BGP Hijacking Attack: Virtualizor Users Served a Malicious Update

Softaculous has warned of an incident involving Virtualizor, the popular control panel for virtual servers that hosting providers use to create and sell VPSes. According to the vendor, from 20:57 UTC on August 28 to 06:10 UTC on August 30, an unknown attacker hijacked a block of IP addresses hosted at Hetzner using BGP (Border Gateway Protocol) hijacking.

How BGP hijacking works

A BGP hijacking attack comes down to a network operator falsely announcing a route to IP addresses that belong to someone else. Other networks may accept the bogus route as the preferred one, and traffic intended for the legitimate owner begins flowing to the attacker. Once in control of the data flow, the attacker is able to alter it or redirect it to nodes under their control.

This is exactly how the traffic of Softaculous's update systems, as well as its client and billing portal, was diverted. As a result, some Virtualizor installations that checked for updates during this period received a malicious package. The vendor stresses that only a small number of servers were affected, not the entire user base.

What administrators should do

Because the requests went directly to the attacker, Softaculous has no logs of what happened. The company recommends checking for the presence of the /etc/systemd/system/java-jre-update.service service. If it is found, you should rotate and restrict your API keys, and also check the system for unauthorized SSH keys, accounts, scheduled tasks and outbound connections.

Users who logged into the Softaculous client area or entered payment details during the incident are advised to change their passwords, review account activity and keep an eye on their card statements.

The vendor's measures

Routing has already been restored, and the fraudulent certificate has been submitted for revocation. On September 1, a new version, Virtualizor 3.2.9.9, was released with a Security Analyzer tool in the admin panel. Going forward, Softaculous promises to implement cryptographic signing of all software packages and to move to more robust infrastructure. The investigation is ongoing, but no signs of compromise in the company's other products have been found so far.

The incident is telling: even when the update code itself is untouched, delivery can be compromised at the level of internet routing — and the absence of package signing turns the auto-update mechanism into a convenient channel for attack.

Source: Bleeping Computer