BGP hijack infecting networks caused by a comedy of errors that’s not funny at all
What can we learn from a BGP hijacking that poisoned production software? Plenty.
Hackers orchestrated a supply chain attack that infiltrated networks by employing a novel method: manipulating a segment of the Internet where cloud management software updates are conducted. The perpetrators exploited vulnerabilities in the routing security of hosting provider Hetzner Online and the process for procuring legitimate TLS certificates.
These flaws enabled the attackers to execute a BGP ( Border Gateway Protocol ) hijacking, thereby gaining control over IP addresses allocated to Softaculous. Softaculous, headquartered in the United Arab Emirates, is the creator of a platform for deploying and managing web applications and the developer of Virtualizor, a platform for managing virtualized environments.
With the hijacked IPs at their disposal, the assailants utilized them to disseminate malware disguised as software updates to unsuspecting users.
Written by urgent.news from Ars Technica's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
