{"id":80245,"date":"2020-05-04T19:42:04","date_gmt":"2020-05-04T17:42:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack"},"modified":"2020-05-04T19:42:04","modified_gmt":"2020-05-04T17:42:04","slug":"vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack","title":{"rendered":"Exploitation of LineageOS infrastructure through a vulnerability in SaltStack","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Developers of the mobile platform LineageOS<\/a><\/noindex>, which replaced CyanogenMod, warned<\/a><\/noindex> reported on the discovery of traces of a breach in the project's infrastructure. It is noted that at 6 a.m. (MSK) on May 3, the attacker was able to gain access to the main server of the centralized configuration management system SaltStack<\/a><\/noindex> through the exploitation of an unpatched vulnerability. Currently, an investigation into the incident is underway and details are not yet available. <\/p>\n

It is reported<\/a><\/noindex> However, the attack did not affect the keys used for generating digital signatures, the build system, or the platform's source code \u2014 keys. were stored<\/a><\/noindex> on hosts that were completely isolated from the main infrastructure, managed via SaltStack, and the builds were stopped for technical reasons on April 30. According to the data on the page status.lineageos.org<\/a><\/noindex> the developers have already restored the server with the code review system Gerrit, the website, and the wiki. The build server (builds.lineageos.org), the file download portal (download.lineageos.org), email servers, and the mirror coordination system remain disconnected. <\/p>\n

The attack was made possible because the network port (4506) for accessing SaltStack was not<\/a><\/noindex> It was blocked for external requests by the firewall \u2014 the attacker had to wait for a critical vulnerability in SaltStack to appear and exploit it before administrators could apply the fix. All SaltStack users are urgently advised to update their systems and check for signs of compromise.<\/p>\n

Apparently, the attacks through SaltStack were not limited to the LineageOS breach and became widespread \u2014 throughout the day, various users who had not updated SaltStack were affected. note<\/a><\/noindex> identified compromises in their infrastructures with code for mining or backdoors placed on their servers. In particular it is reported<\/a><\/noindex> about a similar breach of the content management system Ghost<\/a><\/noindex>, which affected the Ghost(Pro) websites and billing (it is claimed that credit card numbers were not compromised, but hashes of Ghost users' passwords may have fallen into the hands of attackers).<\/p>\n

On April 29, updates for the SaltStack platform were released<\/a><\/noindex> in which vulnerabilities were addressed 3000.2<\/a><\/noindex> and 2019.2.4<\/a><\/noindex>, details about the vulnerabilities were published on April 30, assigned the highest level of danger as they allow access without authentication were fixed in Salt<\/a><\/noindex> them to be accessed allow<\/a><\/noindex> Remote code execution both on the management host (salt-master) and on all servers managed through it.<\/p>\n