Hacked Joomla sites

droid · 06-12-2008, 09:27:26 AM

Hi all,

Just wondered if anyone else has recently had their Joomla sites hacked.

I had all mine hacked thro firstly the config and then the index.php files.

Though quite easy to fix (and change permissions to 644) was this a widespread thing or just me.

Gary

admin · 06-12-2008, 09:55:07 AM

Mine are OK (famous last words).

Hacking is an occupational hazard.

Just make sure the passwords you are using for your DB connections are not the same for every site or one that you use for something else such as your PayPal account.

I now use a password generator for my DB passwords since one of mine was hacked and they posted the username and password on a forum.

Admin

mat · 30-05-2009, 06:35:03 PM

One of mine is getting done daily at the moment! Any tips on securing it? Its just the index page being replaced every time, such a pain!!

rush · 30-05-2009, 07:39:23 PM

Have you tried a Plugin like this:

jSecure Authentication - Joomla Plugin

It adds a layer of security at the back end/admin login page, i.e. you have to add a security key to the */administrator address in order to access?

Or are they getting in another way/front end?

mat · 30-05-2009, 07:47:50 PM

The first time I found a trojan called "lol.php"

in the modules folder. Does that give a clue to how they are getting in? Since then its been done again but I found no trojan file....

Juniper · 31-05-2009, 11:00:37 AM

I had a Mambo site that was always getting hit, eventually I uninstalled one of the modules and updated all the other ones I had in place.

They were exploiting a weakness in the add-on module, its important to keep all your add-ons up to date as many I had installed had security fixes added since they were first integrated.

admin · 31-05-2009, 11:04:21 AM

Try and analyse your hosting log files, comparing the activity around the date/timestamp of the replaced files. I have used this many times to find how they are getting access.

I will help you with the analysis if anyone needs it

Admin

mat · 31-05-2009, 04:41:16 PM

If anyone uses the Agora Forum component I found it to be that, they have released the fix for it as of 27th May...

06-12-2008, 09:27:26 AM	#1 (permalink)
droid Join Date: May 2007 Location: Stoke on Trent Posts: 221 No Classified Ratings Domain Trader Rating: (100% / 5)	Hacked Joomla sites Hi all, Just wondered if anyone else has recently had their Joomla sites hacked. I had all mine hacked thro firstly the config and then the index.php files. Though quite easy to fix (and change permissions to 644) was this a widespread thing or just me. Gary

06-12-2008, 09:55:07 AM	#2 (permalink)
admin Administrator Join Date: Jun 2004 Posts: 8,601 No Classified Ratings Domain Trader Rating: (100% / 1)	Mine are OK (famous last words). Hacking is an occupational hazard. Just make sure the passwords you are using for your DB connections are not the same for every site or one that you use for something else such as your PayPal account. I now use a password generator for my DB passwords since one of mine was hacked and they posted the username and password on a forum. Admin __________________ Domain Appraisal \| Domain Scripts \| Domain Software\| link to Acorn Domains

30-05-2009, 06:35:03 PM	#3 (permalink)
mat Join Date: Apr 2007 Location: Hampshire Posts: 3,328 No Classified Ratings Domain Trader Rating: (100% / 40)	One of mine is getting done daily at the moment! Any tips on securing it? Its just the index page being replaced every time, such a pain!! __________________ Mathew.co.uk - Follow me on Twitter here

30-05-2009, 07:47:50 PM	#5 (permalink)
mat Join Date: Apr 2007 Location: Hampshire Posts: 3,328 No Classified Ratings Domain Trader Rating: (100% / 40)	The first time I found a trojan called "lol.php" in the modules folder. Does that give a clue to how they are getting in? Since then its been done again but I found no trojan file.... __________________ Mathew.co.uk - Follow me on Twitter here

31-05-2009, 11:00:37 AM	#6 (permalink)
Juniper Member Join Date: Jun 2008 Location: Yorkshire Posts: 66 No Classified Ratings Domain Trader Rating: (100% / 1)	I had a Mambo site that was always getting hit, eventually I uninstalled one of the modules and updated all the other ones I had in place. They were exploiting a weakness in the add-on module, its important to keep all your add-ons up to date as many I had installed had security fixes added since they were first integrated. __________________ Koh Samui Travel � Gold

30-05-2009, 07:39:23 PM	#4 (permalink)
rush Join Date: Apr 2009 Location: Manchester Posts: 196 No Classified Ratings Domain Trader Rating: (100% / 3)	Have you tried a Plugin like this: jSecure Authentication - Joomla Plugin It adds a layer of security at the back end/admin login page, i.e. you have to add a security key to the */administrator address in order to access? Or are they getting in another way/front end?

31-05-2009, 11:04:21 AM	#7 (permalink)
admin Administrator Join Date: Jun 2004 Posts: 8,601 No Classified Ratings Domain Trader Rating: (100% / 1)	Try and analyse your hosting log files, comparing the activity around the date/timestamp of the replaced files. I have used this many times to find how they are getting access. I will help you with the analysis if anyone needs it Admin __________________ Domain Appraisal \| Domain Scripts \| Domain Software\| link to Acorn Domains

31-05-2009, 04:41:16 PM	#8 (permalink)
mat Join Date: Apr 2007 Location: Hampshire Posts: 3,328 No Classified Ratings Domain Trader Rating: (100% / 40)	If anyone uses the Agora Forum component I found it to be that, they have released the fix for it as of 27th May... __________________ Mathew.co.uk - Follow me on Twitter here

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Domain Name Community	Replies	Last Post
moving a Joomla site	admin	Joomla	2	11-09-2009 11:38:57 AM
Sites which collect articles automatically somehow??	woopwoop	Website Design	0	30-10-2008 05:10:15 AM
Domain Parking Versus Mini Sites	Billy	General Domain Parking	6	26-07-2008 03:24:07 PM
Adsense Allowed sites	golddiggerguy	Internet Marketing	4	15-11-2007 11:09:13 PM