5 ms·

How has Snowflake felt ANY recourse for being the source of all of these hacks?

beardedwizard 2y ago
The dark web and info stealing malware are the source of the hacks. My worry is not only that consumers get numb to breaches, but they consume rampant misinformation and have no idea how to hold appropriate parties accountable. How many times have you held AWS accountable for stolen access keys? Was it AWS fault when rabbit leaked their own keys? Is it snowflakes fault when you lose your creds to infostealing malware? How should snowflake enforce mfa on machine service account credentials? The answers are no, no, and they can not possibly. Not even hyperscalers have this magic.
- edm0nd 2y ago
  Eh, iirc the source of the hack was just regular stealers like Redline, not "the dark web". It was actually Snowflakes fault. The threat actors were able to find a test/demo account they could log into and from there they were able to access prod things they shouldnt have.
  - beardedwizard 2y ago
    This is exactly the kind of comment I'm talking about. You have not read anything from snowflake, mandiant or crowdstrike on this, and you haven't even read the cnn article that has snowflakes response on this. The snowflake demo account has nothing to do with it.
    - edm0nd 2y ago
      No, its what happened 100%. Funnily enough, its YOU who hasnt read anything. https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion https://cloud.google.com/blog/topics/threat-intelligence/unc... "In April 2024, Mandiant received threat intelligence on database records that were subsequently determined to have originated from a victim’s Snowflake instance. Mandiant notified the victim, who then engaged Mandiant to investigate suspected data theft involving their Snowflake instance. During this investigation, Mandiant determined that the organization’s Snowflake instance had been compromised by a threat actor using credentials previously stolen via infostealer malware. The threat actor used these stolen credentials to access the customer’s Snowflake instance and ultimately exfiltrate valuable data. At the time of the compromise, the account did not have multi-factor authentication (MFA) enabled." https://www.symmetry-systems.com/blog/what-we-know-so-far-about-the-snowflake-breach/ https://www.symmetry-systems.com/blog/what-we-know-so-far-ab... "Snowflake has confirmed that a threat actor obtained credentials of a single former employee and accessed demo accounts they had access to. Snowflake asserts these accounts contained no “sensitive” data and were isolated from production and corporate systems. However, unlike Snowflake’s core systems, which are protected by Okta and Multi-Factor Authentication (MFA), these dormant demo accounts lacked such safeguards. "
taspeotis 2y ago
> Snowflake blamed the data thefts on its customers for not using multi-factor authentication to secure their Snowflake accounts
Aaronstotle 2y ago
its not Snowflake's fault their customers used weak passwords and no MFA. Not enforcing MFA does merit some blame on Snowflake, however, I still think its on the customer to secure your own environment.
- smcin 2y ago
  Snowflake is saying they knew of unusual activity "around mid-April 2024", confirmed "May 23, 2024", around which time they made MFA mandatory (although their customer AT&T say they knew of the breach "Mar 20"; these timelines keep shifting back): "Mandatory MFA option unveiled by Snowflake" - Jul 11, 2024 https://www.scmagazine.com/brief/mandatory-mfa-option-unveiled-by-snowflake https://www.scmagazine.com/brief/mandatory-mfa-option-unveil... > "US cloud storage firm Snowflake has already required the implementation of multi-factor authentication across all user accounts a month following the widespread breach of customer accounts, including those of Ticketmaster and Santander Bank, reports The Register."
  - iaabtpbtpnn 2y ago
    It's not mandatory, I still have Snowflake user accounts that don't use MFA.
    - smcin 2y ago
      "Mandatory MFA option unveiled by Snowflake" sounds like they made it an option for an organization to decide to make MFA mandatory within that organization. But that conflicts with TheRegister headline - Snowflake's PR machine seems to be in overdrive.
- mewpmewp2 2y ago
  It's industry standard to enforce MFA for customers of such sensitive data though. There's always going to be weak links.
- chefandy 2y ago
  Right. Snowflake facilitated AT&T'S abject negligence, but ultimately the buck stops with AT&T, here.
sickofparadox 2y ago
The Mandiant report said that some Snowflake customers declined to use MFA AND had passwords in place for 4+ years[1]. Maybe Snowflake should have pushed for MFA harder but at the end of the day, this is AT&T's fault. [1] https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion https://cloud.google.com/blog/topics/threat-intelligence/unc...
- Ragnarork 2y ago
  I'd say the blame lies halfway between AT&T and Snowflake. If you let your customers have poor security practices, and you have the power to ensure a heightened security level, you're also partly to blame...
  - theluketaylor 2y ago
    Snowflake also made it hard to have good practices, giving them further culpability. There was no setting for customers to force their entire tenant to enforce MFA. Customers had to depend on each person with access to do the right thing, something that is unlikely to be universally true.
- wredue 2y ago
  Non-expiring passwords is probably no more or less secure, unless you are a rampantly terrible employer known for setting ablaze every bridge ever to the point of atomic annihilation.
  - dylan604 2y ago
    Are you suggesting a disgruntled former employee could use the password and do things? At that point, I have questions. How is the former employee accessing the cloud service? If your cloud is allowing public access without a VPN, then you've done something wrong there. If the former employee is still accessing your VPN, again, you've done something wrong. Many other things still come to mind but point back to you well before password rotation rules.

The dark web and info stealing malware are the source of the hacks. My worry is not only that consumers get numb to breaches, but they consume rampant misinformation and have no idea how to hold appropriate parties accountable. How many times have you held AWS accountable for stolen access keys? Was it AWS fault when rabbit leaked their own keys? Is it snowflakes fault when you lose your creds to infostealing malware? How should snowflake enforce mfa on machine service account credentials? The answers are no, no, and they can not possibly. Not even hyperscalers have this magic.

edm0nd 2y ago
Eh, iirc the source of the hack was just regular stealers like Redline, not "the dark web". It was actually Snowflakes fault. The threat actors were able to find a test/demo account they could log into and from there they were able to access prod things they shouldnt have.
- beardedwizard 2y ago
  This is exactly the kind of comment I'm talking about. You have not read anything from snowflake, mandiant or crowdstrike on this, and you haven't even read the cnn article that has snowflakes response on this. The snowflake demo account has nothing to do with it.
  - edm0nd 2y ago
    No, its what happened 100%. Funnily enough, its YOU who hasnt read anything. https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion https://cloud.google.com/blog/topics/threat-intelligence/unc... "In April 2024, Mandiant received threat intelligence on database records that were subsequently determined to have originated from a victim’s Snowflake instance. Mandiant notified the victim, who then engaged Mandiant to investigate suspected data theft involving their Snowflake instance. During this investigation, Mandiant determined that the organization’s Snowflake instance had been compromised by a threat actor using credentials previously stolen via infostealer malware. The threat actor used these stolen credentials to access the customer’s Snowflake instance and ultimately exfiltrate valuable data. At the time of the compromise, the account did not have multi-factor authentication (MFA) enabled." https://www.symmetry-systems.com/blog/what-we-know-so-far-about-the-snowflake-breach/ https://www.symmetry-systems.com/blog/what-we-know-so-far-ab... "Snowflake has confirmed that a threat actor obtained credentials of a single former employee and accessed demo accounts they had access to. Snowflake asserts these accounts contained no “sensitive” data and were isolated from production and corporate systems. However, unlike Snowflake’s core systems, which are protected by Okta and Multi-Factor Authentication (MFA), these dormant demo accounts lacked such safeguards. "

taspeotis 2y ago

> Snowflake blamed the data thefts on its customers for not using multi-factor authentication to secure their Snowflake accounts

Aaronstotle 2y ago

its not Snowflake's fault their customers used weak passwords and no MFA. Not enforcing MFA does merit some blame on Snowflake, however, I still think its on the customer to secure your own environment.

smcin 2y ago
Snowflake is saying they knew of unusual activity "around mid-April 2024", confirmed "May 23, 2024", around which time they made MFA mandatory (although their customer AT&T say they knew of the breach "Mar 20"; these timelines keep shifting back): "Mandatory MFA option unveiled by Snowflake" - Jul 11, 2024 https://www.scmagazine.com/brief/mandatory-mfa-option-unveiled-by-snowflake https://www.scmagazine.com/brief/mandatory-mfa-option-unveil... > "US cloud storage firm Snowflake has already required the implementation of multi-factor authentication across all user accounts a month following the widespread breach of customer accounts, including those of Ticketmaster and Santander Bank, reports The Register."
- iaabtpbtpnn 2y ago
  It's not mandatory, I still have Snowflake user accounts that don't use MFA.
  - smcin 2y ago
    "Mandatory MFA option unveiled by Snowflake" sounds like they made it an option for an organization to decide to make MFA mandatory within that organization. But that conflicts with TheRegister headline - Snowflake's PR machine seems to be in overdrive.
mewpmewp2 2y ago
It's industry standard to enforce MFA for customers of such sensitive data though. There's always going to be weak links.
chefandy 2y ago
Right. Snowflake facilitated AT&T'S abject negligence, but ultimately the buck stops with AT&T, here.

sickofparadox 2y ago

The Mandiant report said that some Snowflake customers declined to use MFA AND had passwords in place for 4+ years[1]. Maybe Snowflake should have pushed for MFA harder but at the end of the day, this is AT&T's fault. [1] https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion https://cloud.google.com/blog/topics/threat-intelligence/unc...

Ragnarork 2y ago
I'd say the blame lies halfway between AT&T and Snowflake. If you let your customers have poor security practices, and you have the power to ensure a heightened security level, you're also partly to blame...
- theluketaylor 2y ago
  Snowflake also made it hard to have good practices, giving them further culpability. There was no setting for customers to force their entire tenant to enforce MFA. Customers had to depend on each person with access to do the right thing, something that is unlikely to be universally true.
wredue 2y ago
Non-expiring passwords is probably no more or less secure, unless you are a rampantly terrible employer known for setting ablaze every bridge ever to the point of atomic annihilation.
- dylan604 2y ago
  Are you suggesting a disgruntled former employee could use the password and do things? At that point, I have questions. How is the former employee accessing the cloud service? If your cloud is allowing public access without a VPN, then you've done something wrong there. If the former employee is still accessing your VPN, again, you've done something wrong. Many other things still come to mind but point back to you well before password rotation rules.