Hackers turned a security tool's updates into a way into servers

On November 2, an attacker broke into the update system of cPGuard, a security tool for Linux servers, and used it to send out a malicious script. The script installed a backdoor and copied password hashes and other sensitive files. The tool's maker, OPSSHIELD, said so in an advisory. In short, the software meant to protect servers was used to get into them.

What happened

At 02:06 UTC, the attacker, who has not been identified, got into cPGuard's update system using compromised credentials. The script went out in versions 5.88.12 through 5.88.19. OPSSHIELD says it detected the attack within 12 hours of those versions going out. It has since cleared its infrastructure credentials and stopped the script from reaching more servers. It is still investigating how the attacker got the credentials.

What was taken

The script collected files that hold keys to a server. These include the password hash file, the root database settings, root's shell history, and root's SSH access files. A hash is a scrambled form of a password. Weak, common or previously leaked passwords can be recovered from hashes by guessing offline. Database settings and shell history may hold secrets that are not scrambled at all.

The script uploaded what it found to a licensing server run by OPSSHIELD, using a compromised account, so the attacker could collect it later. By late November 2 UTC, OPSSHIELD estimated the attacker had taken 32 files, each tied to one customer server. That count may change, and it does not show how many servers are involved in total.

Who can relax, and who cannot

Not every server that checks for updates ran the script, since servers check at intervals. But a clean log is not proof of safety. A missing or incomplete log, or no matching entries, does not rule out that the script ran. Even a server now on version 5.88.25 or later should be treated as possibly compromised, because the update removes the backdoor but does not cancel passwords already copied.

What to do

The alert box above lists the steps. The key point is that updating alone is not enough. Passwords and keys on affected servers need to be changed, and OPSSHIELD Support can help anyone unsure about a server.

What happens next

OPSSHIELD has not said how many servers installed an affected version. It has found no other malicious activity so far, but says that is not final. It does not recommend a full rebuild as a routine step, though that could change. As a precaution, it is also releasing another update that removes its support-access keys. It has not said whether the matching private key was exposed.