{"id":367,"date":"2018-04-26T16:53:52","date_gmt":"2018-04-26T11:23:52","guid":{"rendered":"https:\/\/www.nocturnalknight.com\/?p=367"},"modified":"2018-04-26T16:53:52","modified_gmt":"2018-04-26T11:23:52","slug":"sa-core-2018-002-and-how-acquia-mitigated-500000-attacks-on-drupal","status":"publish","type":"post","link":"https:\/\/nocturnalknight.com\/?p=367","title":{"rendered":"What is SA-Core-2018-002 and How Acquia Mitigated 500000 attacks on Drupal"},"content":{"rendered":"

Disclaimer: I have been working on WCMS and specifically with Acquia\/Drupal for more than seven\u00a0years. And in that period, I have developed a Love\/hate relationship with Drupal. Love for Drupal 6 and hate for 7. Or something like that. So my views may be slightly unneutral.<\/em>
\n 
\nOn March 28th, the Drupal Security Team released a bug fix for a critical security vulnerability, named\u00a0SA-CORE-2018-002<\/a>. Over the next week, various exploits have been identified, as attackers have attempted to compromise unpatched Drupal sites. Hackers continue to try to exploit this vulnerability, and Acquia’s own security team has observed more than 100,000 attacks a day.
\n

\"\"<\/a>
Timeline of SA-CORE-2018-002<\/figcaption><\/figure>
\nThe Remote code execution<\/a> exploit or the so-called\u00a0SA-CORE-2018-002 was a vulnerability that had been present on various layers of Drupal 7 and 8. And Drupal being Drupal,\u00a0 had one of the most efficient governance among Open Source projects around<\/strong>. This I can say with confidence and pride as I have had more than a few interactions with the community, notifying issues, committing\u00a0documentation, in feature roadmap discussions (Agreed, some of them are heated!) and submitting patch\/fixes. Drupal community has very high standards and even though your patch or fix has functionally addressed the underlying issue, it may be declined. That said, it’s also one of the democratic community software you can get. Still, They insist on following the stringent and high community standards for the modules or themes.
\nSo, it is no surprise that Drupal today has one of the most Responsible Disclosure policy. <\/strong>
\nDrupal community had previously notified all the developers in official channels and had asked to prepare a high impact patch. Meanwhile, Acquia did the same for its SMEs and Enterprise clients as well. Those in the deep of it knew a bit early on the nature of exploit and mitigation strategy.
\nAnd in the community forums, there were detailed descriptions of planning this infrastructure patch up and how to plan for uptime, isolation post disclosure, patching, updation and redeployment.
\nMultiple methods to suit multiple needs of the environment, architecture etc has also begun to appear. It was one giant machinery, albeit\u00a0a self-governing one in it. I have known large organisations do a hodge-podge patchwork and contain the underlying vulnerability. Leaving a vendetta-driven Ex-Employee or a determined Hacker to expose the inner workings of the exploit. It had resulted in many multi-million dollar loss. Only after the #Apache project had reached a state of maturity, did these larger organisations learnt the art of disclosure. but, how many of them were practising it is a big question.
\nTill 28th March 2018, there were no (publically) known exploit for the RCA in Drupal 7\/8.\u00a0<\/strong>
\nThis all changed after Checkpoint Research released a detailed step by step explanation of the security bug SA-CORE-2018-02 and how it can be exploited. In less than 6 hours after\u00a0Checkpoint Research’s blog post<\/a>, Vitalii Rudnykh, a Russian security researcher, shared a proof-of-concept exploit on GitHub.
\nThe article by Checkpoint Research and Rudnykh’s proof-of-concept code have spawned numerous exploits, which are written in different programming languages such as Ruby, Bash, Python and more. As a result, the number of attacks has grown significantly after that.
\nThe scale and the severity of this attack suggest that if you failed to upgrade your Drupal sites, or your site is not supported by Acquia Cloud or another trusted vendor that provides platform level fixes, the chances of your site being hacked are very high. If you haven’t upgraded your site yet and you are not on a protected platform then assume your site is compromised. Rebuild your host, reinstall Drupal from a backup taken before the vulnerability was announced and upgrade before putting the site back online.
\n
\"\"<\/a>
Geographic distribution of SA-CORE Attack Vectors<\/figcaption><\/figure><\/p>\n

Solution:<\/h4>\n
\n
\nUpgrade to the most recent version of Drupal 7 or 8 core.<\/p>\n