Hacker News Reader

Comment by jareds | Hacker News Reader

I have started to use Drupal to create a small site for a non-profit. I disabled the site a couple of days after this vulnerability. Is there a way to determine if I have been compromised or since I have put about 30 minutes of work into it so far am I better off rebuilding from scratch?

View on HN

Small sites may not have been hit if you turned it off soon enough. Quick tips:

* Look through the menu_router table for suspicious looking entries. * Look at users & user roles, anything new? * Look for scripts and executibles in your public and private upload files directory.

If you really don't know drupal and it's a new project, start from scratch (New Database but you're code should be safe assuming your repo isn't stored on the same server and there's no write to repo access on server)

Yes, there is: http://drupal.geek.nz/

For peace of mind I'd rebuild from scratch in your circumstances.

Go into your Drupal updates and see if the core says 7.32 if it does you are good. If it doesn't just update it using drush and carry on.

No: that's not good advice. The OP said "I disabled the site a couple of days after this vulnerability", but we know that there were attacks in the wild within hours of disclosure. If it's only 30 minutes work you might as well start over.

This isn't the "correct" answer - because a backdoor may have been dropped which you wouldn't notice with this method.

Also, apparently some sites were found, or it's at least feasible, that someone got control/access of the site and applied the patch themselves to keep others from doing the same. Like a burglar locking the door behind themselves.

Reply on news.ycombinator.com