Digest · Sunday

Security digest: June 2, 2024

1 editorial brief and 2 critical advisories.

All digests · RSS · Markdown

Take stock

Check exposure: Snowflake / UNC5537. Anyone running Snowflake or a similar SaaS data warehouse with human or service users that still sign in with a password and no second factor, key pair or SSO, or without a network allow list.
crates.io (Rust): 1 critical advisory (qdrant). Check with cargo audit.
Maven: 1 critical advisory (org.silverpeas.core:silverpeas-core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

Jun 2, 2024 · Breach

Snowflake UNC5537: Customer Accounts Hit With Stolen Logins

There was no Snowflake bug to patch; the lesson is that any cloud data platform reachable with a password alone will eventually be logged into by someone holding an infostealer log.

Must act: Anyone running Snowflake or a similar SaaS data warehouse with human or service users that still sign in with a password and no second factor, key pair or SSO, or without a network allow list.

Can relax: Accounts that already enforce MFA or SSO for every human user, key-pair or OAuth auth for service users, and network policies did not match the pattern Mandiant found in this campaign.

Enforce MFA or SSO for every human user via an authentication policy; do not wait for your account's enforcement date
Move service users to key-pair or OAuth authentication and block password auth for them
Apply network policies so only known IP ranges can authenticate

Read the brief →