Hackers exploited a series of preventable security lapses to perform a BGP hijacking, installing malware via seemingly legitimate software updates. The attack impacted networks managed by hosting provider Hetzner Online, through a poorly configured process involving a cloud management platform called Softaculous. Despite warnings from the company, the attack highlights the critical importance of robust security practices in the tech industry.

The attackers benefited from Softaculous’s failure to validate update packages using code signing—a basic security measure. This oversight allowed the malicious update to bypass verification, potentially infecting a small but unknown number of servers. The attack spanned a 33-hour window, during which Hetzner Online intermittently misdirected traffic, only to reclaim control 12 hours after the hijacking started.

While the incident window was closed within a day, the vulnerability underscores the need for stringent security protocols. It serves as a stark reminder that even large, established companies can fall victim to such attacks due to human error or inadequate security measures. The lack of cryptographic verification is particularly concerning, as it leaves the system vulnerable to compromise.

The attackers were able to push malware to unsuspecting users by pushing modified update packages. Softaculous’s update clients did not verify the update packages, meaning a malicious package would not have been detected. This incident serves as a cautionary tale for the tech industry, emphasizing the importance of robust security practices and the need for more stringent validation processes.