Security

Hi everyone,

The Drupal Security Team is updating its security issue reporting tools to Drupal 7. We also need your help to improve our reporting workflow and make it easy to report and track security issues.

Please take our survey: Please help us out by taking our survey. http://ow.ly/uqAHz .

This survey should take between 5 and 10 minutes to complete. It is on 2 pages.

All my domains were earlier hacked which I describe in this post https://drupal.org/node/2153055.

I have now uploaded one OLD site but without hacked files and need to update this but not just now - maybe a stupid question but taken the site off-line will it then be impossible for hackers to attack this site because they can't see it's and old version and other info which hackers go for?

Edited 10:25: And is it also safe to use Devel module online when the site is put off-line?

Hi Folks,

I want to accurately describe to a client the vulnerability of a form collecting data over http.

I understand that over unprotected wifi a person could "listen" and grab data passing from someone submitting info to the form.

What I don't know is how hard it is for someone to "sit" on a particular form and collect data being submitted to the form from people who do share a network connection with the person trying to steal the information.

Thanks,

Shai

Are there any hosted WAF (Web Application Firewall) solutions available that work best with Drupal? The site we have in mind for use in this scenario is a simple content-driven site.

There's the Drupal core security advisory just released that talks about the uncontrolled PHP execution. here's some remarks.

1. If you're using the config available on the Nginx wiki you're vulnerable.

   That config has a catch all location location ~ \.php$ {...} for handling
   PHP script execution.

2. If you're using any of the configs recommended on the [Nginx group] (https://groups.drupal.org/nginx) you're safe.

Hi there,

Wondering what else I should check on my site.

D6 site, all latest security patches. Have captcha module enabled.

Cleaned out the site of dummy users but I am still getting them to appear on the site. Along with fake comments.

Both user registration and posting comments requires a captcha image verification, but somehow they are still appearing.

What other security methods should I be looking at, or other forms of vulnerabilities that I need to check, to see why they are still being made?

HI

This topic has come up in the past at some events, within the security team and on drupal.org. Symfony project founder Fabien Potencier posted a proposal for dealing with downstream projects (such as Drupal) at
https://github.com/symfony/symfony-docs/pull/2639/files

This agreement will have an impact on how efficiently and how quickly the Drupal security team can work with the Symfony security team to coordinate security releases in a timely manner. Let's discuss this on github so Symfony and the other projects can be kept in the loop.