News for hackers. Stuff that matters.

A comment on Drupal Core – Highly Critical Public Service announcement. Parent comment

Re:Drupal Core – Highly Critical Public Service announcement by peterevans on Wednesday October 29, 2014 @04:26PM (#8529684)
Drupal is saying that people were being compromised only hours after the details were known. That's a very short window to update software. In this instance, I'm not really sure what anyone could have done to avoid the potential for compromise. Your install is practically DOA by the time you will learn of the news.
[ Parent | on HN ]
Re:Drupal Core – Highly Critical Public Service announcement by daviddede on Wednesday October 29, 2014 @04:38PM (#8529763)
That's exactly the issue. Most enterprises didn't even have time to be notified and properly test/push a patch live before the attacks were already in the wild.
[ Parent | on HN ]
Re:Drupal Core – Highly Critical Public Service announcement by Mandatum on Wednesday October 29, 2014 @05:24PM (#8530076)
It's like Exploit Wednesday for Windows, except Drupal is a lot easier to reverse and find where the security issues lie given it's open-source.. So instead of taking a day to reverse/find holes, it takes a matter of minutes.
[ Parent | on HN ]
Re:Drupal Core – Highly Critical Public Service announcement by TacticalMalice on Wednesday October 29, 2014 @05:32PM (#8530118)
In addition, the issue was leaked pre-announcement among a great many parties who had time to prepare.
[ Parent | on HN ]
Re:Drupal Core – Highly Critical Public Service announcement by Mandatum on Sunday November 02, 2014 @10:07PM (#8549174)
Do you have more detail on that? I'd hazard a guess at irresponsible disclosure, or an internal Drupal employee leak.
[ Parent | on HN ]
Re:Drupal Core – Highly Critical Public Service announcement by r0s on Wednesday October 29, 2014 @11:15PM (#8531148)
Then you fall back on backups. These are all very old admin problems.
[ Parent | on HN ]