Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Advisory says to assume all Drupal 7 websites are compromised

Steve Ragan | Oct. 31, 2014
Only those who patched within seven hours may be in the clear.

"That issue wasn't submitted as hey, this is a security hole,' and it wasn't submitted to the security teams issue queue (where there *are* people who's role it is to address these sorts of things). There are currently over 14000 issues in Drupal core's issue queue. I would bet money that somebody else has also reported another potential security hole via some sort of report in there, and nobody has seen it. Who's job is it? Yours. Mine. Everybody who participates in an open source project. Many eyes make all bugs shallow only works if you actually have many eyes."

Again, anyone using a Drupal installation that isn't updated to version 7.32 (or an installation that wasn't patched within the target window) should assume the worst and start the recovery process.

Drupal has offered some basic steps, but the incident response process will differ between organizations, so it's best to stick to internal policy no matter what. For administrators acting on their own, contact your Web host and discuss options, which could include assistance in responding to a potential incident.

In the mean time, the first step is to take the Drupal website offline. Replace the index.php file with a generic HTML page, and begin the transition process to a backup of the website that is from October 14 or earlier.

Do not attempt to restore without a backup or just patch a standing install. Attacks targeting this vulnerability have been known to install backdoors, which may reside outside of Drupal's core code.

Unfortunately, if the backups were stored on the same server as the compromised website, it might be best to remove the entire installation and rebuild it from scratch.

Either way, the entire server will need to be checked for malicious code, and signs of malicious activity. This is because a single vulnerable Drupal install is all that's needed to compromise the server and all the other websites on it, which compounds the problem for administrators hosting Drupal on re-seller hosting accounts or shared hosting environments.

 

Previous Page  1  2 

Sign up for CIO Asia eNewsletters.