I am running Drupal 6.28 that was recently hacked and there were scripts being executed out of the /tmp directory, apparently running a bitcoin mining server and other brute force scripts.
I would get random processes sometimes 2-4 at a time that would each consume over 100% cpu(core) for an indefinite period of time. Which would make sense if they were running some type of bitcoin mining operation or brute force attack.
To the best of my knowledge the attacker uploaded a file named 32.tar.gz to the site. Drupal moved this file to the /tmp directory, then attacker extracted into the same /tmp directory, which has 777 permissions.
I would gladly change the permissions on this folder to something more sane like 755, but in doing so, Drupal stops functioning properly.
All files/folders in my drupal install directory are owned like: myUser:www-data, where www-data is the user that PHP/Apache is running as.
The /tmp folder is owned by the same user and group, so I would think that it would be writable at 755, but that just isn't the case for some reason. Is there a way to harden the security of the site that would prevent this from happening?