Over 12 million Drupal websites attacked

 

There are chances that over 12 million websites may have been attacked by a group of hackers that made use of a bug in the famed Drupal Software

The sites that use Drupal to manage web content and images, multimedia elements like videos and text are impacted.

According to a security warning issued to users stating that the sites that did not apply the latest released patch, should “assume” they have been hacked.
According to the issued warning, the programmed attacks benefitted from the bug and can let the hackers take total control of the site.

‘Shocking’ statement

In its “highly critical” announcement, Drupal’s security team said anyone who did not take action within seven hours of the bug being discovered on 15 October should “should proceed under the assumption” that their site was compromised.

According to the security team of Drupal, anyone who did not employ the necessary action within the first seven hours of discovery of the bug on 15 October “should proceed under the assumption” that their site have been compromised

Anyone who had not yet updated should do so without any delay, it cautioned.

However, the team also added that only applying the update will not remove any indirect access that hackers have managed to acquire after they got an entrée. Sites should make sure that no data has been taken by the hackers, said the warning.

“Attackers may have copied all data out of your site and could use it maliciously,” stated the notice. “There may be no trace of the attack.” A link also has been provided to advice that would help sites redeem their data and security.

 

An analyst at security firm, Mark Stockley said the warning was “shocking”.

The hackers take up advantaged position with the bug in version 7 of the Drupal, he informed. The site that are being attacked can actually by malware or a worse, may have to tackle a compromised server as the access can be used to take control of the server or seed a site with malware to attack online visitors.

 

According to his estimations, 5.1% of the billion or close to it number of sites on the web use Drupal 7 to manage their content, which mean that number of sites compromised can be around 12 million.

Users that are not applying updates, even after the warning is the thing that Drupal should worry about, said Mr. Stockley.

 

“Many site owners will never have received the announcement and many that did will have been asleep,” he added. “What Drupal badly needs but doesn’t have is an automatic updater that rolls out security updates by default.”