What are common methods of intrusion into a Drupal website?

Question

I am running Drupal 6.28 that was recently hacked and there were scripts being executed out of the /tmp directory, apparently running a bitcoin mining server and other brute force scripts.

I would get random processes sometimes 2-4 at a time that would each consume over 100% cpu(core) for an indefinite period of time. Which would make sense if they were running some type of bitcoin mining operation or brute force attack.

To the best of my knowledge the attacker uploaded a file named 32.tar.gz to the site. Drupal moved this file to the /tmp directory, then attacker extracted into the same /tmp directory, which has 777 permissions.

I would gladly change the permissions on this folder to something more sane like 755, but in doing so, Drupal stops functioning properly.

All files/folders in my drupal install directory are owned like: myUser:www-data, where www-data is the user that PHP/Apache is running as.

The /tmp folder is owned by the same user and group, so I would think that it would be writable at 755, but that just isn't the case for some reason. Is there a way to harden the security of the site that would prevent this from happening?

Answer 1

The first question is how they are uploading and extracting the file. That is likely only possible via a vulnerable contributed module (probably an out of date one) or because they have credentials to your server (either at the drupal layer or the server - ie ssh or sftp layer).

The second question is why your tmp directory is in a publicly accessible location (is it?). If it's not then it seems more likely the problem is arbitrary code execution or credentials compromised.

Solutions: basically you have to "start over."

• Audit every single account and permission
• Audit every single file of code - download fresh copies from drupal.org and ensure the versions on your site match them exactly.
• Install the security review and paranoia modules and read their documentation to ensure they are working properly. They will help audit your permissions and content.