cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
cPGuard disclosed that a credential was leaked, exposing a trust relationship that could have been abused.
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers.
An attacker has compromised the update infrastructure of cPGuard, a security suite for Linux web hosting servers, and pushed out a malicious update to nearly 3,000 customer servers.
Its later disclosure says version 5.88.26 removes the backdoor, and a follow-up update removes a scheduled task the script also left, and in a later disclosure , OPSSHIELD said about 2,950 customer servers ran the script, which sent the files it collected back to the attacker.
The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory .
The company has also revoked the stolen update key and its cloud access keys, and is rebuilding its billing, licensing and internal servers from clean images.
The company revoked the stolen update-storage key along with all cloud API tokens and access keys; removed the attacker’s SSH key, cloned servers and snapshots from its cloud account; and enabled stronger login protection.
Separately, OPSSHIELD said it was releasing another update, as a precaution, that removes its support-access keys from cPGuard servers where they were added earlier.
At 02:06 UTC, the attacker, who has not been identified, used compromised credentials to get into cPGuard's update system, and the attack was detected within 12 hours of those versions going out, according to OPSSHIELD.
Credentials the script copied may still work after the update, so any server that may have run the script also needs new passwords and keys.
OPSSHIELD asks admins to update every cPGuard server now and then check for files the script left: Admins should also take these steps for any server where the script ran or may have run: All OPSSHIELD customers should also reset their billing portal password at manage.opsshield.com and turn on two-factor login.
What happened
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers.
An attacker has compromised the update infrastructure of cPGuard, a security suite for Linux web hosting servers, and pushed out a malicious update to nearly 3,000 customer servers.
What changed
Its later disclosure says version 5.88.26 removes the backdoor, and a follow-up update removes a scheduled task the script also left, and in a later disclosure , OPSSHIELD said about 2,950 customer servers ran the script, which sent the files it collected back to the attacker.
Who is affected
The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory .
The company has also revoked the stolen update key and its cloud access keys, and is rebuilding its billing, licensing and internal servers from clean images.
Why it matters
The company revoked the stolen update-storage key along with all cloud API tokens and access keys; removed the attacker’s SSH key, cloned servers and snapshots from its cloud account; and enabled stronger login protection.
Separately, OPSSHIELD said it was releasing another update, as a precaution, that removes its support-access keys from cPGuard servers where they were added earlier.
Technical details
At 02:06 UTC, the attacker, who has not been identified, used compromised credentials to get into cPGuard's update system, and the attack was detected within 12 hours of those versions going out, according to OPSSHIELD.
Credentials the script copied may still work after the update, so any server that may have run the script also needs new passwords and keys.
Response
OPSSHIELD asks admins to update every cPGuard server now and then check for files the script left: Admins should also take these steps for any server where the script ran or may have run: All OPSSHIELD customers should also reset their billing portal password at manage.opsshield.com and turn on two-factor login.
For the next 70+ minutes, cPGuard agents installed the fake update on about 2,950 customer servers and ran it as root .
What security teams should do
According to OPSShield’s report, the day before the compromise of the update infrastructure the attacker probed OPSShield’s billing portal.
The attacker took the key used to publish updates and uploaded the malicious script to cPGuard's update system between 02:04 and 02:09 UTC on November 2.
What remains unknown
OPSSHIELD has not said whether the private key that matches its support-access key was exposed in the attack.
Attribution
The Hacker News: An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers.
Help Net Security: An attacker has compromised the update infrastructure of cPGuard, a security suite for Linux web hosting servers, and pushed out a malicious update to nearly 3,000 customer servers.
What to watch next
Watch for updated vendor guidance and fixed-version details.