Hackers leverage Saltbox flaw to breach LineageOS, Ghost and DigiCert servers

It took only days for hackers to latch onto these known vulnerabilities

Just days after cyber security researchers brought attention to two critical vulnerabilities in the SaltStack configuration framework, hackers have exploited the flaws to breach the servers of LineageOS, Ghost and DigiCert.

Dubbed CVE-2020-11651 and CVE-2020-11652, the previously disclosed flaws may allow a hacker to execute arbitrary code on remote servers deployed in data centers and cloud environments.

Advertisement - Article continues below

Researchers previously warned that any competent hacker could create 100% reliable exploits related to the issues in 24 hours or less. Since then, LineageOS detected an intrusion that occurred on May 2, 2020.

"Around 8 pm PST on May 2nd, 2020, an attacker used a CVE in our SaltStack master to gain access to our infrastructure," the company shared in its incident report. The company added the breach didn’t impact Android builds and signing keys.

Ghost also fell victim to the Saltbox vulnerability. Developers noted that "around 1:30 am UTC on May 3rd, 2020, an attacker used a CVE in our SaltStack master to gain access to our infrastructure" and install a cryptocurrency miner. According to the developers, the mining attempt spiked CPUs, which quickly overloaded Ghost’s systems, alerting them of the attack immediately.

LineageOS and Ghost have since patched the impacted systems and restored services. 

Advertisement
Advertisement - Article continues below

The Salt vulnerability was also used to hack into DigiCert certificate authority. DigiCert's VP of product, Jeremy Rowley, shared in a Google Groups post on Sunday, "We discovered today that CT Log 2's key used to sign SCTs (signed certificate timestamps) was compromised last night at 7 pm via the Salt vulnerability." 

Advertisement - Article continues below

Rowley added, "Although we don't think the key was used to sign SCTs (the attacker doesn't seem to realize that they gained access to the keys and were running other services on the infrastructure), any SCTs provided from that log after 7 pm MST yesterday are suspect. The log should be pulled from the trusted log list." 

While the issues were fixed by SaltStack in a release published on April 29, 2020, it’d be wise for businesses to update Salt software packages to the latest version to resolve these flaws and avoid any and all nefarious hacking attempts.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now
Advertisement

Recommended

Visit/security/hacking/355774/nigerian-hackers-swindle-millions-of-dollars-from-unemployment-systems
hacking

Nigerian hackers swindle millions of dollars from unemployment systems

22 May 2020
Visit/security/hacking/355773/hackers-take-on-unsuspecting-airliners-exposing-customer-data
hacking

Hackers take on unsuspecting airliners, exposing customer data

22 May 2020
Visit/security/hacking/355749/hackers-targets-game-developers-with-advanced-malware
hacking

Hackers target game developers with advanced malware

21 May 2020
Visit/security/hacking/355738/security-service-of-ukraine-arrests-infamous-hacker-sanix
hacking

Security Service of Ukraine arrests infamous hacker Sanix

21 May 2020

Most Popular

Visit/security/34616/the-top-ten-password-cracking-techniques-used-by-hackers
Security

The top ten password-cracking techniques used by hackers

5 May 2020
Visit/mobile/5g/355712/nokia-5g-speed-record
5G

Nokia breaks 5G record with speeds nearing 5Gbps

20 May 2020
Visit/cloud/cloud-computing/355742/microsoft-launches-public-cloud-service-for-health-care
cloud computing

Microsoft launches public cloud service for health care

21 May 2020