daviddede

We have a few samples of the SQL injection attempts here:

http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts...

In there you can see the type of backdoors being added (generally fake users with admin-level privileges).

And that was at the same time that everyone was worried about POODLE and the media was going crazy over it.

Somehow this vulnerability went over the radar.

What is interesting is that based on our own data, we started noticing attacks around 8 hours after it was disclosed and we shared some of the payloads being used here:

http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts...

Virtual patching is the main benefit on WAFs for cases like this.

We were able to issue a virtual patching signature for our clients in less than 2 hrs after the disclosure.

Plus, our generic SQL injection signatures were already blocking this attack even without it.

That gives our clients more time to test and deploy patches without worrying about being compromised in the middle.

That's exactly the issue. Most enterprises didn't even have time to be notified and properly test/push a patch live before the attacks were already in the wild.

You have a good point, but I was looking at these two points:

1- Extent of the damage

2- Number of points vulnerable

Heartbleed had (has) a lot more servers vulnerable, but the impact is a lot lower and it is a lot harder to exploit to extract valuable data. In fact, I doubt you will see a compromise or a major issue because of heartbleed (despite the mass drama).

Compared to this problem with Drupal, that is used by the many of the top sites online, the overall damage can be a lot bigger.

Time will tell.

It depends on the complexity of the attack. This Drupal one took our team less than an hour to have a working proof of concept (just based on the diffs).

The exploit is very simple, and doesn't require any interaction with the remote site. Explaining why they started on it very fast.

On other more complex exploits, we generally see days (if not weeks), before the attacks start.

That's as big as it can be. We started seeing attacks hours after the initial disclosure and shared some of them here:

http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts...

This is a lot worse than Heartbleed, Poodle and others. Full database / server take over for 700,000+ sites that use Drupal.

That's very similar to what we are seeing as well:

http://blog.sucuri.net/2014/09/bash-shellshocker-attacks-inc...

Also, if anyone need a WAF to protect it in the mean while, we offer one that works very well with CloudFlare (their free plan).

Our team is giving is free for 30 days to help out.

Details: https://sucuri.net/website-firewall/

*Just email [email protected] and they will get you hooked up.

thanks,

That's just the start. Once people start hitting cpanel servers:

http://blog.sucuri.net/2014/09/bash-vulnerability-shell-shoc...

It absolutely is. Specially now with thousands of cPanel servers known to be vulnerable:

http://blog.sucuri.net/2014/09/bash-vulnerability-shell-shoc...

cPanel servers vulnerable as well:

http://blog.sucuri.net/2014/09/bash-vulnerability-shell-shoc...

Do you have a screenshot by chance?

We have quite a few openings (all remote):

-Senior PHP developer: http://sucuri.net/company/senior-php-developer-ops-022514

-Frontend designer/developer: http://sucuri.net/company/senior-frontend-developer-022516

-Junior Support Analyst: https://sucuri.net/company/employment/junior-security-suppor...

-Security Analyst: https://sucuri.net/company/employment/security-analyst-08231...

-Sys admin: https://sucuri.net/company/system-administrator-022517

We’re small company (35+), with a very culturally diverse configuration across all our teams. We have team members distributed around the world – from the US, Canada to Malaysia, Russia, Brazil and Colombia.

Not new:

http://dcid.me/texts/attacking-log-analysis-tools.html

It had a similar vuln many years ago.

Yep, same here. I hate when products (companies) I use get acquired. It always come with not-welcoming product changes.

Hope it doesn't happen to them.

Top of my list: Linode, Digital Ocean, Sucuri, CloudProxy, Balsamiq and Amazon Ec2.

Sucuri, Inc - Remote

Our company is fully remote and we have people working from all sort of places: USA, Canada, Brazil, Spain, Romania, etc.

Right now we have 3 positions open:

-Senior PHP Developer -Senior FrontEnd Developer -Product UI/UX Designer

http://sucuri.net/company/employment

If interested, you can email [email protected] for more details.

thanks,

I know one: http://sucuri.net

Focused exactly on what you mentioned (web site recovery, monitoring and protection).

*I work there :)

Remote, Anywhere

Sucuri, INC: http://sucuri.net

Senior FrontEnd Developer

Sucuri is looking for a Senior Frontend Developer to join our R&D (Research and Development) team. As a senior frontend develper you would be responsible to build dynamic, responsive and beautiful HTML/Javascript/CSS code to be integrated into our web application products. More details here: http://sucuri.net/company/senior-frontend-developer-022516

Remote, Anywhere

Sucuri, INC: http://sucuri.net System Administrator

Sucuri is looking for a System Administrator with strong Linux and shell scripting experience to join our IT team. As a system administrator with Sucuri, you would be responsible for building and maintaining our entire stack. This includes all servers and applications used by the team. You would also be responsible for the security of the servers, including log monitoring to ensure their integrity and performance. We place a strong emphasis on security, so you should too. In case of emergencies, you should be available as well.

More details here: http://sucuri.net/company/system-administrator-022517

Remote, Anywhere

Sucuri, INC: http://sucuri.net

Senior PHP Developer: http://sucuri.net/company/senior-php-developer-ops-022514

Sucuri is looking for a Senior PHP Developer with shell scripting and Linux experience to join our R&D (Research and Development) team. You need to be able to write clean and secure PHP code and also push it live to servers on a continuous base. As a senior developer you would also be responsible for code reviews and guiding more junior developers on their work. More details here: http://sucuri.net/company/senior-php-developer-ops-022514

thanks!