security

Hi All,

I recently received an email from my host (Arvixe) stating that they had disabled a script on one of my D7 sandbox sites due to large quantities of spam email emanating from there.

Upon investigation I found an encrypted PHP file called "sql91.php" in my modules/field/modules/options folder. I later discovered a second bogus file called "sraynr.php" in a different folder. Both of these files have been called from Russian IP addresses:

146.185.239.52
146.185.239.51

According to Drupal Community, Drupal 7.32 was released on October 15, 2014 which contain fixes for security vulnerabilities.

Sites are urged to upgrade immediately after reading this security announcement.

For anyone who runs a "responsible disclosure" program, you are probably used to getting reports of SQL injection that are not valid. SQL Injection can be tough for an independent researcher to validate because demonstrating it either requires a lot of time (to fingerprint the structure and get some secret) or a damaging interaction (dropping some tables?) or both.

I just ran across an article regarding a new discovered security flaw in any USB devices. And yes Virginia, this could affect Mac's. Someone has discovered how to store viruses / malware in the firmware of a USB devices. Here is an excerpt from the article along with a link to the full article.

According to Drupal Community, Drupal 7.29 and 6.32 were released on July 16, 2014 which contain fixes for security vulnerabilities.

Sites are urged to upgrade immediately after reading this security announcement.

According to Drupal Community, Drupal 7.27 and 6.31 were released on April 17, 2014 which contain fixes for security vulnerabilities.

Sites are urged to upgrade immediately after reading this security announcement.

According to Drupal Community, Drupal 7.26 and 6.30 were released on January 16, 2014 which contain fixes for security vulnerabilities.

Sites are urged to upgrade immediately after reading this security announcement.

Are there any hosted WAF (Web Application Firewall) solutions available that work best with Drupal? The site we have in mind for use in this scenario is a simple content-driven site.

There's the Drupal core security advisory just released that talks about the uncontrolled PHP execution. here's some remarks.

1. If you're using the config available on the Nginx wiki you're vulnerable.

   That config has a catch all location location ~ \.php$ {...} for handling
   PHP script execution.

2. If you're using any of the configs recommended on the [Nginx group] (https://groups.drupal.org/nginx) you're safe.

Hi,

My 2 sites are hacked. both in almost same way. my .htaccess is rewritten. and some fishy code is written in corn.php, install.php, update.php,authorize.php. Also a file wp-config.php,

All JS file in the all/modules were also written document.write(<iframe src=....)

does nay one has any clue.

thanks