Posted by joyseeker on October 30, 2014 at 7:27am
Yesterday, my webhost told me that one of my Drupal sites was sending out spam, and the emails were coming from the Drupal modules folder. Since it is only a test site I occasionally use, I deleted the Drupal installation.
Then tonight I see the Security group talking about Drupageddon, and how Drupal sites have been compromised with one of the indications being that spam is being sent out from the Drupal site.
https://groups.drupal.org/node/447468
There's no new Drupal core update since October 15 -- does this mean that all Drupal sites are, potentially, compromised? If so, what is the fix? Does this mean I have to "Build a new VM/host server" as the post states?
Susan
Comments
And the bad news about Drupageddon is out
http://www.zdnet.com/drupal-security-team-gives-ominous-news-7000035242/
Install the patch/upgrade
The Public Service Anouncement - PSA-2014-003 released yesterday... talks about the patch/Drupal upgrade from two weeks ago. It suggests if you haven't yet updated your Drupal 7 sites, there's a likelihood your site is hacked and you have problems beyond just needing to patch/upgrade -- which you still need to do.
If you patched your site the first day or two
Quit reading. Nothing left to see here. :-P
If you haven't yet upgraded or patched you site - do it now
If you still need to upgrade ... maybe you're a bunch of versions behind and you've been "meaning to upgrade" ... well, just apply the patch now. It's safe... easy... and will protect your site.
How to patch?
You'll need to use the command line.
sshto your server (or use a control panel "to open a terminal" -- or whatever your host calls it that allows access to the CLI), navigate to the Drupal root and cut-paste this:[ -f includes/database/database.inc ] && wget --no-check-certificate -O - https://www.drupal.org/files/issues/SA-CORE-2014-005-D7.patch | patch -p1 -b && git diff includes/database/database.inc includes/database/database.inc.orig #security patchThat's it. no other actions needed. You don't need to run update.php, etc.
Is it safe?
Let me break it down and you decide.
[ -f <em>includes/database/database.inc</em> ]<-- "Test" for the existance of the file tht needs to be patched; doesn't exist on drupal 6 sites.wget --no-check-certificate -O - https://www.drupal.org/files/issues/SA-CORE-2014-005-D7.patch<-- go get the patch... you can first try without --no-check-certificate, but it won't work on some servers. with the flag as listed, there is a small risk of spoofingpatch -p1 -b<-- Uses the download and applies the patch. if there's an error, it won't apply and it'll tell you a bit about the problem -- so therefore, no danger doing this twice.git diff includes/database/database.inc includes/database/database.inc.orig<-- Show us what happened, if anything. if git isn;t installed on the server, simply remove that portion of the command.--
mike stewart { twitter: @MediaDoneRight | IRC nick: mike stewart }
Thank you
Thanks for bringing this to my attention. I am in the middle of doing all of the upgrades.
A note for those following the thread via email. Most (I hope all) know that email uses the HTML entities instead of the displayed character so the less-than sign becomes < (shows as ampersand l t ;) and ampersand becomes & (shows as ampersand a m p ;).
Do not copy the email text into a shell. You won't get what you desired.
Thanks Mike!
Nice post.
I though the patch was incorporated in latest release of core (7.32). Is this not true? Thanks again.
Stopping the incursion before it enters
Thanks, Mike.
The site that was compromised was only a clean Drupal install that I used to test out modules, and it had no protection against user spam. What is so shocking to me was that through this compromise, they were able to create an email address outside of my cpanel to use for sending spam.
My live sites are not compromised even though I just upgraded to 7.32 yesterday. I have a lot of security on them to stop the user spam from entering like Spamicide, Captcha and Honeypot, etc. Also, PHP is turned off. I exported my Watchdog table to Excel to look at the spam activity, and it's amazing the complicated code spammers are trying to inject using PHP! (The Excel format decompiles the code; SQL doesn't.) They are trying to exploit the user and logintoboggan modules.
phpMyAdmin Does Export Text in SQL format
There is a checkbox in phpMyAdmin export that allows you to output an export in text. This can be dangerous if the BLOB fields do contain (8-bit) binary. You will need to do a 'Custom' export to get the checkbox.
Latest release of core does have the patch
Those of us that just recently upgraded still may have been hacked though and back doors may have been left. The recommended approach is a restore from backup before 10/15.
Latest release of core does have the patch
Those of us that just recently upgraded still may have been hacked though and back doors may have been left. The recommended approach is a restore from backup before 10/15.
Latest release of core does have the patch
Those of us that just recently upgraded still may have been hacked though and back doors may have been left. The recommended approach is a restore from backup before 10/15.
https://www.drupal.org/projec
https://www.drupal.org/project/drupalgeddon
This drush script can help you in determining if your site has been hacked... but at this point, you might need to assume that it has, even if it doesn't catch anything for you.
Keep up with your security updates people :) especially when they're so explicitly critical.
A few other things to be looking for: modified files, new users or roles, strange entries in the menu router table.
Any other suggestions?
7.32 does include the patch
Just to be clear, 7.32 includes the patch.
I agree with @oseldman -- patch your sites. However, I posted the one liner above if for some reason you don't/haven't had time to do a full update... if you haven't upgraded to 7.32, you should at least apply the patch; which will close the door to future exploits.
Note: Your 'status report' will still report the current version of Drupal.
To add to @oseldman list of checks, look at your webtraffic logs ... have you had a spike since the 15th? That may be an indicator of some nafarious activity/backdoor. You could also check server logs for a spike in outgoing traffic, such as email -- though you may not have access to this type of info depending on your service provider.
--
mike stewart { twitter: @MediaDoneRight | IRC nick: mike stewart }
Follow up discussion
There's and excellent follow up discussion posted by @bevan. Have a look at some additional helpful suggestions there, and in the comments: https://groups.drupal.org/node/447468
patched within "the first day or two" is not enough
Important corrections to mike stewart's comments: "If you patched your site the first day or two Quit reading. Nothing left to see here. :-P"
This is not true. Sites patched or updated within the first few hours can be considered safe, but all others should be considered compromised.
From the PSA:
Also a correction to this: "if you haven't upgraded to 7.32, you should at least apply the patch; which will close the door to future exploits."
Not exactly true. Patching or updating now won't close any backdoors which may have been left by intruders while your site was vulnerable. Those backdoors will leave your site vulnerable to continued tampering even after you update.
From the PSA:
Summary: Any site which was not updated within 7 hours after the announcement should be considered compromised.
Drupalgeddon followup and security presentation this Thursday
If anyone in this thread is interested, I'm presenting on Better Sleep Through Web Security and sharing our company's security process. We're still getting calls and emails from companies and organizations who didn't get patched and updated in time and aren't able to keep up with the demand.
All the meetup info is at https://groups.drupal.org/node/448913 and here's just the essential location and call-in information.
Date and time: November 20, 2014 at 6pm Pacific Time
Location: Fuller Theological Seminary, at 135 N Oakland Ave
Pasadena, CA 91101 (Building "Glasser 110")
Video conference: https://glad.zoom.us/j/129319220
Phone: +1 415-762-9988 or +1 646-568-7788
Meeting ID: 129 319 220
In short, it's now more cost-effective for site owners to skip a security audit and just rollback and redeploy content and code changes since the Drupalgeddon security advisory an October 15th and check / rehaul their server infrastructure. The presentation has a lot more.