cPGuard Update Channel Hijacked to Install Backdoors
Original title: cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
Attacker hijacked cPGuard update system to distribute backdoor in versions 5.88.12-5.88.19 that collected password hashes and other files from Linux servers.
The attacker broke into cPGuard's update system using compromised credentials on November 2 and sent a malicious script in versions 5.88.12 through 5.88.19. The script installed a backdoor and collected files like /etc/shadow, /etc/passwd, shell history, and SSH files. OPSSHIELD estimates 32 files taken from the licensing server. Affected versions are fixed in 5.88.25. The attacker took some data. Admins should update and reset credentials.
Unconfirmed: The exact number of servers affected is unknown
- Backdoor sent in cPGuard versions 5.88.12 to 5.88.19
- Collected /etc/shadow, /etc/passwd, shell history, SSH files
- Attacker took 32 files
- Fixed in version 5.88.25
- Update detected within 12 hours
Impact: collected password hashes and sensitive files from Linux servers
- 1.Update cPGuard to 5.88.25 or later
- 2.Reset local Linux account passwords
- 3.Rotate database passwords and SSH keys
From the original article
4 min read at thehackernews.com
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.