GoKawiilWritten by: Ido Shlomo, Co-founder and CTO, Token Security
Connor Moucka did not exploit a vulnerability in Snowflake. He and his co-conspirators used valid customer credentials, many of them years old, to log in, reaching more than 165 Snowflake customer organizations.
They stole billions of records, including the call and text records of nearly all of AT&T’s wireless customers. Moucka pleaded guilty on August 5 to computer fraud, wire fraud, aggravated identity theft, and conspiracy.
The campaign exposed a familiar identity failure: credentials remained valid long after their exposure, the affected accounts lacked a second factor, and network restrictions were often absent.
Snowflake is now forcing customers to confront that identity debt by focusing on non-human identities.
During Phase 3 of its authentication rollout, Snowflake is migrating legacy service users to the SERVICE type, which will block password-based authentication. Replacing those passwords is the mechanical part.
Discovering what uses each account has, assigning an owner, and deciding how much access it still needs is the real challenge.
The accounts that still have a password
Soon, every service account will be blocked from authenticating with a password. The LEGACY_SERVICE user type is being fully deprecated, and existing legacy accounts are being migrated to SERVICE, which cannot store a password.
Snowflake runs the deprecation in three phases, and the first two have already closed most of the doors:
... continue reading