A BGP hijacking attack allowed unknown hackers to install malware on real networks by seizing control of Internet address space used to distribute cloud management updates. The supply chain operation targeted infrastructure relied upon by hosting providers, data centers, and other large infrastructure companies, turning routine software updates into a delivery mechanism for malicious code.
The attackers exploited weaknesses in the routing security of hosting provider Hetzner Online along with flaws in the process for obtaining valid TLS certificates. Those gaps enabled them to perform a Border Gateway Protocol (BGP) hijack and take control of IP addresses assigned to Softaculous, a company based in the United Arab Emirates. Softaculous develops a platform for installing and managing web software and is the maker of Virtualizor, a management platform for virtualized environments.
Softaculous used those IP addresses to issue updates and host a client and billing site. Once the attackers controlled the hijacked space, they used the addresses to push malware disguised as legitimate updates to unsuspecting users.
A Chain of Preventable Configuration Errors
Loose routing security configuration at Hetzner Online was the primary factor that made the attack possible, but several additional mistakes contributed to its success. Most significantly, Softaculous did not follow one of the most common safeguards in software development: validating updates through code signing.
“During the incident window, a Virtualizor installation whose traffic was diverted could have received a malicious update package from the attacker’s server,” Softaculous stated Monday. “Our product update clients did not yet cryptographically verify update packages, so a modified package would not have been rejected on that basis. We believe only a small number of servers were actually affected, but we cannot produce a definitive list, so please treat every Virtualizor server as in scope for the checks below.”
Hetzner Online’s configuration allowed the hijackers to intermittently misdirect traffic across two spans within a 33-hour window. The company reclaimed the address space 12 hours after the hijacking began by announcing the correct path. It then stopped announcing that path, and the attacker executed the same hijack a second time. On this occasion, Hetzner took nearly 10 hours to respond, and the hijack remained active during that period.
Softaculous and Zet.net, the transit peer downstream from Hetzner Online, also failed to properly monitor their systems. As a result, the hijacking went undetected until it had been active on and off for 22 hours. Questions also remain about another host, Nexon Host, whose infrastructure somehow facilitated the malicious announcement.
Why BGP Attacks Threaten the Internet
BGP attacks target the foundations that make the Internet a unified, worldwide network. The Internet is divided into many autonomous systems (ASes), also called autonomous system networks (ASNs). Each AS is an independent network assigned a portion of the roughly 3.7 billion public IP addresses in circulation. BGP governs how traffic is routed among these systems, which is why weaknesses in routing security can have far-reaching consequences.
Ben Cartwright-Cox, a BGP expert and creator of the BGP Tools suite, described the failures as “silly, pre
Source
Image: arstechnica.com
