DEVOURED
Security Incident - BGP Hijacking
An unauthorized BGP route announcement diverted traffic for Softaculous IP ranges for 33 hours, resulting in the delivery of malicious software updates.
What: NexonHost (AS62390) announced a more-specific 162.55.80.0/24 route, hijacking traffic intended for Softaculous infrastructure. The attacker intercepted ACME validation traffic to obtain valid Let's Encrypt certificates, preventing browser warnings during the redirection.
Why it matters: This incident demonstrates how BGP vulnerabilities allow attackers to bypass TLS/SSL protections by controlling the path validation traffic takes, effectively subverting the trust model of certificate authorities.
Takeaway: If you operate a Virtualizor server, perform a security audit of your recent update logs and verify the integrity of your installed packages against official checksums.
Deep dive
- Hijack window: Aug 28, 20:57 UTC to Aug 30, 06:10 UTC.
- Peak diversion affected ~72% of RIPE RIS peers.
- Attackers used fraudulent Let's Encrypt certificates to intercept traffic.
- Malicious updates reached only a small subset of servers due to intermittent route flapping.
- Hetzner mitigated by announcing the specific /24 prefix.
Decoder
- BGP Hijacking: The unauthorized diversion of internet traffic by announcing an IP prefix that a network does not control.
- AS (Autonomous System): A collection of IP networks under the control of a single entity that presents a common routing policy to the internet.
- ACME (Automated Certificate Management Environment): A protocol used for the automated issuance and validation of TLS/SSL certificates.
Original article
Full article content is not available for inline reading.
Explore all 57 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi