2

Apparently one of the modules installed on my drupal site has been sending SPAM emails from my server as in (name)_(lastname)@(myservername).com , it managed to send 1000 email and queue 97,000 emails only in the first day..

At first, based on the email details, I figured it was being sent from a PHP page called diff.php under /sites/all/modules/contrib/libraries/tests/libraries/diff.php, so I deleted the whole tests folder, but now the emails are heading directly from my root site.. I have installed Hacked! to a development copy, and here's a copy of the results: enter image description here

Does it seem like a module issue? should I re-install the changed modules?

  • In order to avoid similar issues in the future, go to /admin/reports/updates/settings and add your email so you will get notifications whenever a new security update is available. Don't forget to set up a cron job. Try to do the security updates as soon as possible and make frequent backups of your database. – consuela May 13 '15 at 9:34
7

The version of core you're running - 7.30 - is extremely vulnerable. As long as you're running any version of core prior to 7.32, your site will remain vulnerable. The vulnerability will allow changing modules (which can be discovered with the Hacked! module), putting executable PHP in the database (which can not be discovered with Hacked!), and injecting malicious shell scripts (which can not be discovered with Hacked!).

Simply replacing Drupal core and modules with non-hacked versions will not remove backdoors.

Just going through the changed modules and reinstalling them will not do. At this point, even if you replace everything, the intruder have probably infected your database with exploits, as well as having installed several well-hidden backdoors to your site at shell level.

The best recourse is to delete your entire site an rebuild it from scratch on a clean vhost, then restore its contents from a backup made prior to Oct. 15, 2014.

Read this SA to understand the severity of this vulnerability: https://www.drupal.org/SA-CORE-2014-005. Also read:

If you're unable to delete the site and restore from backup, read this about recovering: Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?.

After you have cleaned up your site, to be alerted if this happens again, consider installing File integrity check. This module will monitor the integrity of almost all files on your site and send you an email if it detects that file integrity is breached.

| improve this answer | |
0

yes - start in a new folder and install everything new. (you can try to copy the unchanged modules from your old installation - but i wouldn't suggest that)

take care of any customizations made to core or contributed modules (actually, this is bad practice ..) - so , first keep your code and check back there if something does not work.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.