Cybersecurity
Stolen UpdraftCentral keys backdoored WordPress sites
TeamUpdraft said unauthorised access to its website may have exposed customer data and connection keys, while Patchstack and Nethemba said attackers used those keys against connected WordPress sites.
- TeamUpdraft said it found unauthorised access to teamupdraft.com over the weekend of 17-18 October and believed its customer database had been accessed.
- The company said the exposed data may have included billing details, order history, password hashes, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone, but not payment details.
- TeamUpdraft said UpdraftPlus plugin files and downloads were unaffected, and it advised customers to update to 1.26.13 or 2.26.13 or later and remove stored UpdraftCentral keys.
- Patchstack said stolen access keys were being used against connected sites, while Nethemba said attackers targeted three of its sites through UpdraftCentral and installed malicious plugins on two.
TeamUpdraft said it detected unauthorised access to its website over the weekend of 17-18 October. It said it closed the access route, signed out all accounts and replaced keys and credentials that may have been affected.
The company said the customer database may have been accessed. It said the data could have included customer and billing information, order history, password hashes, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.
Patchstack's lead researcher, Oliver Sild, said attackers had started using stolen access keys to compromise sites connected to UpdraftCentral. Patchstack said the attacks began on 18 October at 15:32 UTC and that it had logged at least 99 malicious backdoor plugins.
Nethemba said three of its WordPress sites were targeted through UpdraftCentral and that malicious plugins were installed on two of them. It said the attacker used valid private dashboard keys, and that the initial 1.26.12/2.26.12 release had been intended to remove UpdraftCentral Cloud keys but a bug stopped that happening.
Named in this story
People
- Oliver Sild
- Patchstack's lead researcher who commented on the campaign
Companies
- TeamUpdraft
- said its website was breached and its customer database may have been accessed
- Patchstack
- reported that stolen keys were being used to backdoor connected sites
- Nethemba
- said its own WordPress sites were targeted through UpdraftCentral
Products and systems
- UpdraftPlus
- the backup plugin family that TeamUpdraft develops
- UpdraftCentral
- the remote management service whose connection keys may have been exposed
- UpdraftVault
- the cloud backup storage service whose keys may have been exposed
- UpdraftClone
- the staging site service whose keys may have been exposed
How the source tells it
The article was mostly straight news, but a sensational subheading and a large extrapolated exposure estimate gave it an alarmed, urgent edge.
- alarm a dramatic section heading and language about sites being backdoored
- threat inflation an estimate based on a percentage that was translated into a very large site count
- urgency rapid-response wording and imperative remediation instructions