Hi All,
I am curious to know who of you were affected by the recent hacks by these guys: https://www.facebook.com/Hamzah.Uygun.Gov
They targeted quite a few SA sites as evident in their Facebook timeline and reports in the media about Sasol and others:
http://www.fin24.com/Tech/News/Hackers-hit-Sasols-website-20141203
http://www.enca.com/technology/cyber-hactivist-strikes-sa-sites-again
http://ridgetimes.co.za/25879/sasols-website-gets-hacked/
Some of my older sites were affected and when I found out about the Sasol site I inspected theirs with Built With and noticed it is also built in Drupal.
It appears that typically the home page is replaced and that the admin user name and password is changed with some sites also having multiple new admin users (!).
Does anyone know the vulnerability in which version of Drupal or particular module that are allowing these hacks or is it related to the these announcements: https://www.drupal.org/SA-CORE-2014-005 and https://www.drupal.org/SA-CORE-2014-005 ?
Comments
False Flag Hacks
Of our over 30 or so Drupal sites only the version 7.x ones that did not have the recent security update were affected. All 6.x sites were OK.
Three sites were affected. In two, several admin accounts were created and in one they ftp'd stuff in...