News for hackers. Stuff that matters.

A comment on One of my Drupal sites was hacked. Parent comment

Re:One of my Drupal sites was hacked by danepowell on Wednesday April 30, 2014 @08:37AM (#7672842)
I've been building Drupal sites for 6 years, and I've never had a single one get hacked, even after I stopped updating them. It's far more likely that FTP with a weak password was the attack vector.
[ Parent | on HN ]
Re:One of my Drupal sites was hacked by spoiler on Wednesday April 30, 2014 @10:33AM (#7673544)
Not sure about Drupal, but Joomla gets targeted all the time. I don't think FTP is the attack vector. Yes, it's possible the password leaked, but it's more likely a bug in Drupal was exploited.

Disclaimer: I work at a hosting company, and this is my personal experience with hacked websites.

[ Parent | on HN ]
Re:One of my Drupal sites was hacked by jauer on Wednesday April 30, 2014 @12:00PM (#7674193)
On Joomla I've seen exploits via the site search feature and the admin login (I too work at a company that does hosting). I haven't seen Drupal sites get taken out.
[ Parent | on HN ]
Re:One of my Drupal sites was hacked by cholmon on Wednesday April 30, 2014 @12:01PM (#7674200)
It's also likely that the vector was a vulnerable module he had installed.
[ Parent | on HN ]