Detecting Drupalgeddon and Drupalgeddon2 backdoors on Drupal sites
Drupalgeddon (October 2014) and Drupalgeddon2 (March 2018) were large automated attacks. Many sites hit back then were never fully cleaned, and the same techniques are still in use.
Backdoors stay after the update.
Updating Drupal closes the hole, it does not remove what the attacker already left. drupal.org's PSA-2014-003 was clear: sites not updated within hours had to be treated as compromised.
The traces sit in different places: a database row, an extra user, a PHP file among the images, a few lines at the end of a core JavaScript file.
We look for each trace where the attack left it.
Database
On Drupal 7 we check
menu_router: a callback tofile_put_contents,assertor similar functions is a critical alert.Files
PHP in
sites/default/files, a changed protection.htaccess, signatures like the Coinhive miner injected intomisc/jquery.once.js.Accounts
Every new administrator, even one created straight in the database, shows up at the next sync.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Do you find every malware variant?
No. Signatures look for documented structures of real incidents. A match always needs checking, and core integrity covers changes signatures do not know.
Does the menu_router check apply to Drupal 8 and later?
No, routing changed in Drupal 8. There, core integrity, suspicious files and new administrators matter.
Goes well with
- Drupal 7 has reached end of life: how to protect the sites still running itMonitoring, integrity, Drupalgeddon backdoors and backups on Drupal 7, even on PHP 7.1.
- PHP malware in the uploads folder: how to find it quicklyPHP in uploads, including names like .php.jpg, and suspicious files.
- Drupal core file integrity checks, Composer projects includedEvery core file compared with the drupal.org archive, archives and Composer.
- Drupal site monitoring for web agenciesA native Drupal module, with insecure releases and core integrity from drupal.org.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.