 |
 |
How do they receive vulnerability report ahead of general public? From whom? Cary On Friday, October 31, 2014, Lin, Kun <[log in to unmask]> wrote: > If you are using drupal as main website, consider using Cloudflare Pro. > It's just $20 a month and worth it. They'll help block most attacks. And > they usually receive vulnerability report ahead of general public. > > Kun > > -----Original Message----- > From: Code for Libraries [mailto:[log in to unmask] <javascript:;>] > On Behalf Of Cary Gordon > Sent: Friday, October 31, 2014 9:59 AM > To: [log in to unmask] <javascript:;> > Subject: Re: [CODE4LIB] Terrible Drupal vulnerability > > This is what I posted to the Drupal4Lib list: > > -------------------- > > By now, you should have seen https://www.drupal.org/PSA-2014-003 and > heard about the "Drupageddon" exploits. and you may be wondering if you > were vulnerable or iff you were hit by this, how you can tell and what you > should do. Drupageddon affects Drupal 7, Drupal 8 and, if you use the DBTNG > module, Drupal 6. > > The general recommendation is that if you do not know or are unsure of > your server's security and you did not either update to Drupal 7.32 or > apply the patch within a few hours of the notice, you should assume that > your site (and server) was hacked and you should restore everything to a > backup from before October 15th or earlier. If your manage your server and > you have any doubts about your file security, you should restore that to a > pre 10/15 image, as well or do a reinstall of your server software. > > I know this sounds drastic, and I know that not everyone will do that. > There are some tests you can run on your server, but they can only verify > the hacks that have been identified. > > At MPOW, we enforce file security on our production servers. Our > deployments are scripted in our continuous integration system, and only > that system can write files outside of the temporal file directory (e.g. > /sites/site-name/files). We also forbid executables in the temporal file > system. This prevents many exploits related to this issue. > > Of course, the attack itself is on the database, so even if the file > system is not compromised, the attacker could, for example, get admin > access to the site by creating an account, making it an admin, and sending > themselves a password. While they need a valid email address to set the > password, they would likely change that as soon as they were in. > > Some resources: > https://www.drupal.org/PSA-2014-003 > > https://www.acquia.com/blog/learning-hackers-week-after-drupal-sql-injection-announcement > > http://drupal.stackexchange.com/questions/133996/drupal-sa-core-2014-005-how-to-tell-if-my-server-sites-were-compromised > > I won't attempt to outline every audit technique here, but if you have any > questions, please ask them. > > The takeaway from this incident, is that while Drupal has a great security > team and community, it is incumbent upon site owners and admins to pay > attention. Most Drupal security issues are only exploitable by privileged > users, and admins need to be careful and read every security notice. If a > vulnerability is publicly exploitable, you must take action immediately. > > Thanks, > > Cary > > On Thu, Oct 30, 2014 at 5:24 PM, Dan Scott <[log in to unmask] > <javascript:;>> wrote: > > > Via lwn.net, I came across https://www.drupal.org/PSA-2014-003 and my > > heart > > sank: > > > > """ > > Automated attacks began compromising Drupal 7 websites that were not > > patched or updated to Drupal 7.32 within hours of the announcement of > > SA-CORE-2014-005 > > - <https://www.drupal.org/SA-CORE-2014-005>Drupal > > <https://www.drupal.org/SA-CORE-2014-005> core - SQL injection > > <https://www.drupal.org/SA-CORE-2014-005>. You should proceed under > > the assumption that every Drupal 7 website was compromised unless > > updated or patched before Oct 15th, 11pm UTC, that is 7 hours after the > announcement. > > """ > > > > That's about as bad as it gets, folks. > > > > > > -- > Cary Gordon > The Cherry Hill Company > http://chillco.com > -- Cary Gordon The Cherry Hill Company http://chillco.com