Attackers turned OpsShield’s trusted update channel into a supply-chain attack

Publisher excerpt From CSO Online

The kinks in the software supply chain are once again being exposed, with attackers now targeting OpsShield’s update process. This week, threat actors used compromised credentials to push malicious updates out to cPGuard customers. They then accessed data stored on the vendor’s servers and in its billing portal accounts, and made copies of at least three of OpsShield’s cloud servers. The company said in an advisory that it has “shut the attacker out of every system we know they reached, and … are rebuilding the ones we cannot fully trust.” It has also released updates and urges customers to update to the latest version of cPGuard, change passwords, and generate new SSH keys. Ultimately, the breadth of this unsanctioned access underscores the continued fragility of the software supply chain, as well as the vulnerability of security tools themselves. “The real danger here is that attackers were able to turn a trusted security update mechanism into a vector to break into servers,” said Erik Avakian, a technical counselor at Infotech. “The software that’s supposed to protect those servers became the source that compromised them.” The anatomy of the attack OpsShield specializes in server protection and web security software. Its cPGuard product is a security suite, malware scanner, and firewall designed for Linux web hosting servers. The company disclosed that, between November 1 and 2, attackers were able to gain unauthorized access to the OpsShield update distribution infrastructure, and, for about 70 minutes, pushed out a malicious update. The threat actors began by probing OpsShield’s billing portal, registering a customer account under a false identity, and ordering a free cPGuard trial. They then sent crafted requests that allowed them to gain the ability to run commands on the server to collect data. They used stolen access keys to publish fake updates that ran as root (the highest level of admin privilege), and to copy sensitive files and make copies of three OpsShield cloud servers. About 2,950 customer servers ran the fake update, exposing password hashes, root SSH keys, MySQL root passwords, and shell history, OpsShield reported. Attackers also accessed about 7,900 billing portal accounts containing customer names, addresses, emails, and hashed passwords. OpsShield says it is still reviewing the exact request that provided access, and has patched two possible entry points and verified related vendor components “line by line.” It closed the attacker’s account, revoked the stolen update-storage key as well as “every cloud API token and access key on our account.” The company also removed the attacker’s secure shell (SSH); deleted the clones of its servers created by the attacker plus any snapshots; turned on stronger login protection and replaced every SSH key and password; reset all billing portal login sessions and rotated all keys; and began rebuilding its billing, licensing, and internal management servers with tighter PHP and…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.