3 ms·
I have started to use Drupal to create a small site for a non-profit. I disabled the site a couple of days after this vulnerability. Is there a way to determine
by jareds 12y ago
I have started to use Drupal to create a small site for a non-profit. I disabled the site a couple of days after this vulnerability. Is there a way to determine if I have been compromised or since I have put about 30 minutes of work into it so far am I better off rebuilding from scratch?
- dageshi 12y agoFor peace of mind I'd rebuild from scratch in your circumstances.
- patkai 12y agoYes, there is: http://drupal.geek.nz/ http://drupal.geek.nz/
- dubcanada 12y agoGo into your Drupal updates and see if the core says 7.32 if it does you are good. If it doesn't just update it using drush and carry on.
- objclxt 12y agoNo: that's not good advice. The OP said "I disabled the site a couple of days after this vulnerability", but we know that there were attacks in the wild within hours of disclosure. If it's only 30 minutes work you might as well start over.
- cr3ative 12y agoThis isn't the "correct" answer - because a backdoor may have been dropped which you wouldn't notice with this method.
- lemonberry 12y agoAlso, apparently some sites were found, or it's at least feasible, that someone got control/access of the site and applied the patch themselves to keep others from doing the same. Like a burglar locking the door behind themselves.
- grumps 12y agoSmall sites may not have been hit if you turned it off soon enough. Quick tips: * Look through the menu_router table for suspicious looking entries. * Look at users & user roles, anything new? * Look for scripts and executibles in your public and private upload files directory. If you really don't know drupal and it's a new project, start from scratch (New Database but you're code should be safe assuming your repo isn't stored on the same server and there's no write to repo access on server)