Hacker News Reader

daviddedeon Up to 12M websites may have been compromised via Drupal vulnerability

We have a few samples of the SQL injection attempts here:

http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts...

In there you can see the type of backdoors being added (generally fake users with admin-level privileges).

daviddedeon Up to 12M websites may have been compromised via Drupal vulnerability

And that was at the same time that everyone was worried about POODLE and the media was going crazy over it.

Somehow this vulnerability went over the radar.

What is interesting is that based on our own data, we started noticing attacks around 8 hours after it was disclosed and we shared some of the payloads being used here:

http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts...

daviddedeon Drupal Core – Highly Critical Public Service announcement

Virtual patching is the main benefit on WAFs for cases like this.

We were able to issue a virtual patching signature for our clients in less than 2 hrs after the disclosure.

Plus, our generic SQL injection signatures were already blocking this attack even without it.

That gives our clients more time to test and deploy patches without worrying about being compromised in the middle.

daviddedeon Drupal Core – Highly Critical Public Service announcement

That's exactly the issue. Most enterprises didn't even have time to be notified and properly test/push a patch live before the attacks were already in the wild.

daviddedeon Drupal Core – Highly Critical Public Service announcement

You have a good point, but I was looking at these two points:

1- Extent of the damage

2- Number of points vulnerable

Heartbleed had (has) a lot more servers vulnerable, but the impact is a lot lower and it is a lot harder to exploit to extract valuable data. In fact, I doubt you will see a compromise or a major issue because of heartbleed (despite the mass drama).

Compared to this problem with Drupal, that is used by the many of the top sites online, the overall damage can be a lot bigger.

Time will tell.

daviddedeon Drupal Core – Highly Critical Public Service announcement

It depends on the complexity of the attack. This Drupal one took our team less than an hour to have a working proof of concept (just based on the diffs).

The exploit is very simple, and doesn't require any interaction with the remote site. Explaining why they started on it very fast.

On other more complex exploits, we generally see days (if not weeks), before the attacks start.

daviddedeon Drupal Core – Highly Critical Public Service announcement

That's as big as it can be. We started seeing attacks hours after the initial disclosure and shared some of them here:

http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts...

This is a lot worse than Heartbleed, Poodle and others. Full database / server take over for 700,000+ sites that use Drupal.

daviddedeon Everything you need to know about the Shellshock Bash bug

That's very similar to what we are seeing as well:

http://blog.sucuri.net/2014/09/bash-shellshocker-attacks-inc...

Also, if anyone need a WAF to protect it in the mean while, we offer one that works very well with CloudFlare (their free plan).

Our team is giving is free for 30 days to help out.

Details: https://sucuri.net/website-firewall/

*Just email info@sucuri.net and they will get you hooked up.

thanks,

daviddedeon Another ShellShock exploit in the wild

That's just the start. Once people start hitting cpanel servers:

http://blog.sucuri.net/2014/09/bash-vulnerability-shell-shoc...

daviddedeon Bash 'shellshock' bug is wormable

It absolutely is. Specially now with thousands of cPanel servers known to be vulnerable:

http://blog.sucuri.net/2014/09/bash-vulnerability-shell-shoc...

daviddedeon ShellShock exploited in the wild: kernel exploit with CnC component

cPanel servers vulnerable as well:

http://blog.sucuri.net/2014/09/bash-vulnerability-shell-shoc...

daviddedeon JQuery hacked

Do you have a screenshot by chance?

daviddedeon Ask HN: Who is hiring? (August 2014)

We have quite a few openings (all remote):

-Senior PHP developer: http://sucuri.net/company/senior-php-developer-ops-022514

-Frontend designer/developer: http://sucuri.net/company/senior-frontend-developer-022516

-Junior Support Analyst: https://sucuri.net/company/employment/junior-security-suppor...

-Security Analyst: https://sucuri.net/company/employment/security-analyst-08231...

-Sys admin: https://sucuri.net/company/system-administrator-022517

We’re small company (35+), with a very culturally diverse configuration across all our teams. We have team members distributed around the world – from the US, Canada to Malaysia, Russia, Brazil and Colombia.

daviddedeon Fail2ban security update

Not new:

http://dcid.me/texts/attacking-log-analysis-tools.html

It had a similar vuln many years ago.

daviddedeon Salesforce.com Acquires Startup RelateIQ

Yep, same here. I hate when products (companies) I use get acquired. It always come with not-welcoming product changes.

Hope it doesn't happen to them.

daviddedeon Ask HN: Which paid apps and services do you use?

Top of my list: Linode, Digital Ocean, Sucuri, CloudProxy, Balsamiq and Amazon Ec2.

daviddedeon Ask HN: Who is hiring? (March 2014)

Sucuri, Inc - Remote

Our company is fully remote and we have people working from all sort of places: USA, Canada, Brazil, Spain, Romania, etc.

Right now we have 3 positions open:

-Senior PHP Developer -Senior FrontEnd Developer -Product UI/UX Designer

http://sucuri.net/company/employment

If interested, you can email jobs@sucuri.net for more details.

thanks,

daviddedeon The decay and fall of guest blogging for SEO

I know one: http://sucuri.net

Focused exactly on what you mentioned (web site recovery, monitoring and protection).

*I work there :)

daviddedeon Ask HN: Who is hiring? (January 2014)

Remote, Anywhere

Sucuri, INC: http://sucuri.net

Senior FrontEnd Developer

Sucuri is looking for a Senior Frontend Developer to join our R&D (Research and Development) team. As a senior frontend develper you would be responsible to build dynamic, responsive and beautiful HTML/Javascript/CSS code to be integrated into our web application products. More details here: http://sucuri.net/company/senior-frontend-developer-022516

daviddedeon Ask HN: Who is hiring? (January 2014)

Remote, Anywhere

Sucuri, INC: http://sucuri.net System Administrator

Sucuri is looking for a System Administrator with strong Linux and shell scripting experience to join our IT team. As a system administrator with Sucuri, you would be responsible for building and maintaining our entire stack. This includes all servers and applications used by the team. You would also be responsible for the security of the servers, including log monitoring to ensure their integrity and performance. We place a strong emphasis on security, so you should too. In case of emergencies, you should be available as well.

More details here: http://sucuri.net/company/system-administrator-022517

daviddedeon Ask HN: Who is hiring? (January 2014)

Remote, Anywhere

Sucuri, INC: http://sucuri.net

Senior PHP Developer: http://sucuri.net/company/senior-php-developer-ops-022514

Sucuri is looking for a Senior PHP Developer with shell scripting and Linux experience to join our R&D (Research and Development) team. You need to be able to write clean and secure PHP code and also push it live to servers on a continuous base. As a senior developer you would also be responsible for code reviews and guiding more junior developers on their work. More details here: http://sucuri.net/company/senior-php-developer-ops-022514

thanks!

daviddedeon Open Source Backdoor – Copyrighted Under GNU GPL

It was found in the wild.

daviddedeon OpenX.org compromised and downloads injected with a backdoor

The .js file is actually included in one of their templates (using include()). So the <?php code is executed at that point.

daviddedeon OpenX.org compromised and downloads injected with a backdoor

+1. Most of the compromises we find is due to old/test/never used/demo/debug tools that were once installed and forgotten.

daviddedeon You shouldn't hotlink someone else's JavaScript

This has being going on for a few months with other sites:

http://blog.sucuri.net/2013/05/who-really-owns-your-website-...

thanks,

daviddedeon Malware Hidden Inside JPG EXIF Headers

I think you are over thinking a bit. We do many blog posts per month sharing what we find in the "wild". If you go to the blog, you will see the amount we have.

This is just another one that our team found interesting enough to share.

daviddedeon The paranoid #! Security Guide

Why people still recommend chkrootkit? It is an old tool that havent't been updated in a long while and wont find any new linux rootkits/malware.