9 ms·
Up to 12M websites may have been compromised via Drupal vulnerability
- notastartup 12y agoWhy is Drupal so popular?
- deleted 12y ago[deleted]
- zdw 12y agoIt's quite a good CMS. Lots of modules that let it be easily extended. Has a cli management tool (drush) that allows for a lot of automation. Non-coders can build complex content sorting and display pages with Views, etc. It is a bit of a culture shock if you're using to spewing your PHP all over everything ala other lesser blogging tools, but once you've got your head wrapped around how it works internally, you can be very productive and do things that would be difficult/impossible in other systems with almost no code.
- pestaa 12y agoWhat a culture shock it will be once Drupal 8 comes out written on top of the Symfony framework. Hopefully the code quality coming from an average Drupal shop will increase. Now, can we fix the culture behind those other lesser blogging tools too, please?
- notastartup 12y agoI wonder if Drupal will ever recover after this incident. I haven't used Drupal because the job postings usually advertise super low wages and I think I saw the code base and was totally freaked by how messy the modules and things were. I won't even consider building something with Drupal unless it was secure but I'm sure this makes sense only in hindsight.
- las_cases 12y agoI believe it is because at one point Drupal was a pretty solid foundation for a lot of project types and was greatly flexible. Right now WordPress is way more popular though.
- butterfi 12y agoWordpress and Drupal have similar features, but typically WP is thought to be more of a blogging platform while Drupal has a platform for not just blogging, but online community, e-commerce, etc.
- las_cases 12y agoWell, truth be told Drupal is 13 years old and WordPress 11 years old. I am sure that they both had a lot of time to add tons of features so I am thinking that the gap between them is more in theory, judging by their roots, and less in practice. I know that WordPress has for example BuddyPress for social networking / communities and a number of (free) e-commerce plugins as well.
- ninjaplease 12y agoYeah not really that much of a distinction these days. People have built just about anything on WordPress. Community & ecommerce are both covered pretty solidly by the plugin ecosystem.
- dubcanada 12y agoYou can build a skyscraper using a hammer, but you probably shouldn't. It's the exact same argument with WordPress and Drupal. Drupal is vastly superior for most dynamic website tasks then WordPress is. Views + content types provide that.
- ceejayoz 12y agoHaving recently attempted to migrate a D6 site to D7, I really can't agree. It was a nightmare.
- icecreampain 12y agoLegacy. Drupal was quicker on the "different user roles CMS"-ball which left Wordpress behind. Now that Wordpress has caught up and come up with solutions to content access, I find that WP is far superior to Drupal in every way. The fact that Drupal doesn't allow classes as modules is a complete deal breaker for me - functional Drupal modules are a complete and utter mess.
- simonmales 12y agoDo any of the honeypots have examples of the backdoors in action?
- daviddede 12y agoWe have a few samples of the SQL injection attempts here: http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts-in-the-wild.html http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts... In there you can see the type of backdoors being added (generally fake users with admin-level privileges).
- aleem 12y agoMy sympathies are with the Drupal community, it may never fully recover from a crisis of this magnitude despite whatever. At times like this, I really wish there were more best practices to mitigate against these type of vulnerabilities. One idea is using the remote-execution vulnerability itself to remotely patch the servers by passing the antidote as the payload. I am not sure if this would be legal. The other is something what CloudFlare already does but doing it at the hosting-provider or ISP layer. It need not be as proactive as CloudFlare which can inspect HTTP requests for known exploits and blocks them. It could be something as simple as running scanners and routinely informing customers that their websites are vulnerable. Or better still, temporarily disabling the account or putting it into read-only mode, thereby forcing users to take action.
- drzaiusapelord 12y agoOr, autopatching of security patches without human intervention. This stuff isn't that hard too figure out. The Drupal community needs to stop pretending that its 1996 anymore and start taking security seriously. I think the CMS world needs a Microsoft circa 1999 moment.
- ayrx 12y agoThat is a absolutely horrible idea for frameworks that Drupal. That essentially implies that someone has arbitrary write access to your servers and is free to modify things as he or she wishes.
- geerlingguy 12y ago> At times like this, I really wish there were more best practices to mitigate against these type of vulnerabilities. There are many best practices: - Use version control. - Have remote backups for the past day, week, month, etc. - Apply security patches immediately (and have test infrastructure so you can make sure they don't break anything). - Be able to rebuild a server from scratch w/ backups (configuration management really helps here). - Subscribe to security mailing lists/RSS feeds/Twitter accounts. This vulnerability is pretty bad, of course, but there have been many like it before, and there will be many like it in years to come. If nothing else, use this situation to prepare for the worst on your own site; how would you respond if your site was hacked, your database in an unknown state, and your codebase potentially backdoored?
- arkitaip 12y agoOne of the nice things about major releases of Wordpress is that it will auto patch minor releases. I believe this is a reasonable approach for most open source CMS even if it might break some functionality. You can also fairly easily add auto update for plugins and themes by modifying wp-config.php [1]. I suggest that themes/plugins with 100% compatibility ratings should be auto patched too. Auto patching themes can be problematic because updates override changes you've made to the theme files. So my other suggestion would be to automatically create a child theme for every installed theme so that devs can easily update the parent theme and keep changes made to it. [1] http://codex.wordpress.org/Configuring_Automatic_Background_Updates http://codex.wordpress.org/Configuring_Automatic_Background_...
- ams6110 12y agoYes, better to have your site temporarily broken by an update than hacked and all data stolen. At least in many cases.
- nkuttler 12y agoOf course, giving your php webapp the permission to rewrite it's core files is a brilliant and secure idea!
- ams6110 12y agoMost operating systems do it. It's not an intractable problem.
- hahainternet 12y agoSaid operating systems typically require you to use an account that is inaccessible to almost all automated processes. This would not be the case, the two are not analogous.
- Retric 12y agoSigned binary's can get you most of the way there. It's still a trade-off and for most users waiting to apply a security patch is a larger danger.
- UnoriginalGuy 12y agoWhy does Drupal use string manipulation to generate SQL statements instead of bind parameters? It is 2014, hasn't this been best practice since at least the late 1990s? Wouldn't all security audits, including automated ones, pick this up? And before someone makes a "joke" about PHP, they're using the PDO framework which supports bindParam(). Seems like woful incompetence in the Drupal codebase to me. Exploit in detail: https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html https://www.sektioneins.de/en/advisories/advisory-012014-dru...
- fuligo 12y agoGenerating SQL statements always involves string manipulation at some stage, doesn't it? I mean at some point even PDO has to send query strings to the SQL server. The question is whether Drupal really needed to implement their own engine for this, though.
- UnoriginalGuy 12y ago> Generating SQL statements always involves string manipulation at some stage, doesn't it? I mean at some point even PDO has to send query strings to the SQL server. If your database supports it set PDO::ATTR_EMULATE_PREPARES to false. If not, I'd still take PDO's implementation over a million different implementations which other projects come up with such as this one.
- ams6110 12y agoLegacy? Tons of code to change, and users more interested in new features? No tests? Developer conceit about their own abilities to "do it right"? All the usual reasons any project has old code that exhibits bad practices by current standards.
- krapp 12y ago>Why does Drupal use string manipulation to generate SQL statements instead of bind parameters? Is 'elegance creep' a thing? I would be willing to bet money I don't have, that it's because someone thought it was more elegant and clever, and therefore just better.
- chx 12y agoPerhaps read http://cmsreport.com/articles/drupal-security-not-shocking-but-responsible-11234 http://cmsreport.com/articles/drupal-security-not-shocking-b... as well.
- scolson 12y agoI read that article last night and was wondering if someone here was going to point out how the 12m figure is made up. Were there compromised sites? Sure, but I would be surprised if it were more than an order of magnitude less than what the bbc reported. That is still a lot of sites, but not a monumental cluster-fsck that the aftermath is being made out to be.
- buro9 12y agoI cannot think of how many charities this will affect. Almost without exception, every small or medium UK charity I know uses Drupal in some way for their work. These are usually customised for a specific project, and some of these will have donation facilities built-in. The worrying thing as always is that few people upgrade these instances once they are launched and operational.
- bigiain 12y agoI'm wondering how many Australian government departments - who're all encouraged to use a government supported Drupal platform - are dealing with this properly: https://agov.com.au/ https://agov.com.au/
- jareds 12y agoI have started to use Drupal to create a small site for a non-profit. I disabled the site a couple of days after this vulnerability. Is there a way to determine if I have been compromised or since I have put about 30 minutes of work into it so far am I better off rebuilding from scratch?
- dageshi 12y agoFor peace of mind I'd rebuild from scratch in your circumstances.
- patkai 12y agoYes, there is: http://drupal.geek.nz/ http://drupal.geek.nz/
- dubcanada 12y agoGo into your Drupal updates and see if the core says 7.32 if it does you are good. If it doesn't just update it using drush and carry on.
- objclxt 12y agoNo: that's not good advice. The OP said "I disabled the site a couple of days after this vulnerability", but we know that there were attacks in the wild within hours of disclosure. If it's only 30 minutes work you might as well start over.
- cr3ative 12y agoThis isn't the "correct" answer - because a backdoor may have been dropped which you wouldn't notice with this method.
- lemonberry 12y agoAlso, apparently some sites were found, or it's at least feasible, that someone got control/access of the site and applied the patch themselves to keep others from doing the same. Like a burglar locking the door behind themselves.
- 12y ago
- troymc 12y agoIn the WordPress world, there are many "managed" WordPress hosting providers (including wordpress.com) which will apply WordPress core updates automatically. In the Drupal world, there are some similar managed Drupal hosting providers (e.g. Drupal Gardens), but they're much less common. I wonder why.
- mkr-hn 12y agoThis is one reason I host my blog with Automattic's own hosting thing. I can manage all the technical things, but I don't want to.
- geerlingguy 12y agoThere are a few, such as Pantheon[1], Acquia Cloud[2], Platform.sh[3]. All three of the above providers did add some level of protection immediately following the security announcement, and they (and some other providers) helped ensure sites were updated to 7.32 as soon as possible. I have to link back to my earlier comment about the key takeaway here[4]—not just for Drupal sites, but for anyone who operates any site on any server. You can't afford to let your site sit unmaintained if you value the information within; and if you build sites for other people, you have to convey the importance of that to your customers... 'With great power comes great responsibility' and all that jazz. Your site is either currently broken, or will be someday; it's not about making 100% secure code and servers (you strive for that, of course); it's about your response once something happens (e.g. a security patch is released). [1] https://www.getpantheon.com/ https://www.getpantheon.com/ [2] https://www.acquia.com/products-services/acquia-cloud https://www.acquia.com/products-services/acquia-cloud [3] https://platform.sh/ https://platform.sh/ [4] https://news.ycombinator.com/item?id=8529385 https://news.ycombinator.com/item?id=8529385
- nakovet 12y agoI've updated my site the minute I got the e-mail, though I am not sure if it was fast enough, because there is no way to know if there is any backdoors, besides installing a fresh version and checking the differences.
- macNchz 12y agoI've cleaned up a bunch of compromised servers, and I've never encountered—at least with exploited wordpress installs—an attacker sophisticated enough to change the timestamps on the files containing back doors, so, while I always just overwrote everything from a backup, finding all of the backdoored files right away would amount to something like: $ find /var/www/blah.com/htdocs/ -iname "*.php" -mtime -1 -print
- daviddede 12y agoAnd that was at the same time that everyone was worried about POODLE and the media was going crazy over it. Somehow this vulnerability went over the radar. What is interesting is that based on our own data, we started noticing attacks around 8 hours after it was disclosed and we shared some of the payloads being used here: http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts-in-the-wild.html http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts...
- aaron695 12y agoI have seen 0 evidence of any mass compromise. In fact I've seen 0 evidence of even one site being compromised. Any links with substance?