An UpdraftCentral connection key can send commands to a connected WordPress site, giving an administrator investigating a backdoor a reason to examine the backup management connection itself. The backup relationship supplies the route in. Its authority travels with the stolen key.

BleepingComputer reports that an intruder breached TeamUpdraft’s website, potentially compromising those connection keys. Its report describes stolen keys being used to backdoor WordPress sites.

For the person responsible for restoring a site, that leaves two jobs: removing the backdoor and establishing whether the management connection still lets someone put it back. A clean site can still trust a stolen key.

There is a related failure in the certificate news. Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found that their private keys could be recovered almost instantly. Mozilla, Google and Apple blocked the compromised certificates. The mechanisms differ, but both stories put the same operational question in front of the person maintaining the receiving system: does it still accept the compromised credential?

A backup service’s command connection deserves the scrutiny given to any other remote administration route. Invalidating an exposed UpdraftCentral key and replacing the connection’s credentials removes that key’s authority. Cleaning WordPress files alone leaves the command route intact.