'Drupalgeddon2' Touches Off Arms Race To Mass-Exploit Powerful Web Servers (arstechnica.com) 60
Researchers with Netlab 360 warn that attackers are mass-exploiting "Drupalgeddon2," the name of an extremely critical vulnerability Drupal maintainers patched in late March. The exploit allows them to take control of powerful website servers. Ars Technica reports: Formally indexed as CVE- 2018-7600, Drupalgeddon2 makes it easy for anyone on the Internet to take complete control of vulnerable servers simply by accessing a URL and injecting publicly available exploit code. Exploits allow attackers to run code of their choice without having to have an account of any type on a vulnerable website. The remote-code vulnerability harkens back to a 2014 Drupal vulnerability that also made it easy to commandeer vulnerable servers.
Drupalgeddon2 "is under active attack, and every Drupal site behind our network is being probed constantly from multiple IP addresses," Daniel Cid, CTO and founder of security firm Sucuri, told Ars. "Anyone that has not patched is hacked already at this point. Since the first public exploit was released, we are seeing this arms race between the criminals as they all try to hack as many sites as they can." China-based Netlab 360, meanwhile, said at least three competing attack groups are exploiting the vulnerability. The most active group, Netlab 360 researchers said in a blog post published Friday, is using it to install multiple malicious payloads, including cryptocurrency miners and software for performing distributed denial-of-service attacks on other domains. The group, dubbed Muhstik after a keyword that pops up in its code, relies on 11 separate command-and-control domains and IP addresses, presumably for redundancy in the event one gets taken down.
Drupalgeddon2 "is under active attack, and every Drupal site behind our network is being probed constantly from multiple IP addresses," Daniel Cid, CTO and founder of security firm Sucuri, told Ars. "Anyone that has not patched is hacked already at this point. Since the first public exploit was released, we are seeing this arms race between the criminals as they all try to hack as many sites as they can." China-based Netlab 360, meanwhile, said at least three competing attack groups are exploiting the vulnerability. The most active group, Netlab 360 researchers said in a blog post published Friday, is using it to install multiple malicious payloads, including cryptocurrency miners and software for performing distributed denial-of-service attacks on other domains. The group, dubbed Muhstik after a keyword that pops up in its code, relies on 11 separate command-and-control domains and IP addresses, presumably for redundancy in the event one gets taken down.
Powerful servers (Score:5, Funny)
The exploit allows them to take control of powerful website servers
Powerful indeed, since you need huge resources to run Drupal decently.
Re: (Score:1)
Re: Powerful servers (Score:1)
The intelligent people left this site long ago.
Drupal Consultants (Score:2, Interesting)
Big part of the reason there are so many un-patched Drupal sites is the cost of Drupal consultants. Hourly rates in the $200+ range are a big risk vector to consider for small to medium sized sites.
Re: Drupal Consultants (Score:4, Interesting)
I was running drupal and got hit by a monero miner so I scrapped Drupal and php.
I see this problem as something rooted in php.
I did a small analysis of what had happened and the exploit created a miner executable file in /tmp that was then moved to /dev/shm and executed there by some action. It had been active for just a few hours as a non-privileged process, so no big deal.
Re: (Score:1)
The blame is shared between PHP and the Drupal team. Here's an explanation of the vulnerability:
If you do a POST request to https://example.com/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax, the PHP function uploadAjaxCallback gets called with its $request parameter containing the request including all the URL and POST parameters. The following line splits the element_parents URL parameter:
$form_parents = explode('/', $request->query->get('element_
Re: (Score:2, Informative)
Developers don't get $200 an hour. The firms that employ them get $200+ an hour.
The work gets farmed out to India, Eastern Europe or South America at a rate of around $25 an hour. Developers in Europe or North America get salaries that work out to between $50 and $75 an hour.
The drupalgeddon patches are not hard to apply and push to production. I know because I patched the 16 Drupal sites my organization manages, which isn't even my job, I'm a sysadmin.
The 3 agencies we work with were no help patching the s
Re: (Score:1)
Being a sysadmin it's your job to patch the systems to catch security issues.
Greed is stupid (Score:5, Insightful)
Sensible people would briefly use the servers to install a lightweight, hard-to-find bitcoin miner that stayed out of the way until the victim's computer was doing nothing, but still had an internet connection. Don't get greedy. Don't thrash the hard drive or run the graphics card 'til it melts. Just take a little sip here and a little sip there, and rely on having a lot of places to go for that little sip.
I bet something like that could stay under the radar for a long, long time.
Re: (Score:3)
That's what I've been doing. I got scripts all over the planet mining Bitcoins since 1988.
Re: (Score:2)
It's not possible to hide if the server admin runs tools like 'rkhunter'. That's how I saw that my server was impacted.
And in my case it was a monero miner. I did dig through the stuff in the server and found out the hashed ID of the culprit as well and mailed the monero support with that ID. Haven't heard anything about it but if they cancel the mined stuff without notifying anyone then I'm good with that too.
Re: (Score:2)
Anything that would annoy the illegal miner is fine by me.
Re: (Score:2)
It's not possible to hide if the server admin runs tools like 'rkhunter'.
I've not heard of rkhunter before, but from how it works I can think of a few ways to hide. It doesn't appear to scan the contents of kernel memory, so if you're able to inject running code into the kernel and masquerade as a low-priority kernel thread then it won't be noticed. It also isn't able to scan into SGX enclaves, or into any of the (now compromised) trusted firmware on AMD systems, the latter of which gives you a good way of persisting your malware across reboots.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
On the plus side, it would be re
Re: (Score:2)
I believe rkhunter made an appearance in Mr. Robot.
Re: (Score:2)
I've noticed on some Linux PC's that using lsmod will provide a list of modules and how many modules plus their names are depending on it. But in some cases the "Intel" module has about 5 other modules using, but they aren't listed.
Re: (Score:2)
Thanks for that. If possible, I'd give you points for "Informative".
Re: Greed is stupid (Score:2)
Re: (Score:2)
Re:Windows or Linux servers? (Score:4, Informative)
It's not really a Linux issue, it's a PHP / Drupal issue.
PHP is as it's designed a potential security risk and any code written is "dirty" since it's hard to validate and is a mix of code, HTML and Javascript. So even a slight error in coding in PHP can lead to "interesting" side effects.
Probed constantly (Score:5, Interesting)
Re: (Score:2)
I don't run Drupal but in a six hour period Saturday morning even my little website was hit on from 147 different IP addresses, each using 4 or 5 requests in rapid succession. Made my logs hard to read.
If they're hitting the same URL, just make sure the URL refers to a 2TB random file.
Or you could start whitelisting/blacklisting or banning IP's trying to access resources that shouldn't be accessed.
Re: (Score:2)
Re: (Score:2)
What do these probes look like in the logs?
Re: (Score:2)
"GET / HTTP/1.1" 301 226 "-"
"POST
"POST
"GET / HTTP/1.1" 301 226 "-"
"GET / HTTP/1.1" 301 226 "-"
"GET
"GET
Code of Conduct (Score:1)
That's ok, Drupal's code of conduct specifically bans malicious hacking because it isn't nice. That, and any form of kink that doesn't have a parade and could be inconvenient for Dries's IPO.
God bless the Drupal CoC.
Drupal is awful (Score:1)
It's worse than Wordpress. That's saying something.
These garbage cms's that have an established base of "developers" with a lot of sunk costs becoming "experts" need to die. Maybe a good, easy to use cms will come along but it won't be Drupal or Wordpress.
Re: (Score:1)
Concrete5, Statamic, and Pagekit. ExpressionEngine and maybe Joomla except for the ease of use condition...
Great source article (Score:5, Informative)
why does anyone use it anymore? (Score:2)
Re: (Score:2)
Drupal is WP in worse and without the userbase. (Score:5, Interesting)
Disclaimer: I've used and developed for both Drupal and WP professionally, for a living. A good living.
Like most PHP systems Drupal is built by monkeys on crack with zero clue about proper software architecture. Unlike WordPress though it doesn't have a 140 million+ installbase and an army of people messing around with it every day and patching holes as they pop up just about instantly. This is a problem. Add to that the fact that while both WP and Drupal are built by people who didn't know squat what they were doing when they started out, WP actually makes it somewhat easy to code around it's mess, just using a few utility functions from WP core to latch on to the DB and the user management and stearing clear of the rest of the mess, getting to doing real work roughly 10 minutes in to your first WP plugin.
Drupal OTOH is a mess through and through *and* forces you to follow along, making development much more difficult. Which is why the installbase is 'only' a few million which AFAICT isn't enough to compensate for crappy webapps built by n00bs in PHP. I expect Drupal holes like this one to be much more of a problem vis-a-vis WPs holes, simply because the userbase is orders of magnitude smaller than of WP.
My 2 cents.