cPGuard Yangilanish Kanali Buzib Kirilib, Linux Serverlarini Orqa Eshik Bilan Yuqtirish va Parol Xeshlarini Yig'ish Uchun Ishlatilgan

Hujumchi 2-noyabrda cPGuard xavfsizlik vositasining yangilanish tizimiga kirib, mijozlarning Linux serverlariga zararli skript yuborgan.

Skript orqa eshik o'rnatgan va uni ishga tushirgan serverlardan parol xeshlarini va boshqa maxfiy fayllarni yig'gan, deb xabar berdi cPGuard ishlab chiqaruvchisi OPSSHIELD o'z maslahatida. Hujumchi o'sha ma'lumotlarning bir qismini allaqachon olgan.

cPGuard 5.88.25 va undan keyingi versiyalari orqa eshikni va skript qoldirgan fayllarni o'chiradi. Skript nusxalagan ma'lumotlar yangilanishdan keyin ham ishlashi mumkin, shuning uchun skriptni ishga tushirgan bo'lishi mumkin bo'lgan har qanday server yangi parollar va kalitlarga ham muhtoj.

02:06 UTC da, hali aniqlanmagan hujumchi, buzilgan ma'lumotlardan foydalanib cPGuard yangilanish tizimiga kirgan. Skript cPGuard 5.88.12 dan 5.88.19 gacha versiyalarida tarqatilgan.

OPSSHIELD ma'lumotiga ko'ra, hujum o'sha versiyalar tarqatilgandan keyin 12 soat ichida aniqlangan. Kompaniya infratuzilma ma'lumotlarini tozalagan va skriptning boshqa serverlarga yetib borishini to'xtatgan. Hujumchi ma'lumotlarni qanday olganini hali ham tekshirmoqda.

OPSSHIELD bu versiyalardan birini o'rnatgan serverlar sonini aytmagan. Serverlar yangilanishlarni oraliqlarda tekshiradi, shuning uchun ba'zilari skriptni ishga tushirmagan bo'lishi mumkin.

Administratorlar server yangilanish jurnalini qidirib, ta'sirlangan versiyani o'rnatganligini tekshirishi mumkin:

grep 'Successfully updated' /opt/cpguard/logs/install_log

5.88.12 dan 5.88.19 gacha har qanday versiya uchun yozuv server ta'sirlangan yangilanishni o'rnatganini bildiradi. Yozuvning o'zi skript ishga tushganini yoki ma'lumot serverdan chiqqanini ko'rsatmaydi. Server hozir 5.88.25 yoki undan keyingi versiyada ishlasa ham, uni potentsial buzilgan deb hisoblash kerak.

Mos yozuvlar yo'q bo'lgan, yoki jurnal yo'q yoki to'liq bo'lmagan server ham skriptni ishga tushirgan bo'lishi mumkin. Ishonch hosil qilmagan administratorlar OPSSHIELD Qo'llab-quvvatlash xizmati bilan bog'lanishi mumkin.

Skript quyidagi turdagi ma'lumotlarni yig'gan, deb aniqlagan OPSSHIELD: /etc/shadow va /etc/passwd, rootning MariaDB yoki MySQL konfiguratsiyasi (my.cnf), rootning shell tarixi, va root uchun SSH avtorizatsiya va ma'lum hostlar fayllari. U har bir serverdan har bir faylni yig'magan bo'lishi mumkin, va kompaniya har biridan nima chiqqanini hali aniqlamoqda.

/etc/shadow fayli bir tomonlama parol xeshlarini saqlaydi. Zaif, keng tarqalgan yoki avval sizib chiqqan parollar bu xeshlar orqali oflayn sinov bilan tiklanishi mumkin, va hatto kuchli parollar ham qayta o'rnatilishi kerak. Ma'lumotlar bazasi konfiguratsiyasi yoki shell tarixida joylashgan maxfiy ma'lumotlar bunday xeshlash himoyasiga ega emas.

Skript yig'ilgan ma'lumotlarni OPSSHIELDning o'zi boshqaradigan litsenziya serveriga, buzilgan hisob orqali yuklagan, shuning uchun hujumchi uni keyinroq olishi mumkin edi. OPSSHIELD o'sha hisobni allaqachon himoyalagan.

OPSSHIELD 2-noyabr UTC kechqurun hisob-kitobiga ko'ra, hujumchi o'sha serverdan 32 ta fayl olgan, har biri bitta mijoz serveriga bog'liq. Bu raqam faqat olingani ma'lum bo'lgan fayllarni qamrab oladi va o'zgarishi mumkin. Bu jami qancha server ishtirok etishi mumkinligini ko'rsatmaydi.

Ma'lumot yig'ish va orqa eshikdan tashqari, OPSSHIELD hozircha boshqa zararli faoliyat topmagan, bu natija yakuniy emasligini aytgan.

cPGuard Administratorlari Hozir Nima Qilishi Kerak

OPSSHIELD administratorlardan har bir cPGuard serverini hozir yangilashni va versiyani tasdiqlashni so'raydi:

1. Har bir serverda cpgcli update --start ni ishga tushiring.
2. cpgcli --version ni ishga tushiring va u 5.88.25 yoki undan keyingi versiyani ko'rsatishini tekshiring. Agar yangilanish muvaffaqiyatsiz bo'lsa yoki versiya pastroq bo'lsa, OPSSHIELD Qo'llab-quvvatlash xizmati bilan bog'laning.

Administratorlar skript ishga tushgan yoki ishga tushishi mumkin bo'lgan har qanday server uchun quyidagi qadamlarni ham bajarishi kerak:

1. Ishonchli tiklash muhitidan, root va parol ishlatadigan har bir boshqa mahalliy Linux hisobining parollarini qayta o'rnating.
2. Ishonchli qurilmadan, boshqa tizimlarda ham ishlatiladigan o'sha parollarning barchasini o'zgartiring.
3. Serverning ma'lumotlar bazasi parollarini, S3 kirish kalitlarini, DigitalOcean tokenlarini va rootning shell tarixida yozilgan har qanday maxfiy ma'lumotlarni aylantiring.
4. /root/.ssh ostida saqlangan SSH shaxsiy kalitlarini almashtiring va ularga mos eski ochiq kalitlarni ishonadigan har bir tizimdan o'chiring.

OPSSHIELD odatiy qadam sifatida to'liq qayta o'rnatish yoki operatsion tizimni qayta qurishni tavsiya qilmayapti, va bu fikr tekshiruv davom etishi bilan o'zgarishi mumkinligini aytgan. Boshqa buzilish belgilarini topgan, yoki server toza ekanligini tasdiqlay olmagan administratorlar OPSSHIELD Qo'llab-quvvatlash xizmati bilan alohida ko'rib chiqish uchun murojaat qilishi kerak, bu qayta qurishga olib kelishi mumkin.

Alohida, OPSSHIELD ehtiyot chorasi sifatida, avvalroq qo'shilgan cPGuard serverlaridan o'zining qo'llab-quvvatlash kirish kalitlarini o'chiradigan yana bir yangilanishni chiqaradi.

Qo'llab-quvvatlash kirishi — bu cPGuard xususiyati bo'lib, mijozlar OPSSHIELD xodimlariga muammolarni hal qilish uchun serverga kirishiga ruxsat beradi. Uni berish root uchun authorized_keys fayliga OPSSHIELDga tegishli SSH ochiq kalitini qo'shadi, deb kompaniya hujjatlarida aytilgan.

OPSSHIELD o'zining qo'llab-quvvatlash kirish kalitiga mos shaxsiy kalit hujumda ochilganmi yoki yo'qligini aytmagan.

Skript Qoldirgan Fayllar

OPSSHIELD quyidagi fayl nomlarini e'lon qilgan. Yangilanish orqa eshik shellini va yig'ish katalogini o'chiradi, shuning uchun yangilanishdan keyin ularning yo'qligi skript ishga tushganligi haqida hech narsa isbotlamaydi.

• Fayl: cpguard-v58812-i91511.sh (zararli skript)
• Fayl: /var/tmp/.cpg91511_sh (orqa eshik shell)
• Katalog: /var/tmp/.cpg91511 (skript fayllarni yig'gan joy)
• Fayl: /var/tmp/.cpg91511/loot.tgz (skript tayyorlagan arxiv)

An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers.

The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data.

cPGuard 5.88.25 and later versions remove the backdoor and the files the script left. Credentials the script copied may still work after the update, so any server that may have run the script also needs new passwords and keys.

At 02:06 UTC, the attacker, who has not been identified, used compromised credentials to get into cPGuard's update system. The script went out in cPGuard versions 5.88.12 through 5.88.19.

The attack was detected within 12 hours of those versions going out, according to OPSSHIELD. The company has cleared its infrastructure credentials and stopped the script from reaching more servers. It is still investigating how the attacker got the credentials.

OPSSHIELD has not said how many servers installed one of these versions. Servers check for updates at intervals, so some may not have run the script.

Admins can check whether a server installed an affected version by searching its update log:

grep 'Successfully updated' /opt/cpguard/logs/install_log

An entry for any version from 5.88.12 through 5.88.19 means the server installed an affected update. The entry alone does not show that the script ran or that data left the server. The server should still be treated as potentially compromised, even if it now runs 5.88.25 or later.

A server with no matching entries, or with a missing or incomplete log, may still have run the script. Admins who are unsure can contact OPSSHIELD Support.

The script collected these kinds of data, OPSSHIELD found: /etc/shadow and /etc/passwd, root's MariaDB or MySQL configuration (my.cnf), root's shell history, and the SSH authorization and known-hosts files for root. It may not have collected every file from every server, and the company is still working out what left each one.

The /etc/shadow file stores one-way password hashes. Weak, common or previously leaked passwords can be recovered from those hashes by testing guesses offline, and even strong ones still need resetting. Secrets that may sit in the database configuration or shell history have no such hashing to protect them.

The script uploaded what it collected to a licensing server run by OPSSHIELD itself, using a compromised account, so the attacker could pick it up later. OPSSHIELD has since secured that account.

The attacker took 32 files from that server, each tied to one customer server, OPSSHIELD estimated late on November 2 UTC. The count covers only files known to have been taken, and it may change. It does not show how many servers may be involved in total.

Beyond the data collection and the backdoor, OPSSHIELD has found no other malicious activity so far, a finding it says is not final.

What cPGuard Admins Should Do Now

OPSSHIELD asks admins to update every cPGuard server now and confirm the version:

1. Run cpgcli update --start on each server.
2. Run cpgcli --version and check that it reports 5.88.25 or later. If the update fails or the version is lower, contact OPSSHIELD Support.

Admins should also take these steps for any server where the script ran or may have run:

1. From a trusted recovery environment, reset the passwords for root and every other local Linux account that uses a password.
2. From a trusted device, change any of those passwords that are also used on other systems.
3. Rotate the server's database passwords, S3 access keys, DigitalOcean tokens and any secrets recorded in root's shell history.
4. Replace the SSH private keys stored under /root/.ssh, and remove the matching old public keys from every system that trusts them.

OPSSHIELD is not recommending a full reset or operating system rebuild as a routine step, and says that view could change as the investigation continues. Admins who find other signs of compromise, or cannot confirm a server is clean, should ask OPSSHIELD Support for a case-by-case review, which may lead to a rebuild.

Separately, OPSSHIELD is releasing another update, as a precaution, that removes its support-access keys from cPGuard servers where they were added earlier.

Support access is a cPGuard feature customers use to let OPSSHIELD staff into a server for troubleshooting. Granting it adds an SSH public key belonging to OPSSHIELD to the authorized_keys file for root, according to the company's documentation.

OPSSHIELD has not said whether the private key that matches its support-access key was exposed in the attack.

Files the Script Left Behind

OPSSHIELD published these file names. The update removes the backdoor shell and the collection directory, so their absence after updating proves nothing about whether the script ran.

• File: cpguard-v58812-i91511.sh (the malicious script)
• File: /var/tmp/.cpg91511_sh (backdoor shell)
• Directory: /var/tmp/.cpg91511 (where the script gathered files)
• File: /var/tmp/.cpg91511/loot.tgz (archive the script prepared)

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.