Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/31/2014
04:25 PM
50%
50%

Drupal: Attacks Started Within Hours Of Patch Release

If you didn't patch your site quickly, you should assume it was compromised, Drupal says.

Users of the Drupal content management system platform got a rude awakening this week: According to Drupal, automated attacks began compromising Drupal 7 websites that were not patched or updated to Drupal 7.32 within hours of the announcement of SA-CORE-2014-005 -- Drupal core -- SQL injection. And here's the kicker –- users should proceed with the assumption that every Drupal 7 website was compromised unless it was updated before 11:00 p.m. UTC on Oct. 15.

The vulnerability in question is a bug in a database abstraction API that allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests, this can lead to privilege escalation, arbitrary PHP execution, or other attacks as well, according to Drupal.

Not long after a security advisory was posted Oct. 15, multiple attacks were reported in the wild.

"As soon as a vulnerability in popular CMS platforms like Drupal is discovered, millions of crawlers operated by hackers (similar to Google bots) start searching for vulnerable websites," says High-Tech Bridge CEO Ilia Kolochenko, in a statement.

Once a victim is identified, their website gets hacked, patched (to prevent competition from overtaking the same site), and backdoored, he says. Within several days, access to the compromised website will be sold on the black market, more than likely to different customers who may each resell it several more times, he adds.

The announcement by Drupal fits into a larger trend of security challenges facing content management systems (CMS). Such systems are juicy targets for cyber criminals because they can create a more efficient way for hackers to launch automated, large-scale attacks. Earlier this month, Imperva noted in a report that websites running WordPress were attacked 24% more than sites running on all other CMS platforms combined.

"Content management systems are on the front lines, getting assaulted via brute force attacks and other hack attempts on a daily basis," says Jerome Segura, senior security researcher at Malwarebytes, in a statement. "While the problem with site compromises often revolves around poor security practices from the owners themselves, this latest case where a vulnerability in Drupal was exploited only a few hours after it was announced is very alarming."

"The best defense in this arms race is about protecting your properties in various ways that complement each other," he continues. "While patching is important, there are other methods to defend against such attacks, for example by hardening your website against SQL injections, brute force attacks, and also by deploying a Web application firewall which can detect malicious behavior and stop them before they reach your internal applications."

Drupal notes in its advisory that updating to the latest version (7.32) patches the vulnerability but does not fix an already compromised website.

"If you find that your site is already patched but you didn’t do it, that can be a symptom that the site was compromised -- some attacks have applied the patch as a way to guarantee they are the only attacker in control of the site," according to the advisory.

The Drupal security team also recommends site owners consult with their hosting provider. If they did not patch Drupal or otherwise block the SQL injection attacks within hours of the Oct. 15 announcement, site owners should restore their site to a backup from before that date.

Many people simply don't realize their website is a very attractive target for hackers, says Kolochenko.

"Obviously, hackers don't aim to hack their particular website, they just need to hack as many as they can to steal visitor's traffic and to infect visitors with malware that turns their PCs into bots to perform DDoS attacks or send spam," he says. 

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
11/3/2014 | 2:19:08 PM
No Surprises Here - Time to Change the Game
The cyber criminal toolkts are getting more flexible and advanced, as are the scripting skills in languages like Python, thus making the jump from published exploit to application of it much faster.  As quickly as the vulnerability is released and the site compromised, it is pushed to anonymous sales boards and admin/root accounts are sold/resold.  The surprises here are actually that 1) more ownership for secure coding/testing/end-user fixes isn't applied to projects like Drupal and other CMS, let alone FOSS (free and open source software) in general, and 2) that the international community isn't applying more pressure to cyber criminals by thoroughly destroying the infrastructure that allows such blackmarket shops to easily pop up and profit from these crimes.

Go to Packet Storm Security and drop in Drupal or WordPress.  Every exploit database out there is full of examples of the myriad ways in which vulnerabilities in LAMP (Linux Apache MySQL PHP) and variations on that platform can be exploited.  Proprietary software isn't necessarily more secure, but what makes code more secure is accountability.  Here I go again with an incredibly unpopular viewpoint, but if the Internet was better regulated, there would be standards and audits applied to code released to the Internet that could help (not solve) maintain a more secure code base for applications that can cause serious damage when compromised.  These activities are threats to our National security, make no mistake, and the buyers in these underground markets could have more in mind than simply obtaining a springboard to tag other sites, or steal a few hundred dollars in digital goods. 

This is just another vulnerability, but a good example of how cyber criminals are improving their "time to blackmarket" with our stolen digital goods.  The question is, whose buying these goods and how long before their intentions move from theft to acts of terror?   
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
10/31/2014 | 5:38:01 PM
That was fast....
I find it amazing the speed at which criminals can operate today, truly astounding.  Did Drupal release any information to customers so they can detect backdoors on their systems?
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .