// ARS TECHNICA — CYBERSECURITY
BGP hijack infecting networks caused by a comedy of errors that’s not funny at all
What can we learn from a BGP hijacking that poisoned production software? Plenty.
Hackers carried out a supply chain attack that installed malware on networks using an unusual technique: hijacking a chunk of Internet space where cloud management software used by hosting providers, data centers, and other large infrastructure companies is updated.
In a well-coordinated operation, the unknown attackers exploited weaknesses in the routing security setup of hosting provider Hetzner Online and the process for attaining valid TLS certificates. The lapses allowed the attackers to successfully perform a BGP (Border Gateway Protocol) hijacking to obtain control over IP addresses assigned to Softaculous. The company, based in the United Arab Emirates, is the maker of a platform for installing and managing Web software and is the developer of Virtualizor, a management platform for virtualized environments.
Softaculous used the IPs to issue updates and host a client and billing site. With control over the hijacked space, the attacker was now using the addresses to push malware masquerading as updates to unsuspecting users.
Lax configuration of routing security in Softaculous’ hosting provider, Hetzner Online, was the major contributor to the hack. A large number of other errors contributed to the success of the attack. Most notably, Softaculous failed to follow one of the most common safety steps in software development, which is to validate software updates using code signing.
“During the incident window, a Virtualizor installation whose traffic was diverted could have received a malicious update package from the attacker’s server,” Softaculous warned Monday. “Our product update clients did not yet cryptographically verify update packages, so a modified package would not have been rejected on that basis. We believe only a small number of servers were actually affected, but we cannot produce a definitive list, so please treat every Virtualizor server as in scope for the checks below.”
A loose configuration by Hetzner Online allowed hijackers to intermittently misdirect traffic over two spans in a 33-hour window. Hetzner Online reclaimed the address space 12 hours after the hijacking started by announcing the correct path. Then Hetzner Online stopped announcing the path, and the attacker executed the same hijack a second time. This time, it took Hetzner almost 10 hours to react. During that time, the hijack was active.
Like Hetzner Online, both Softaculous and Zet.net, the transit peer downstream from Hetzner Online, failed to properly monitor their systems and, as a result, didn’t catch the hijacking until it had been ongoing on and off for 22 hours. There are also questions about another host provider, Nexon Host, whose infrastructure somehow facilitated the malicious announcement.
Ben Cartwright-Cox, a BGP expert and creator of the BGP Tools suite, called the lapses “silly, preventable mistakes.” Softaculous, Hetzner, and Zet.net didn’t immediately respond to emailed questions.
BGP attacks target the underpinnings that make the Internet a unified, worldwide network. The Internet is splintered into many ASes (autonomous systems), also known as ASNs (autonomous system networks). Each AS is an independent network assigned a portion of the 3.7 billion publicly available addresses under the IPv4 protocol. BGP is the glue that binds all these ASes together and allows each one to connect to any other.