun 01, 2024, 2:34 PM UTC

waihtis wrote: post #96

hangtime79 wrote: post #87

I don't work for Snowflake but I spend a lot of time working with them and their SE organisation. When working and building demos with clients, SEs create demonstration environments on the same $400 Snowflake demo accounts anyone can. To build demos the client would grant access to that SE. The SE would take some of the data to the demo environment and then work on it. This is further confirmed by the name of the env…

The whole blog post reeks of extreme self-congratulation and youre right, a total scum move to expose the victim. Altogether very weak performance from Hudson Rock.

Post by darth_avocado » Sat, Jun 01, 2024, 4:30 PM UTC

billythemaniam wrote: post #217

donalhunt wrote: post #166

Earlier quoted context omitted.

You can definitely bring your own storage (e.g. store your data in your own s3 buckets and integrate it with snowflake) using storage integrations and external tables. See https://docs.snowflake.com/en/user-guide/data-load-s3-config... Personally believe this is the right approach as the data resides in a location fully under the company's control. You could ditch snowflake and the data still resides in your s3 bucke…

Yes, federated queries (external tables) are supported but that is a lot slower than ingesting the data into Snowflake's storage and querying it. Since Snowflake's pricing model is based on computation time, querying external tables are usually more costly because of worse performance.

Post by [deleted] » Sat, Jun 01, 2024, 5:05 PM UTC

p0seidon wrote: post #113

bawolff wrote: post #111

Earlier quoted context omitted.

Indeed, the less novel the exploit the more embarassing it is. Data stolen because of some crazy multi-exploit zero day chain. Well that is understandable, i don't blame the company. Data stolen because no 2FA support? In 2024 that is just embarassing.

Yes, that's also what I think must have happened—missing 2FA. But it seems it's also not mandatory within Snowflake accounts also, from what I understand from the general message. I've never used Snowflake and assumed that because you push all your data into it, it probably has 2FA enabled by default. Is it optional?

Post by kwillets » Sat, Jun 01, 2024, 5:25 PM UTC

wokwokwok wrote: post #181

Galanwe wrote: post #141

Earlier quoted context omitted.

So the customer data is actually stored on Snowflakes AWS accounts? What difference does it make what underlying storage / provider it uses then? Also does that mean every data query to snowflake goes out/in to/from internet at egress/Ingress costs?

> So the customer data is actually stored on Snowflakes AWS accounts? Yes. > Also does that mean every data query to snowflake goes out/in to/from internet at egress/Ingress costs? Yes. It's covered comprehensively in their docs, along with the caveats. > What difference does it make what underlying storage / provider it uses then? "Snowflake does not charge data ingress fees. However, a cloud storage provider might…