5 ms·

Hi, Felipe at Snowflake here. Here is the latest from Snowflake on this issue: https://community.snowflake.com/s/question/0D5VI00000Emyl00AB/detecting-and-prev

by fhoffa 2y ago

Hi, Felipe at Snowflake here. Here is the latest from Snowflake on this issue: https://community.snowflake.com/s/question/0D5VI00000Emyl00AB/detecting-and-preventing-unauthorized-user-access https://community.snowflake.com/s/question/0D5VI00000Emyl00A... We'll keep updating that URL with any further news.

p0seidon 2y ago
Will there be any direct comment regarding the article here?
- catchnear4321 2y ago
  the ad for protection services?
  - p0seidon 2y ago
    Yes, I know... I've seen that, also the posts on Reddit/HN and so on, but I am just curious if there is some truth to it.
    - catchnear4321 2y ago
      snowflake has released a handful of statements and articles. giving attention to the ad would only be promoting it. unlikely to be allowed.
- demosthanos 2y ago
  The linked post now contains unambiguous denials of the majority of claims in TFA, and TFA has been taken down.
Galanwe 2y ago
The salesforce.com servers are temporarily unable to respond to your request. We apologize for the inconvenience. Thank you for your patience, and please try again in a few moments.
- Kailhus 2y ago
  Sill down. “…Visit http://trust.salesforce.com http://trust.salesforce.com for current system status and availability.”
deleted 2y ago
[deleted]
BlackNitrogen 2y ago
The OP Hudson Rock writes something that I understand is saying: This was more than a breach of one customer's credentials, they got some employee creds and they weren't protected by 2 factor so they got into other customer accounts using that engineer's creds. The snowflake writeup reads to me as if a customer's account creds got compromised - and it implied to me that was the end of it, no central or other account access on thoes creds. Nothing about this use of some employee account info that didn't have 2 factor auth on it. 1. I'm sure snowflake wants all access creds of any kind for their internal employees to use 2fa. 2. It used to be at least as a customer you could create a name/password without 2fa to log in to your own info there if you wanted to, like say as a customer you create a db or table and want to access it.
- desert_rue 2y ago
  For 1. Those accounts would be set up by customers, so if they didn’t require 2FA, it didn’t happen.
hn_throwaway_99 2y ago
So, just to be clear because I found your link filled with a bit too much corporate speak: 1. The linked Hudson Rock post is explicitly claiming that the breaches at Ticketmaster and Santander Bank were caused by a Snowflake employee whose credentials were compromised. 2. This bullet point, "We did find evidence that similar to impacted customer accounts, the threat actor obtained personal credentials to and accessed a demo account owned by a former Snowflake employee. It did not contain sensitive data." (emphasis mine) says pretty clearly to me, then, that Snowflake believes the Hudson Rock account to be false. So is that a correct understanding then?

by fhoffa 2y ago

p0seidon 2y ago

Will there be any direct comment regarding the article here?

catchnear4321 2y ago
the ad for protection services?
- p0seidon 2y ago
  Yes, I know... I've seen that, also the posts on Reddit/HN and so on, but I am just curious if there is some truth to it.
  - catchnear4321 2y ago
    snowflake has released a handful of statements and articles. giving attention to the ad would only be promoting it. unlikely to be allowed.
demosthanos 2y ago
The linked post now contains unambiguous denials of the majority of claims in TFA, and TFA has been taken down.

Galanwe 2y ago

The salesforce.com servers are temporarily unable to respond to your request. We apologize for the inconvenience. Thank you for your patience, and please try again in a few moments.

Kailhus 2y ago
Sill down. “…Visit http://trust.salesforce.com http://trust.salesforce.com for current system status and availability.”

deleted 2y ago

[deleted]

BlackNitrogen 2y ago

The OP Hudson Rock writes something that I understand is saying: This was more than a breach of one customer's credentials, they got some employee creds and they weren't protected by 2 factor so they got into other customer accounts using that engineer's creds. The snowflake writeup reads to me as if a customer's account creds got compromised - and it implied to me that was the end of it, no central or other account access on thoes creds. Nothing about this use of some employee account info that didn't have 2 factor auth on it. 1. I'm sure snowflake wants all access creds of any kind for their internal employees to use 2fa. 2. It used to be at least as a customer you could create a name/password without 2fa to log in to your own info there if you wanted to, like say as a customer you create a db or table and want to access it.

desert_rue 2y ago
For 1. Those accounts would be set up by customers, so if they didn’t require 2FA, it didn’t happen.

hn_throwaway_99 2y ago

So, just to be clear because I found your link filled with a bit too much corporate speak: 1. The linked Hudson Rock post is explicitly claiming that the breaches at Ticketmaster and Santander Bank were caused by a Snowflake employee whose credentials were compromised. 2. This bullet point, "We did find evidence that similar to impacted customer accounts, the threat actor obtained personal credentials to and accessed a demo account owned by a former Snowflake employee. It did not contain sensitive data." (emphasis mine) says pretty clearly to me, then, that Snowflake believes the Hudson Rock account to be false. So is that a correct understanding then?