BGP hijack infecting networks caused by a comedy of errors that's not funny at all BGP劫持感染网络：一出并不好笑的连环失误

TL;DR

• Attackers executed a BGP hijacking attack on Softaculous's IP space (162.55.80.0/24), hijacking the routing path through hosting provider Hetzner Online and transit peer Zet.net to intercept and redirect software update traffic
• The hijacked IP addresses hosted Softaculous's software-update endpoint and client/billing site, allowing attackers to push malware disguised as legitimate Virtualizor updates to unsuspecting users
• Multiple preventable failures enabled the attack: lax BGP routing security configuration at Hetzner Online, failure to implement code signing for software updates at Softaculous, and inadequate monitoring by all involved parties
• The forged BGP route was technically RPKI-valid because the attacker appended AS24940 (Hetzner) as the origin ASN and the ROA allowed prefix lengths between /24 and /16, bypassing RPKI Route Origin Validation protections
• The attack pulsed on and off over a 33-hour window, with the hijack remaining undetected for approximately 22 hours due to failures in traffic monitoring across Softaculous, Hetzner Online, and Zet.net

Why It Matters

This incident demonstrates how foundational Internet routing infrastructure remains critically vulnerable despite decades of known risks, and how a single chain of preventable misconfigurations can enable a supply chain attack with real-world malware distribution capabilities. For AI practitioners and infrastructure operators, it underscores that security is only as strong as its weakest link — from BGP routing policies to code-signing practices — and that assuming RPKI deployment alone provides sufficient protection is a dangerous misconception.

Technical Details

• BGP Hijacking Mechanism: Attackers announced the more-specific prefix 162.55.80.0/24 (a subset of the broader 162.55.0.0/16 space normally originated by AS24940/Hetzner Online) through the AS path AS6204 (Zet.net) → AS62390 (Nexon Host) → AS24940 (Hetzner Online), effectively diverting traffic destined for Softaculous's update infrastructure
• RPKI Bypass via Overly Permissive ROA: The forged route passed RPKI Route Origin Validation because the ROA for the prefix allowed the origin ASN to be AS24940 and permitted prefix lengths ranging from /24 to /16, meaning the attacker's /24 announcement with AS24940 as the rightmost ASN was cryptographically valid
• Absence of Code Signing: Softaculous did not cryptographically verify update packages using code signing, meaning any modified or malicious update package delivered through the hijacked channel would be accepted without rejection by the Virtualizor update client
• Multi-Party Monitoring Failures: Hetzner Online initially reclaimed the address space 12 hours after the first hijack but then stopped announcing the path entirely, enabling a second hijack that went undetected for nearly 10 hours; neither Softaculous nor Zet.net detected the anomaly during the 22-hour active window
• Potential Origin Compromise: BGP expert Doug Madory indicated the malicious announcement likely originated from Nexon Host (AS62390), possibly through a compromise of its infrastructure or a customer exploiting security gaps within that environment

Industry Insight

• RPKI is not a silver bullet: Organizations must not assume RPKI deployment alone prevents hijacking; overly permissive ROA configurations (such as allowing wide prefix-length ranges) can be exploited, and operators should audit their ROAs for minimal necessary scope and enforce strict prefix-length matching
• Code signing for software updates is non-negotiable: Any organization distributing software updates over the Internet must implement cryptographic code signing and client-side verification; the absence of this basic security control turned a routing anomaly into a potential mass malware distribution event
• Supply chain security requires defense in depth across all layers: This attack exploited weaknesses at the routing layer (BGP), the hosting layer (Hetzner's configuration), the transit layer (Zet.net's monitoring gaps), and the application layer (Softaculous's lack of code signing); securing critical infrastructure demands that each layer independently enforce its own security controls rather than relying on any single mechanism

摘要

攻击者对Softaculous的IP地址空间（162.55.80.0/24）实施了BGP劫持攻击，劫持了经由托管服务提供商Hetzner Online和中转对等体Zet.net的路由路径，以拦截并重定向软件更新流量
被劫持的IP地址托管了Softaculous的软件更新端点和客户/计费网站，使攻击者能够向毫无戒心的用户推送伪装成合法Virtualizor更新的恶意软件
多重可预防的失败促成了此次攻击：Hetzner Online的BGP路由安全配置松懈、Softaculous未能实施软件更新的代码签名，以及所有相关方的监控不足
伪造的BGP路由在技术上符合RPKI有效性，因为攻击者将AS24940（Hetzner）作为起源ASN附加，且ROA允许的前缀长度在/24到/16之间，从而绕过了RPKI路由起源验证保护
攻击在33小时内断断续续进行，劫持持续约22小时未被发现，原因是Softaculous、Hetzner Online和Zet.net的流量监控存在失效

深度分析

简要总结

• 攻击者对Softaculous的IP地址空间（162.55.80.0/24）实施了BGP劫持攻击，劫持了经由托管服务提供商Hetzner Online和中转对等体Zet.net的路由路径，以拦截并重定向软件更新流量
• 被劫持的IP地址托管了Softaculous的软件更新端点和客户/计费网站，使攻击者能够向毫无戒心的用户推送伪装成合法Virtualizor更新的恶意软件
• 多重可预防的失败促成了此次攻击：Hetzner Online的BGP路由安全配置松懈、Softaculous未能实施软件更新的代码签名，以及所有相关方的监控不足
• 伪造的BGP路由在技术上符合RPKI有效性，因为攻击者将AS24940（Hetzner）作为起源ASN附加，且ROA允许的前缀长度在/24到/16之间，从而绕过了RPKI路由起源验证保护
• 攻击在33小时内断断续续进行，劫持持续约22小时未被发现，原因是Softaculous、Hetzner Online和Zet.net的流量监控存在失效

为何重要

此次事件表明，尽管已知风险已存在数十年，但基础互联网路由基础设施仍然极其脆弱，且单一系列可预防的配置错误即可促成具备实际恶意软件分发能力的供应链攻击。