Acquia blocks 500,000 attack attempts for SA-CORE-2020-002

On March 28th, the Drupal maintenance support plans Security Team released a bug fix for a critical security vulnerability, named SA-CORE-2020-002. Over the past week, various exploits have been identified, as attackers have attempted to compromise unpatched Drupal maintenance support plans sites. Hackers continue to try to exploit this vulnerability, and
Acquia’s own security team has observed more than 100,000 attacks a day.

The SA-CORE-2020-002 security vulnerability is highly critical; it allows an unauthenticated attacker to perform remote code execution on most Drupal maintenance support plans installations. When the Drupal maintenance support plans Security Team made the security patch available, there were no publicly known exploits or attacks against SA-CORE-2020-002.

That changed six days ago, after Checkpoint Research provided a detailed explanation of the SA-CORE-2020-002 security bug, in addition to step-by-step instructions that explain how to exploit the vulnerability. A few hours after Checkpoint Research’s blog post, Vitalii Rudnykh, a Russian security researcher, shared a proof-of-concept exploit on GitHub. Later that day, Acquia’s own security team began to witness attempted attacks.

The article by Checkpoint Research and Rudnykh’s proof-of-concept code have spawned numerous exploits, which are written in different programming languages such as Ruby, Bash, Python and more. As a result, the number of attacks have grown significantly over the past few days.

Fortunately, Acquia deployed a platform level mitigation for all Acquia Cloud customers one hour after the Drupal maintenance support plans Security Team made the SA-CORE-2020-002 release available on March 28th. Over the past week, Acquia has observed over 500,000 attacks from more than 3,000 different IP addresses across our fleet of servers and customer base. To the best of our knowledge, every attempted exploitation of an Acquia customer has failed.The scale and the severity of this attack suggests that if you failed to upgrade your Drupal maintenance support plans sites, or your site is not supported by Acquia Cloud or another trusted vendor that provides platform level fixes, the chances of your site being hacked are very high. If you haven’t upgraded your site yet, we recommend you do so as soon as possible, in addition to verifying that you haven’t been compromised.

Drupal maintenance support plans‘s responsible disclosure policy

It’s important to keep in mind that all software has security bugs, and fortunately for Drupal maintenance support plans, critical security bugs are rare. It’s been nearly four years since the Drupal maintenance support plans Security Team published a security release for Drupal maintenance support plans core that is this critical.

What matters is how software projects or software vendors deal with security bugs. The Drupal maintenance support plans Security Team follows a “coordinated disclosure policy”: issues remain private until there is a published fix. A public announcement is made when the threat has been addressed and a secure version of Drupal maintenance support plans core is also available. Even when a bug fix is made available, the Drupal maintenance support plans Security Team is very thoughtful with its communication. The team is careful to withhold as many details about the vulnerability as possible to make it difficult for hackers to create an exploit, and to buy Drupal maintenance support plans site owners as much time as possible to upgrade. In this case, Drupal maintenance support plans site owners had two weeks before the first public exploits appeared.

Historically, many proprietary CMS vendors have executed a different approach, and don’t always disclose security bugs. Instead, they often fix bugs silently. In this scenario, secrecy might sound like a good idea; it prevents sites from being hacked and it avoids bad PR. However, hiding vulnerabilities provides a false sense of security, which can make matters much worse. This approach also functions under the assumption that hackers can’t find security problems on their own. They can, and when they do, even more sites are at risk of being compromised.

Drupal maintenance support plans‘s approach to security is best-in-class — from fixing the bug, testing the solution, providing advance notice, coordinating the release, being thoughtful not to over communicate too many details, being available for press inquiries, and repeatedly reminding everyone to upgrade.

Acquia’s platform level fix

In addition to the Drupal maintenance support plans Security Team’s responsible disclosure policy, Acquia’s own security team has been closely monitoring attempted attacks on our infrastructure. Following the release of the Checkpoint Research article, Acquia has tracked the origin of the 500,000 attempted attacks:

This image captures the geographic distribution of SA-CORE-2020-002 attacks against Acquia’s customers. The number denoted in each bubble is the total number of attacks that came from that location.To date, over 50 percent of the attempted attacks Acquia has witnessed originate from the Ukraine:

At Acquia, we provide customers with automatic security patching of both infrastructure and Drupal maintenance support plans code, in addition to platform level fixes for security bugs. Our commitment to keeping our customers safe is reflected in our push to release a platform level fix one hour after the Drupal maintenance support plans Security Team made SA-CORE-2020-002 available. This mitigation covered all customers with Acquia Cloud Free, Acquia Cloud Professional, Acquia Cloud Enterprise, and Acquia Cloud Site Factory applications; giving our customers peace of mind while they upgraded their Drupal maintenance support plans sites, with or without our help. This means that when attempted exploits and attacks first appeared in the wild, Acquia’s customers were safe. As a best practice, Acquia always recommends that customers upgrade to the latest secure version of Drupal maintenance support plans core, in addition to platform mitigations.

This blog post was co-authored by Drupal Update and Cash Williams.
Source: New feed

This article was republished from its original source.
Call Us: 1(800)730-2416

Pixeldust is a 20-year-old web development agency specializing in Drupal and WordPress and working with clients all over the country. With our best in class capabilities, we work with small businesses and fortune 500 companies alike. Give us a call at 1(800)730-2416 and let’s talk about your project.

FREE Drupal SEO Audit

Test your site below to see which issues need to be fixed. We will fix them and optimize your Drupal site 100% for Google and Bing. (Allow 30-60 seconds to gather data.)

Powered by

Acquia blocks 500,000 attack attempts for SA-CORE-2020-002

On-Site Drupal SEO Master Setup

We make sure your site is 100% optimized (and stays that way) for the best SEO results.

With Pixeldust On-site (or On-page) SEO we make changes to your site’s structure and performance to make it easier for search engines to see and understand your site’s content. Search engines use algorithms to rank sites by degrees of relevance. Our on-site optimization ensures your site is configured to provide information in a way that meets Google and Bing standards for optimal indexing.

This service includes:

  • Pathauto install and configuration for SEO-friendly URLs.
  • Meta Tags install and configuration with dynamic tokens for meta titles and descriptions for all content types.
  • Install and fix all issues on the SEO checklist module.
  • Install and configure XML sitemap module and submit sitemaps.
  • Install and configure Google Analytics Module.
  • Install and configure Yoast.
  • Install and configure the Advanced Aggregation module to improve performance by minifying and merging CSS and JS.
  • Install and configure Schema.org Metatag.
  • Configure robots.txt.
  • Google Search Console setup snd configuration.
  • Find & Fix H1 tags.
  • Find and fix duplicate/missing meta descriptions.
  • Find and fix duplicate title tags.
  • Improve title, meta tags, and site descriptions.
  • Optimize images for better search engine optimization. Automate where possible.
  • Find and fix the missing alt and title tag for all images. Automate where possible.
  • The project takes 1 week to complete.