CPGuard Compromised

dylightful

Another one... email below from CPGuard and latest update here: https://opsshield.com/notice/cpguard-update-channel-compromise.html

Email:

Dear cPGuard customers and partners,
An unidentified attacker targeted OPSSHIELD, gained unauthorized access to our licensing and update systems, and distributed a malicious script through the cPGuard update channel. We have stopped further distribution of the script and released cPGuard 5.88.25 to remove the known backdoor and files left by the script.
The script sent data to an endpoint on our licensing server under a compromised account. We secured that account as soon as we identified the breach and cleared our infrastructure credentials. We are investigating how the attacker gained access, which customer servers ran the script, and what data the attacker accessed.
Please take the following actions immediately.
1. Update every cPGuard server. Run cpgcli update --start. The corrective update removes the backdoor shell at /var/tmp/.cpg91511_sh and the collection directory /var/tmp/.cpg91511, including the password hashes and credential archive (loot.tgz) staged there.
2. Verify the installed version. After the update completes, run cpgcli --version on each server and confirm it reports 5.88.25. If the update fails or the server still reports an older version (between 5.88.12 and 5.88.19), contact OPSSHIELD Support immediately.
3. If you know or suspect the malicious script ran, reset passwords and revoke exposed credentials. The script targeted /etc/shadow. Reset passwords for root and all other password-enabled local accounts from a trusted recovery environment. From a trusted device, change any passwords reused elsewhere and rotate affected database passwords, S3 access keys, DigitalOcean tokens, and secrets recorded in root's shell history. Replace SSH private keys stored under /root/.ssh and remove the corresponding old public keys from every system that trusts them. Complete this step even if the update succeeds, because credentials copied before cleanup may still be usable.
We are sorry that this breach put your systems at risk. If you need help assessing a server, please contact OPSSHIELD Support through your usual support channel. We will share further findings as we verify them.
The OPSSHIELD Team

AnthonySmith

It's getting scary out there.

dylightful

@AnthonySmith said:
It's getting scary out there.

I don't know about anyone else, but I'm tired....

poei

@dylightful said:

@AnthonySmith said:
It's getting scary out there.

I don't know about anyone else, but I'm tired....

Docker_dude

@AnthonySmith said:
It's getting scary out there.

At this point when AI is finding linux vulnerabilities every week it's a challenge to have everything running how it should be and no vulnerabilities.

AnthonySmith

@Docker_dude said:

@AnthonySmith said:
It's getting scary out there.

At this point when AI is finding linux vulnerabilities every week it's a challenge to have everything running how it should be and no vulnerabilities.

I used to genuinely worry about security on a deep and personal level, like if a platform I was responsible for got breached or comprised etc I would have taken that deeply personally.

I still do, but I am not sure if I could ever take it personally anymore, I know I do what I can but at this point, it feels like worrying about rain touching the ground.

I was giving security some thinking yesterday in a broader sense in relation to AI, we all use windows Linux Mac or bsd and we all pretty much use the same thing for online services, php, node, go, etc, with very little variations.

So the blue print is there, a medium level LLM is already better at all of the above than any entire team of humans if directed by a competent human, it's finite, to a human knowing everything about all of the above with unlimited recall and 0.01% expert level in all along side the insane iteration speed all for $18 .... What chance do we have.

Security through obscurity might be the best defence as I doubt we are going to be able to keep up other wise.

Edit: phone murder auto correct

AK_KWH

things getting harder day by day