1

Case:

- Aegir server 2.1 on Drupal 6.31
-- Platform Hostmaster: Drupal 6.31
--- Hostmaster: ?
-- Platform 1: Drupal 7.31
--- Site 1: HACKED
--- Site 2: HACKED
-- Platform 2: Drupal 7.32
--- Site 3: ?
--- Site 4: ?

Actions:

  • So the attackers get access on site 1 + site 2 using the SA-CORE-2014-005.
  • Platforms 1 and sites 1 and site 2 totally deleted or restored from an old backup and then updated (files and db).

Questions:

  1. Is there a case that the hackers gain access on Hostmaster or on sites 3 and site 4?

  2. Or even worst… the hackers gain that level of access on the server that can compromise a new Aegir install?

Improve this question
5
  • 1
    Aegir sandboxes sites within user accounts, so theoretically no to both. You'll want to actually check users/permissions manually to be sure, of course
    – Clive ♦
    Oct 31, 2014 at 10:49
  • Thanks @Clive, it's a theoretical scenario and even on a non hacked server I've test the db, pull the files from the repository and check the md5 of the server's file. But it's always good having a valid second opinion.
    – tvl
    Oct 31, 2014 at 11:27
  • 1
    What kind of impact did the attackers have on the sites? Were they able to run a persistent rootkit? Did they inject PHP in blocks/nodes? (was the PHP module enabled?) If you're running plain Aegir, it's possible to escalate privileges by injecting PHP in a site database, then getting that code to be run during cron. If cron is run as the Aegir user (using drush, instead of the web cron which is slower but more secure), they could then read config files to the hostmaster, write to files, etc.
    – bgm
    Oct 31, 2014 at 13:22
  • @bgm Thanks for the hints! There was no actual attack (at least I can't find any traces) but I want to be sure that I check everything. The cron runs as aegir user, so I have to change that to improve the security.
    – tvl
    Oct 31, 2014 at 13:31
  • 1
    @tvl: Can you use Drush within Aegir? If so, I'd run Drush, install the site_audit and drupalgeddon Drush extensions and run "rush asec" in the root directories just in case. I did that today and found that several accounts had been affected, some were development sites that were offline (maintenance mode) and not accessible via a domain name but they were still affected and... They had been patched shortly after receiving the update notifications. I've never seen anything like it.
    – Andrew Wasson
    Nov 1, 2014 at 4:31

1 Answer 1

Reset to default
1
  1. If site 1 and 2 are compromised, it's entirely possible that sites 3 and 4 are either in danger of being compromised or have already been compromised.
  2. More or less, yes. If they already have sites 1 and 2, it's extremely likely that they can directly access your server.

You should consider your current server and the sites running on it as tainted and rebuild from scratch. Despite @Clive's assertion, there is no user account sandboxing happening at the per-site level.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.