Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
VDS.net
CorePanel
Servury - Anonymous & Privacy-focused VPS Hosting
InterServer VPS
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
CloudLinux
MeduzaVPN
Animated Silicon Kiwi cloud ad featuring VPS from $4.90/month, 100 GB S3 storage from $1.49/month, Kiwi Apps from $12/month and cloud backup from $3/month
Lium GPU Pods
Yeap Cloud
GenixNode - KVM NVMe Gen4 VPS from $2.99/mo in 14 locations

Categories

In this Discussion

Home › News › Security
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

cPGuard Compromised

c_vpsc_vps Member
in Security

Just received a email regarding the compromised of cPguard

Thanked by 3oloke loay jcn50

Comments

  • GravelyGravely Member
    edited November 2

    Instructions from the email:

    Update every cPGuard server. Run cpgcli update --start. The corrective update removes the backdoor shell at /var/tmp/.cpg91511_sh and the collection directory /var/tmp/.cpg91511, including the password hashes and credential archive (loot.tgz) staged there.
    2. Verify the installed version. After the update completes, run cpgcli --version on each server and confirm it reports 5.88.25. If the update fails or the server still reports an older version (between 5.88.12 and 5.88.19), contact OPSSHIELD Support immediately.

    Edit: Cloudflare was blocking me from posting step 3. Essentially rotate SSH Keys, S3 keys and all passwords if evidence of the files listed above were present.

  • ZhenmueZhenmue Member

    all our cpanel and directadmin servers had the cpguard compromised version. wow.

    Thanked by 1loay
  • MainfrezzerMainfrezzer Member

    That name just kills me. Jesus Christ.

    Any more context in the email at all or just

    "We got goatsed, sorry about that"?

    Thanked by 2Obelous globalRegisters
  • ZhenmueZhenmue Member
    edited November 2 
    Dear cPGuard customers and partners,


    An unidentified attacker targeted OPSSHIELD, gained unauthorized access to our licensing and update systems, and distributed a malicious script through the cPGuard update channel. We have stopped further distribution of the script and released cPGuard 5.88.25 to remove the known backdoor and files left by the script.

    The script sent data to an endpoint on our licensing server under a compromised account. We secured that account as soon as we identified the breach and cleared our infrastructure credentials. We are investigating how the attacker gained access, which customer servers ran the script, and what data the attacker accessed.

    Please take the following actions immediately.

    1. Update every cPGuard server. commands
    2. Verify the installed version. After the update completes, run commands
    3. If you know or suspect the malicious script ran, reset passwords and revoke exposed credentials. The script targeted /. Reset passwords for root and all other password-enabled local accounts from a trusted recovery environment. From a trusted device, change any passwords reused elsewhere and rotate affected database passwords, S3 access keys, DigitalOcean tokens, and secrets recorded in root's shell history. Replace SSH private keys stored under and remove the corresponding old public keys from every system that trusts them. Complete this step even if the update succeeds, because credentials copied before cleanup may still be usable.

    We are sorry that this breach put your systems at risk. If you need help assessing a server, please contact OPSSHIELD Support through your usual support channel. We will share further findings as we verify them.

    The OPSSHIELD Team

    Thanked by 1Mainfrezzer
  • MainfrezzerMainfrezzer Member
    edited November 2

    @Gravely said:
    Instructions from the email:

    Update every cPGuard server. Run cpgcli update --start. The corrective update removes the backdoor shell at /var/tmp/.cpg91511_sh and the collection directory /var/tmp/.cpg91511, including the password hashes and credential archive (loot.tgz) staged there.
    2. Verify the installed version. After the update completes, run cpgcli --version on each server and confirm it reports 5.88.25. If the update fails or the server still reports an older version (between 5.88.12 and 5.88.19), contact OPSSHIELD Support immediately.

    Edit: Cloudflare was blocking me from posting step 3. Essentially rotate SSH Keys, S3 keys and all passwords if evidence of the files listed above were present.

    The instructions are weird, if you're supposed to upgrade immediately and that removes the files, does it at least tell you that they got removed? Cause how the fuck are you supposed to figure out that one got pwnd when the files are gone

  • GravelyGravely Member
    edited November 2

    @Mainfrezzer said:

    @Gravely said:
    Instructions from the email:

    Update every cPGuard server. Run cpgcli update --start. The corrective update removes the backdoor shell at /var/tmp/.cpg91511_sh and the collection directory /var/tmp/.cpg91511, including the password hashes and credential archive (loot.tgz) staged there.
    2. Verify the installed version. After the update completes, run cpgcli --version on each server and confirm it reports 5.88.25. If the update fails or the server still reports an older version (between 5.88.12 and 5.88.19), contact OPSSHIELD Support immediately.

    Edit: Cloudflare was blocking me from posting step 3. Essentially rotate SSH Keys, S3 keys and all passwords if evidence of the files listed above were present.

    The instructions are weird, if you're supposed to upgrade immediately and that removes the files, does it at least tell you that they got removed? Cause how the fuck are you supposed to figure out that one got pwnd when the files are gone

    I lodged a ticket to ask this exact question - will let you know their reply.

    Thanked by 1Mainfrezzer
  • AndreixAndreix Host Rep, Veteran
    edited November 2

    Guess some of the well seasoned hyper-full-stack devs full of themselves (like we start to see here more often too) got screwed by some AI slop...

    #shit

  • MakersHelpDeskMakersHelpDesk Member

    This is a great reason to own your own provisioning & guard systems. All of these overcomplicated modules and packages that are out there are going to be OBLITERATED.

    Thanked by 1MikeA
  • ZhenmueZhenmue Member

    @Mainfrezzer said:

    @Gravely said:
    Instructions from the email:

    Update every cPGuard server. Run cpgcli update --start. The corrective update removes the backdoor shell at /var/tmp/.cpg91511_sh and the collection directory /var/tmp/.cpg91511, including the password hashes and credential archive (loot.tgz) staged there.
    2. Verify the installed version. After the update completes, run cpgcli --version on each server and confirm it reports 5.88.25. If the update fails or the server still reports an older version (between 5.88.12 and 5.88.19), contact OPSSHIELD Support immediately.

    Edit: Cloudflare was blocking me from posting step 3. Essentially rotate SSH Keys, S3 keys and all passwords if evidence of the files listed above were present.

    The instructions are weird, if you're supposed to upgrade immediately and that removes the files, does it at least tell you that they got removed? Cause how the fuck are you supposed to figure out that one got pwnd when the files are gone

    All our servers auto-updated to the correct "clean" version, that deletes the evidence of what was done and what was collected... so their update indeed deletes what and if anything was done

    Thanked by 1Mainfrezzer
  • GravelyGravely Member

    Advisory now live - https://opsshield.com/notice/cpguard-update-channel-compromise.html

  • ObelousObelous Member

    I guess we need a cpguardguard

    Thanked by 4loay jcn50 jaden forest
  • GravelyGravely Member

    At this point I'm just considering a full rebuild without CPGuard installed. The .sh script had far too much access and without seeing the loot folder we can't be sure.

  • loayloay Member

    @Gravely said:
    At this point I'm just considering a full rebuild without CPGuard installed. The .sh script had far too much access and without seeing the loot folder we can't be sure.

    The way they've worded the advisory makes it sound like they really want to recommend a full server reinstall without explicitly saying so.

  • loayloay Member

    @Gravely said:
    Advisory now live - https://opsshield.com/notice/cpguard-update-channel-compromise.html

    I don't understand why DigitalOcean is mentioned in the notice? it specifically mentions rotating DigitalOcean API tokens!

  • HOSTCAYHOSTCAY Member, Host Rep

    “ We detected the attack within 12 hours of the launch of the updates in question”
    Actually it was around 17 hours

Sign In or Register to comment.