BGP hijack infecting networks caused by a comedy of errors that’s not funny at all

Summary

A BGP hijacking attack successfully installed malware on networks by exploiting routing security weaknesses at Hetzner Online and Softaculous. The attack involved hijacking IP addresses used for software updates, allowing attackers to distribute malicious packages. Preventable mistakes in configuration and a lack of update validation contributed to the incident's success.

Key Takeaways

1. Hackers carried out a supply chain attack that installed malware on networks using an unusual technique: hijacking a chunk of Internet space where cloud management software used by hosting providers, data centers, and other large infrastructure companies is updated.
2. In a well-coordinated operation, the unknown attackers exploited weaknesses in the routing security setup of hosting provider Hetzner Online and the process for attaining valid TLS certificates.
3. The incident is one of the few times a BGP hijacking has been known to be used to spread malware.

Statement Breakdown

• Claimed Facts: 60% of statements the article presents as facts
• Opinions: 30% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article provides a detailed technical explanation of a BGP hijacking incident, citing expert opinions and specific technical details. However, it relies on information from the affected companies and experts, and the full extent of the malware's impact remains unclear.

Bias assessment: Technically Focused Reporting. The article prioritizes a technical explanation of the BGP hijacking event, focusing on the 'how' and 'why' of the attack. It avoids sensationalism and presents information factually, with minimal emotional language or partisan framing.

Note: This article offers a detailed technical analysis of a BGP hijacking. While informative, readers should note that some details are based on company statements and expert analysis, and the full impact of the malware is still being assessed.

Credibility flag: Technical Deep Dive

Claimed Facts (10)

• This is a direct statement of fact about the nature of the attack.
• This describes the specific technical vulnerabilities that were exploited.
• This provides factual information about Softaculous and its products.
• This states a fact about how the hijacked IP addresses were being used.
• This is a factual statement about contributing factors to the attack's success.
• This points to a specific, factual omission in Softaculous's security practices.
• This describes a specific configuration issue and its consequence.
• This details a specific action taken by Hetzner Online and its timing.
• This describes a sequence of events following Hetzner's initial action.
• This states a factual failure in monitoring by multiple entities.

Opinions (8)

• This is a subjective and opinionated statement used as a title, conveying a strong negative sentiment.
• This is a subjective judgment on the nature of the errors made.
• This attributes an opinionated statement to an expert.
• While factually descriptive, the term 'splintered' carries a slightly negative connotation, implying fragmentation.
• The phrase 'ran on trust' implies a naive or less secure past, which is a subjective interpretation of historical context.
• The word 'abused' implies a moral judgment on the attackers' actions.
• The term 'lax system' is a subjective assessment of the security measures.
• The word 'succinctly' is an opinion on the quality of the description, and 'impersonate' and 'automatically win' carry a narrative framing.

Claims (6)

• This is a warning about a potential outcome, framed as a possibility rather than a confirmed event, and uses cautious language ('could have received').
• This is a statement of a past deficiency, presented as a reason for the attack's success, but it's a self-reported admission of a security gap.
• This statement expresses a belief about the extent of the damage, but acknowledges uncertainty ('cannot produce a definitive list'), making it a less than concrete claim.
• The word 'somehow' indicates a lack of clear understanding or evidence regarding Nexon Host's role, making this claim speculative.
• The use of 'likely' and 'possibly' indicates that this is a probable scenario rather than a confirmed fact.
• This explicitly states that key information about the attack's impact is unknown.

Key Sources

• Dan Goodin — Author
• Hetzner Online — Hosting Provider
• Softaculous — Software Provider
• Ben Cartwright-Cox — BGP Expert, Creator of BGP Tools suite
• Nexon Host — Host Provider
• Doug Madory — Head of Internet Analysis at Infoblox
• Let's Encrypt — Certificate Authority
• Ars Technica — Media