Hackers have gained access to the core infrastructure of LineageOS, a mobile operating system based on Android, used for smartphones, tablets, and set-top boxes.
The intrusion took place last night, on Saturday, at around 8 pm (US Pacific coast), and was detected before the attackers could do any harm, the LineageOS team said in a statement published less than three hours after the incident. The LineageOS team said the operating system's source code was unaffected, and so were any operating system builds, which had been already paused since April 30, because of an unrelated issue. Signing keys, used to authenticate official OS distributions, were also unaffected, as these hosts were stored separately from the LineageOS main infrastructure.
LineageOS developers said the hack took place after the attacker used an unpatched vulnerability to breach its Salt installation. Salt is an open-source framework provided by Saltstack that is usually deployed and used to manage and automate servers inside data centers, cloud server setups, or internal networks. Earlier this week, cyber-security firm
F-Secure disclosed two major vulnerabilities in the Salt framework that could be used to take over Salt installations.
www.zdnet.com
