On Saturday, at around 8 pm (US Pacific coast), hackers have breached the LineageOS servers by exploiting an unpatched vulnerability.
According to the LineageOS team, the attack was quickly detected and attackers had no time to not cause any problem.
LineageOS team confirmed that the OS builds, and signing keys for official OS distributions were not affected because they were stored on a separate infrastructure.
The LineageOS maintainers are still investigating the incident, meantime that have taken down their servers to address the issues.
The attackers exploited an unpatched vulnerability to breach its Salt installation. Salt (aka SaltStack) is Python-based, open-source software for event-driven IT automation, remote task execution, and configuration management. Salt allows organizations to monitor and update the state of their servers.
A few days ago, researchers from F-Secure disclosed a number of vulnerabilities in the “Salt” framework, including two issues that could be exploited by attackers to take over Salt installations.
The two flaws, tracked as CVE-2020-11651 and CVE-2020-11652, are a directory traversal issue and an authentication bypass vulnerability respectively. Chaining the issue, an attacker could bypass authentication and run arbitrary code on Salt master servers exposed online.
Administrators of Salt servers started reporting attacks exploiting the above vulnerabilities last week, threat actors used them to deliver backdoors and miners.
Administrators should install the available security updates to protect their installs.
Please vote Security Affairs for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS
(SecurityAffairs – LineageOS, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.