One of my Drupal sites was hacked

Re:One of my Drupal sites was hacked by juanrossi on Wednesday April 30, 2014 @08:38AM (#7672846)

I used to work for a web hosting company and we saw this kind of attacks ALL the time.

Most of the cases was because of old CMS versions, but in same others the computer uploading the files was infected and the FTP credentials were stolen (Change your user/password and analyze ftp logs).

I would also check the database and do a clean install of the CMS.

The server could be compromised but I don't think this is the case.

[ Parent | on HN ]

Re:One of my Drupal sites was hacked by themodelplumber on Wednesday April 30, 2014 @05:11PM (#7676474)

Best answer I've seen so far. The takeaway from the guys on the front lines is usually that a full server compromise is rare and that FTP creds were stolen from a client via malware. The result is a simple drive-by that is relatively easy to clean up.

[ Parent | on HN ]