I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off reading through this post and, apart from the Hacked module which I couldn't understand and therefore didn't try, nothing seemed to have happened. Nothing seems to be a breach, but as I read - that's the point... So generally speaking I'm preparing to rebuild the server, but in all this it will take ages as I'll have to check through all the user submitted data. How is the hack able to lead to everything possibly being vulnerable? Looking through the permissions the only things that are owned by "apache" are the "sites/default/files" files. Do I need to rebuild the server?
I updated core immediately, then used the Drupalgeddon module which found nothing (and again found nothing just now):
"Site did not test positive. Good luck! [ok]"
I checked through the live source against our development repository and I couldn't see anything obvious that was suspicous.
I used Toad for MySQL to do a comparison of my live db with a dump of the database before the 15th of October and that did not show anything that I thought might be a problem. I kept doing what I was shown (!) in terms of permissions:
Group: root; Owner: root; Octal: "0755" for
Group: root; Owner: root; Octal: "0444" for
Group: root; Owner: root; Octal: "0644" for
- all root of web directory stuff like...
- the files within the other folders off the root of the web directory
- /includes etc.
have Group: root; Owner: root; Permissions: Octal:"0755"
Which I thought (and which is why I deliberately kept it like that) made everything quite locked down in terms of file access and permissions etc.
So after all this I was struck with a similar scepticism as this article on ZDNET.
Any suggestions? Do those permissions/ ownership help to protect? Do I really need to rebuid? The latest claims are if you didn't update within 7 hours, you've been hacked. The sites are actually fairly new and atm get roughly 5000 sessions a month. Also, coincedentally, I removed user/register to prevent spam because our setup uses a bespoke arrangement for registration.