Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?
If you're reading this article and hoping to check a Drupal 7 site more than a month after the exploit landed, your site quite likely already got hacked. Your best bet is to restore a backup from before the attacks commenced and work from there.

There is a FAQ on SA-CORE-2014-005.


  How do I tell if my sites have been compromised?


One way to quickly check if sites are compromised is with the Drupalgeddon drush command.


https://www.drupal.org/project/drupalgeddon


Install to your ~/.drush with drush dl drupalgeddon

Then use drush drupalgeddon-test to test. Drush aliases make this easy and quick.

This tool can confirm an exploited site, but it cannot guarantee your site did not get exploited. There is no "clean bill of health" here unless you upgraded before the attacks started.



Site Audit module includes some of the checks from Drupalgeddon, and gives you a lot more useful input too. I highly recommend it. (EDIT: Now they work together - super nice!)


http://drupal.org/project/site_audit




Security Review doesn't check for Drupalgeddon attacks but is worth having in your toolbelt too.


http://drupal.org/project/security_review




If your site codebase was writeable to the www user , you could additionally check for modified code using the hacked module. This module may not do what you think based on its name alone :)


http://drupal.org/project/hacked




While there is no single certain way to identify all compromised sites, these tools can help you identify the most common indications.




  What should I search for in my apache access logs to detect if my site was a victim or not?


Your access logs will contain a lot of POST requests by now. Unless you had taken the unusual step of logging all post data in advance of the bug, you're unlikely to have the information to tell which of these were malicious.


  So far what are these hackers doing to compromised sites?


Many are reporting that their sites are being patched by the hackers! As an attacker, this makes good sense - you don't want your newly hijacked site whipped out from underneath you by the next attacker :)

Other than that, I'd guess the sites are being used to harvest whatever valuable data is there (maybe grab some creds, maybe lift transaction details after exploiting) and to do boring things like send spam and work as humble botnet slaves. Oh, and further expand the attacker's empire of hijacked Drupal sites. (Sorry, I don't have any hacked sites to observe.)