The Imunify360 Threat Intelligence Group are monitoring a remote code execution vulnerability targeting installations of the Drupal CMS. This vulnerability has the identifier CVE-2019-6340 . It affects these versions of Drupal: All 8.5.x versions, up to and including 8.5.11 All 8.6.x versions, up to and including 8.6.10 Attack Method Remote code execution vulnerabilities allow attackers to execute arbitrary code on a platform, in this case, the Drupal CMS. The code can install other software, gather data for exporting, or permanently delete or modify data without the site owner's knowledge or consent. Attackers deliver malicious PHP payloads using automated scripts. It is this payload we hav...

We are happy to announce a new feature for Imunify360. Active Response is an OSSEC feature re-engineered by us to block specific server ports under attack. This gives us significantly fewer false positives, and improves the detection and blocking of aggressive brute force requests. It's only available for Imunify360 version 4.0, currently in beta and due for release before the end of March 2019.   To activate Active Response, follow these steps. 1. Edit the configuration file: /etc/sysconfig/imunify360/imunify360.config 2. Add the these lines to it: OSSEC:     active_response: true 3.  Restart the Imunify360 agent: service imunify360 restart That's it. Now,...

Stay in the light; be aware of the dark. Anonymous 'Know your enemy' is an overused cliche in the cybersecurity industry. We take a broader view: Know your world, and your place in it.  Our team knows the hacking world. We've recruited ethical hackers, OSCP-certified engineers, and seasoned IT professionals, all of whom are watching the dark web and its subversive operatives, watching how threats evolve and how attacks are planned. We routinely monitor zero-day exploits, examining use-cases thoroughly and responding with robust mitigation strategies. The fruits of intensive research and development are augmented by both human experience and machine learning. This sharpens our ability to...

The popular Van Ons WordPress plugin for GDPR compliance, with more than 100,000 active installations, was patched on November 7th due to a privilege escalation vulnerability ( CVE–2018–19207 ) found in version 1.4.2. The WP GDPR Compliance plugin helps website owners meet the recent GDPR European data privacy regulation. This came into effect in May of this year, boosting the plugin's popularity. Starting on 10th November, our Threat Intelligence Group noticed a surge in attacks targeting this exploit vector.   Imunify360 customers were already protected by a WAF rule issued several days earlier. This rule detects and blocks malicious payloads attempting to exploit this attack vector. ...

Activity Our monitoring systems identified a first-wave malicious campaign on April 12th, 2018, the same day that proof of concept code went public. The Drupal core security team had earlier released security advisory SA-CORE–2018–002 on the 28th March. We released our blocking and detection rules a few days later meaning that Imunify360 customers were already protected by the time the campaign started. October saw a new burst of attacks on this vector. Botnets located on thousands of IPs requested access to Drupal-based sites to upload a malicious payload. The chart below shows the activity levels for the past few months. Recognition Most connections were attempting to extract the server's ...