Slashdot Mirror
Hundreds of Drupal Sites Targeted With Fake Ransomware (softpedia.com)
An anonymous reader writes: A group of hackers have created a ransomware strain that specifically targets Drupal sites. Infection occurs thanks to an automated bot which scans Drupal sites and then uses an SQL injection (CVE-2014-3704) to change the site admin's password. The bot also dumps any emails it finds on the server, and then overwrites the site's main page to show a typical ransomware note.
Over 400 sites have been infected until now, but nobody has paid the ransom yet.
This case yet again proves why "Web ransomware" will never work because even the worst Web hosting service provides automatic backups from where they could retrieve a clean version of their site.
This case yet again proves why "Web ransomware" will never work because even the worst Web hosting service provides automatic backups from where they could retrieve a clean version of their site.
Even the worst hosts provide backups? I see you are new to this whole hosting thing. Oh, and to how "normal" users behave.
Back when I used to develop sites in Drupal (which was a few years ago), all SQL queries were parameterized, as opposed to passing variable data as part of the query string. I thought this was supposed to protect you from SQL injection attacks. Am I missing something, or are they attacking very, very old Drupal installations?
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
The backups may not even be necessary. Just as the attacker changes the password, unless something has changed with Drupal you can also quite easily change the password simply by hashing a new one. Fixing what damage they've done to the site itself is a little work, but it's not like this would make it unrecoverable.
If backups are made every Saturday at 5pm, infect site at 4:49pm
That said if my site was infected and ransom was cheap and fast, I would pay for convenience. Even if I had offsite backup.
"even the worst Web hosting service provides automatic backups from where they could retrieve a clean version of their site."
I'd imagine the backups they keep are only for a couple weeks. Time delay the obvious symptoms (ransomeware prompts) for a few weeks. Backups won't do much good then. You're welcome.
Drupal and WordPress are horrible! Why can't someone make one that is easy to modify, doesn't take a year to learn, made in a real language like Erlang, and can be updated without being root automatically?
Is that really so hard. Shit we should make another one? It can't be all that hard?
http://saveie6.com/
not trying to be too petty here, but really, does a problem affecting "hundreds" of web sites in the world really matter that much? That's like a percent of a percent isn't it?
And how does anyone (other than the malware author author) know that nobody has paid them yet?
Final note... "will never work".... they wouldn't be doing it if it wasn't making them any money. (not for long anyway, and not more than once) We wouldn't see 99% of the hackery on the internet that we do today (spam, ransomware, phishing, advertisement, scareware, viruses/worms) if they handn't found a way to cash in on their efforts.
I work for the Department of Redundancy Department.
"even the worst Web hosting service provides automatic backups from where they could retrieve a clean version of their site.", sorry, but there are so many newbie developers building sites and cheap business owners that they don't enable backups or aren't willing to pay for it. There are plenty of sites with no backup!
It's open sores and this never happens with open sores softwares! But maybe the cause is the fact that it's a stupid name...
"This case yet again proves why "Web ransomware" will never work because even the worst Web hosting service provides automatic backups from where they could retrieve a clean version of their site."
WTF, the writer of this post lives in a delusional bubble. Most sites don't have backup's, backups cost money. Ransomware exists because it is extremely successful, it only has to work on 1 in a hundred or 1 in a thousand to make it profitable.
Didn't you leave out the most important bit?
Further, of the perhaps 12 hosting companies we've contacted about restoring backups, most of the time the backups didn't actually work. A common scenario was that the backups stopped working several months earlier but nobody noticed until they were needed.
That type of experience, and web hosting companies that go out of business, eventually forced us to create Clonebox.
You know, you could actually use the exploit to change the sites password back, right? And if it's just the main page, even if it isn't backed up it isn't much work to rebuild (well, relatively anyway). Unless they patched it after your site got infected.
I know they use this breach for dirty business. Oh BTW, don't you mind telling me what to do. I told you before and reapeat: I hate you for the rest of my life. And since when polish cyber criminals can do whatever they want?
Ah, hey helena, você é uma filha da puta sem noção. Eu te odeio hoje, vou te odiar amanhã, você e todas as pessoas que você conhece, não passam de um monte de merda pra mim.
Eu estou a 5 meses tentanto te convencer que não adianta bancar a última bolacha do pacote. Tem 3 bilhões de mulheres no mundo, e você deixou de ser interessante a partior do momento que mostrou essa tua cara de retardada e essa familia podre.
Sounds real to me.
Lame, perhaps, but certainly real to the extent that someone is (at least temporarily) locked out of their system and has to take steps to restore it or pay the ransom.
From the fine article, it didn't bother encrypting anything so that certainly bumps it way up on the lame scale. But it's not like people received notices in their inbox demanding ransom for something that never got installed.
"even the worst Web hosting service provides automatic backups from where they could retrieve a clean version of their site."
This is so wrong it gave me brain cancer.
NESFLASH: Lots of hosts don't provide backups, automatic or otherwise. Ask me how I know.
Just cruising through this digital world at 33 1/3 rpm...
> The chance that a site will have a good backup policy is usually related to their potential for loss.
I would say that more than half of companies who sign up for our backup/warm spare service do so right AFTER a loss incident. Their web hosting company has a fire, or vanishes in the night, or they get rooterd or whatever and they realize they should have had a solid backup. They get Clonebox to make sure that kind of thing doesn't happen again.
My stats are a bit skewed because they often call us for help recovering a borked server. We point out that a solid backup would have cost a lot less than trying to recover from a really bad situation.
per the TFA "affects Drupal 7.x installations prior to version 7.32." My Drupal site is at 7.43. 7.33 was released in November 7, 2014. This exploit is actually discussed On Drupal's Security advisories page, and they admit "Multiple exploits have been reported in the wild following the release of this security advisory" lol. Then there is a PSA about it too. Not surprised no one has paid on this yet; if you haven't updated your Drupal site in two years you probably don't really care that much about it haha.
...then don't be surprised when this kind of shit happens to you.
I recommend a product called "literally anything else" as an alternative to Drupal.
I'm not a Drupal Fan - WordPress and sometimes Joomla are my goto PHP CMSes - but this isn't really that big a newspiece, considering the install base Drupal has.
It's like saying WordPress is the Bane of the Web because 8000 Websites were hacked. 8000 out of 105 000 000 (105 Million) Installations isn't really that much. I doubt any other platforms can claim measureably better security.
We suffer more in our imagination than in reality. - Seneca
Hundreds of Drupal Sites Targeted With Fake Ransomware
What's fake about it?
systemd is Roko's Basilisk.