A poisoned cPGuard security update stole secrets from 2,946 servers

On November 2 at 2:08 a.m. UTC (3:08 a.m. in Paris), servers running cPGuard received what looked like an ordinary update. It came through the official channel of the vendor, OpsShield. Yet it contained a script designed to copy the best-guarded secrets on the machine.

cPGuard is a security suite for Linux web servers: malware scanning, firewall, protection against attacks. It is used by hosting providers and server administrators, alongside the cPanel, DirectAdmin or Plesk control panels. According to the alert OpsShield published on November 3, versions 5.88.12 through 5.88.19 are tampered with. Asked by BleepingComputer, an OpsShield spokesperson put the number of affected servers, whose information was copied, at 2,946.

What the script copied

According to the vendor, the attacker got in the day before through its billing portal, using a customer account created that same day, took control of the billing and licensing server, then seized the keys used to publish updates. The script targeted:

• the password hashes of Linux accounts;
• the administrator access configuration for MariaDB or MySQL databases;
• the history of commands typed by the root account, the superuser;
• the root account's SSH files, which list authorized keys and known machines.

One unexpected detail: the stolen data passed through OpsShield's own licensing server, via a compromised account, before the attacker retrieved it. According to the vendor's initial estimate, the attacker retrieved 32 files of collected data, each corresponding to one customer server. OpsShield has not yet established that all targeted files were taken from every server. The attacker also copied customer records from the billing system: name, company, postal address, email and password hash. According to OpsShield, about 7,900 billing portal accounts are affected.

According to the incident notice OpsShield published afterward, servers installed the fake update for about 70 minutes, from 2:08 to 3:20 a.m. UTC. The stolen key was then revoked and a clean version, 5.88.26, was released. Some servers, which only check for updates at regular intervals, may never have run the script. The vendor cannot confirm this.

Using cPGuard? Steps to take

A security tool runs with full privileges on the server, which is what makes its compromise so costly. It is safest to assume that everything the script targeted is in the wrong hands.

1. Update every server to version 5.88.25 or later: according to OpsShield, it removes the backdoor and the files dropped by the attacker.
2. Change the passwords of system accounts, starting with root.
3. Renew database credentials, cloud access secrets and SSH keys, and remove any unknown key from the authorized keys files.
4. Check that version 5.88.26 is installed: according to the cPGuard release log, it revokes OpsShield support access on servers where it was enabled.
5. Change your OpsShield billing portal password and enable two-factor authentication, which the vendor is asking of all its customers.
6. Notify hosted customers whose applications used the exposed credentials.

Software updates, an increasingly popular way in

The scenario is becoming familiar. In October, it emerged that updates to the AOMEI backup software had, between April and July, installed a backdoor, and the Rank Math PRO WordPress plugin had distributed a tampered version for eleven hours. Each time, the customer made no mistake: they trusted their vendor's channel.

In its incident notice published on November 3, OpsShield says it is rebuilding its billing, licensing and internal management servers from clean images. One question remains open: its logs do not show the exact request that let the attacker in, and the vendor says it has fixed two possible entry points.