Drupal resets account passwords after detecting unauthorised access

The attack does not affect sites running Drupal software

Drupal.org has reset account passwords after it found unauthorized access to information on its servers.

The access came through third-party software installed on the Drupal.org server infrastructure, and was not the result of a vulnerability within Drupal, the open source content management software provider said in a security update late Wednesday on its website.

The information exposed includes user names, email addresses, and country information, as well as hashed passwords. The breach has affected user account data stored on Drupal.org and groups.drupal.org, and not on sites running Drupal software. Drupal.org is the volunteer-run home of the Drupal project, which keeps track of the Drupal code and contributed work, while Drupal Groups is used by the community to organize and plan projects.

Investigations are still going on and Drupal may learn about other types of information that may have been compromised, wrote Holly Ross, executive director of (Drupal Association, which maintains the Drupal.org site.

"We do not store credit card information on our site and have uncovered no evidence that card numbers may have been intercepted," Drupal said in a FAQ. There is also no evidence that Drupal core software or any contributed projects or packages on Drupal.org. were modified by an unauthorized user.

The malicious files, placed on association.drupal.org servers by a third-party application used by that site, were discovered during a security audit. The Drupal Association website was shut down "to mitigate any possible ongoing security issues related to the files." During forensic evaluations by the security team, it was found that user account information had been accessed through the vulnerability.

The third-party application was not identified.

Drupal said it had reset all Drupal.org account holder passwords and is asking users to change their passwords at their next login attempt, as a precautionary measure. It gave guidelines to users to change their passwords.

Drupal currently does not have information on who was behind the attack. It did not immediately respond to requests for more information about the intrusion, including on the number of users affected, which could be around 1 million, according to some estimates.

The open-source group has meanwhile strengthened its security to prevent similar attacks, including by hardening its Apache web server configurations, running an anti-virus scanner routinely to detect malicious files being uploaded to the Drupal.org servers, and adding GRSEC secure kernels to most servers. It also made static archives of end-of-life sites, which will not be updated in the future.

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John's e-mail address is john_ribeiro@idg.com

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags Drupal.orgintrusionsecuritydata breachmalware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

John Ribeiro

IDG News Service
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?