How it went down

The attack began a few minutes before 9 PM UTC on Friday, when a small chunk of Softaculous IP space entered the global routing table. This new IP prefix, designated as 162.55.80.0/24, was announced along the path: AS6204 (Zet.net), AS62390 (Nexon Host), and AS24940 (Hetzner Online).

This IP range, containing 256 addresses, hosted Softaculous’ software-update endpoint and its client and billing site. The space was a more specific chunk of the much bigger 162.55.0.0/16 space that was usually originated AS24940. According to a post by BGP expert Doug Madory, the announcement likely originated with NexonHost (AS62390), possibly through a compromise of its infrastructure or a customer who exploited gaps in its security.

Protocols such as RPKI prevent large operators from routing addresses made through fraud or error, but the routing lapses and the failure to properly monitor traffic allowed the hijack to pulse on and off for much of the weekend. Madory, who is head of Internet analysis at Infoblox, continued:

The hijack also included an AS path with a forged origin. Because the attacker appended 24940 as the rightmost ASN in the path, it was considered RPKI-valid for two reasons: the ROA required the origin to be AS24940 but also because it allowed the prefix length to be anywhere between 24 and 16. As a result, this route was RPKI-valid and would not be at risk of being dropped by ASes that reject RPKI-invalid routes.

Both Cartwright-Cox and Madory said Hetzner configured these settings in a way that allowed the hijacking to fly under the radar provided by these security measures.

IP ranges are measured in blocks, with the size of them designated by a slash followed by a number. Somewhat counterintuitively, the larger the number at the end, the smaller the block is. That’s because the system is based on the 32 bits forming the basis of the IPv4 standard. A /24 block designates (32-24)2, or 256 addresses. A /16 block designates (32-16)2, or 65,036 IPs.

Hetzner Online configured a parameter in RPKI that allowed sub-prefixes as small as /24 to be considered valid. Combined with the fact that the hijacked route contained an AS path forged to match the origin in the ROA, the attacker’s new route with a smaller prefix was able to bypass RPKI protections.