BGP hijack infecting networks caused by a comedy of errors that’s not funny at all
Attackers BGP-hijacked Softaculous IP space via Hetzner routing lapses to push malicious Virtualizor updates to hosting servers.
Unknown attackers hijacked the 162.55.80.0/24 prefix used by Softaculous' Virtualizor update service by abusing lax routing security at hosting provider Hetzner Online, announcing the range through AS6204, AS62390, and AS24940 with a forged but RPKI-valid origin. The hijack pulsed intermittently over roughly 33 hours, delivering modified update packages to Virtualizor servers, which lacked cryptographic code signing for updates. Softaculous says only a small number of servers were likely affected but cannot produce a definitive list, urging administrators to treat every Virtualizor server as in scope for checks.
- Hijack announced 162.55.80.0/24 via AS6204, AS62390, and AS24940 with forged RPKI-valid origin.
- Hetzner's lax routing configuration let the hijack recur twice within a 33-hour window.
- Virtualizor update clients did not cryptographically verify packages, so tampered updates were accepted.
- Possible compromise of Nexon Host (AS62390) infrastructure or a customer facilitated the announcement.
- Experts called the lapses 'silly, preventable mistakes' avoidable with RPKI ROV and monitoring.
- Vendors
- HetznerSoftaculous
- Products
- Virtualizor
- Victims
- SoftaculousHetzner
- Organizations
- HetznerSoftaculousNexon HostZet.netInfoblox
From the original article
7 min read at arstechnica.com
What can we learn from a BGP hijacking that poisoned production software? Plenty.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.