Slashdot Mirror
'Drupalgeddon2' Touches Off Arms Race To Mass-Exploit Powerful Web Servers (arstechnica.com)
Researchers with Netlab 360 warn that attackers are mass-exploiting "Drupalgeddon2," the name of an extremely critical vulnerability Drupal maintainers patched in late March. The exploit allows them to take control of powerful website servers. Ars Technica reports: Formally indexed as CVE- 2018-7600, Drupalgeddon2 makes it easy for anyone on the Internet to take complete control of vulnerable servers simply by accessing a URL and injecting publicly available exploit code. Exploits allow attackers to run code of their choice without having to have an account of any type on a vulnerable website. The remote-code vulnerability harkens back to a 2014 Drupal vulnerability that also made it easy to commandeer vulnerable servers.
Drupalgeddon2 "is under active attack, and every Drupal site behind our network is being probed constantly from multiple IP addresses," Daniel Cid, CTO and founder of security firm Sucuri, told Ars. "Anyone that has not patched is hacked already at this point. Since the first public exploit was released, we are seeing this arms race between the criminals as they all try to hack as many sites as they can." China-based Netlab 360, meanwhile, said at least three competing attack groups are exploiting the vulnerability. The most active group, Netlab 360 researchers said in a blog post published Friday, is using it to install multiple malicious payloads, including cryptocurrency miners and software for performing distributed denial-of-service attacks on other domains. The group, dubbed Muhstik after a keyword that pops up in its code, relies on 11 separate command-and-control domains and IP addresses, presumably for redundancy in the event one gets taken down.
Drupalgeddon2 "is under active attack, and every Drupal site behind our network is being probed constantly from multiple IP addresses," Daniel Cid, CTO and founder of security firm Sucuri, told Ars. "Anyone that has not patched is hacked already at this point. Since the first public exploit was released, we are seeing this arms race between the criminals as they all try to hack as many sites as they can." China-based Netlab 360, meanwhile, said at least three competing attack groups are exploiting the vulnerability. The most active group, Netlab 360 researchers said in a blog post published Friday, is using it to install multiple malicious payloads, including cryptocurrency miners and software for performing distributed denial-of-service attacks on other domains. The group, dubbed Muhstik after a keyword that pops up in its code, relies on 11 separate command-and-control domains and IP addresses, presumably for redundancy in the event one gets taken down.
Noice... TFA links back to the 2014 security advisory and completely misses a link to the current 2018 security advisory.
Developers don't get $200 an hour. The firms that employ them get $200+ an hour.
The work gets farmed out to India, Eastern Europe or South America at a rate of around $25 an hour. Developers in Europe or North America get salaries that work out to between $50 and $75 an hour.
The drupalgeddon patches are not hard to apply and push to production. I know because I patched the 16 Drupal sites my organization manages, which isn't even my job, I'm a sysadmin.
The 3 agencies we work with were no help patching the sites. The lowest estimate we received was for 40 hours and it would take 2 weeks from the day the patch came out to complete the work. We could not get them to just apply the patch, we had to buy a sprint.
Which meant the sites would have already been compromised and our servers probably would have been trashed. This was funny because our agency partners are the people who alerted us about the need to immediately patch our code.
This isn't the first time we got a red alert about a vulnerability on short notice and were handed a huge bill to apply a patch. We got a budget last week to migrate the sites to other platforms and already know 10 of them are moving to Wordpress.
The big difference between Wordpress and Drupal is my boss isn't putting her job at risk for choosing Wordpress.
It's not really a Linux issue, it's a PHP / Drupal issue.
PHP is as it's designed a potential security risk and any code written is "dirty" since it's hard to validate and is a mix of code, HTML and Javascript. So even a slight error in coding in PHP can lead to "interesting" side effects.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.