Hackers Breach LineageOS, Ghost, DigiCert Servers Using SaltStack Vulnerability

Tracked as CVE-2020-11651 and CVE-2020-11652, the
disclosed flaws could allow an adversary to execute arbitrary code
on remote servers deployed in data centers and cloud environments.
The issues were fixed by SaltStack in a release^[2] published on April
29th.

“We expect that any competent hacker will be able to create 100%
reliable exploits for these issues in under 24 hours,” F-Secure
researchers had previously warned in an advisory last week.

LineageOS, a maker of an open-source operating system based on
Android, said it detected the intrusion on May 2nd at around 8 pm
Pacific Time.

“Around 8 pm PST on May 2nd, 2020, an attacker used a CVE in our
SaltStack master to gain access to our infrastructure,” the company
noted^[3] in its incident report
but added Android builds and signing keys were unaffected by the
breach.

Ghost, a Node.js based blogging platform, also fell victim to
the same flaw. In its status page, the developers noted that
“around 1:30 am UTC on May 3rd, 2020, an attacker used a CVE in our
SaltStack master to gain access to our infrastructure” and install
a cryptocurrency miner.

“The mining attempt spiked CPUs and quickly overloaded most of
our systems, which alerted us to the issue immediately,” Ghost
added^[4].

Ghost, however, confirmed there was no evidence the incident
resulted in a compromise of customer data, passwords, and financial
information.

Both LineageOS and Ghost have restored the services after taking
the servers offline to patch the systems and secure them behind a
new firewall.

In a separate development, the Salt vulnerability was used to hack
into Digicert certificate authority as well.

“We discovered today that CT Log^[5] 2’s key used to sign
SCTs (signed certificate timestamps) was compromised last night at
7 pm via the Salt vulnerability,” DigiCert’s VP of Product Jeremy
Rowley said in a Google
Groups^[6] post made on Sunday.

“Although we don’t think the key was used to sign SCTs (the
attacker doesn’t seem to realize that they gained access to the
keys and were running other services on the infrastructure), any
SCTs provided from that log after 7 pm MST yesterday are suspect.
The log should be pulled from the trusted log list.”

With F-Secure’s alert revealing more than 6,000
Salt vulnerable servers^[7]
that can be exploited via this vulnerability, if left unpatched,
companies are advised to update the Salt software packages to the
latest version to resolve the flaws.

^[1]