I have a custom block in which I put iframe and javascript ads. I noticed that recently they are being exploited so that attackers add some script to them (i.e on custom block table). I use Full html on the blocks to be able to insert iframe and script code of the ads. All these made me feel very insecure about Drupal so I appreciate your solution to secure my site.
2
-
1Could you provide a little bit more information? Where did you create the blocks (in code or through Drupal's admin), who has rights to modify blocks, have you been noticing any other strange hacks happening (new nodes, comments, etc).– JanceJan 13, 2015 at 19:26
-
sure, I created the block using the admin panel. Nobody had right to customize the block. Just a jQuery been injected that makes continuous requests to 3rd party sties. Also I noticed that I could not login as admin so quickly changed the admin passwd using command line.– ediJan 13, 2015 at 19:43
Add a comment
|
1 Answer
So if your admin account had it's password changed, I would be willing to bet the hackers gained access to your admin account somehow.
Might want to think about beefing up your passwords, for both your admin account and the box.
You definitely should make sure your Drupal install is up to date. If "Drupal Core update status" isn't "up to date" at /admin/reports/status you should look to update core. If there is ever a security vulnerability found in core, it's normally fixed very quickly and rolled out in a new version, so you should keep your core up to date.
As for ways to make your blocks more secure, one thing you might want to try is to actually move the block from being controlled by the admin to being controlled by code.
You can write a little custom module that will create blocks. You'll want to be familiar with hook_block_info and hook_block_view. Another upside to moving blocks into code is that it will increase their portability.
Also, as another general security note, you might want to take a look at Security Review, which will help point out any security flaws you might have on your site.
-
Thanks for the tips Jance. Actually my drupal install is up to date. I used to use 'Simple Ad Block' in 6 but it is discontinued. Do you know any similar module that let create ad blocks?– ediJan 13, 2015 at 20:07
-
When you say "Simple Ad Block" are you refering to this: drupal.org/project/simplead_block if so you might want to look at SimpleAds drupal.org/project/simpleads– JanceJan 13, 2015 at 20:15
-
Yes that's what I meant. I've also seen simpleads but it is overkill for my purpose. I just want to create some static blocks and hate to get into nitty-gritty of drupal development.– ediJan 13, 2015 at 20:20