Support Forum

  • Page:
  • 1

Security Warning

zentoolsIf you use Zentools please post a review at the Joomla! Extensions Directory.

14 years 10 months ago
Hi
Just to bring you up to date Anthony and provide a "be alert" warning to everyone operating their sites ... the bad guys hacked my site and got me bad! Tom at Joomlajabber was a great help and found the server was riddled with trojans and virus (over 2000). He said that while my out of date "Virtuemart" component was a factor in the guys getting in, there was also problems with the security on the host server (webcity) they have a root kit on the server and its used for spamming and music distribution. The host is in denial. I've closed my account with web city and am setting up elsewhere.

So for what its worth heres what I learned:
1. Keep your components up-to-date
2. Monitor closely anyone logging onto your site as a user. I am thinking that depending on where I locate, I may well get users to email me and I will set up their login. The bad guys were the first users to register on my site and spent a month there before making a complete mess of things before they let me know.
3. Be alert to anything "different" happening on your site. This is really difficult when, like me, you are in the process of learning how to use joomla, virtuemart etc. The bad guys having gained access as a user, got my admin username and password by getting an extra login screen (identical to the one I used to login to the backend of the site) to pop up when I clicked on the virtuemart component.
4. Do your research when you organise a host - make sure they have good security and a process to keep their software up to date. I'll be looking at a number of options to multiple user hosts suc as vpns.

Thanks Anthony for your help also. I'll try to get that stuff in the post to you this coming week!
Cheers
laurie
  • Laurie Stiller's Avatar
  • Laurie Stiller
  • 3 Month Basic
  • 12 posts
  • Karma: 0
The administrator has disabled public write access.
14 years 10 months ago
Thanks a heap Laurie and Im glad Tom was able to help you. He was a godsend for me a year or two ago when I needed his help.

Hope the finishing of the site is less eventful :)

Anthony
  • Anthony Olsen's Avatar
  • Anthony Olsen
  • LIfetime Developer - Big Bamboo
  • 23925 posts
  • 788 Thanks
  • Karma: 433
The administrator has disabled public write access.
14 years 10 months ago
A side note, a good idea is to use some other means of logging in to your backend, btw. I've installed the jAuthenticate plugin which blocks access to the default joomla/administrator/ login screen and allows access to the admin page only when you access it through a set path (ie joomla/administrator/?secretPass).

There are probably others out there as well.. :)
  • Erica K. Frei's Avatar
  • Erica K. Frei
  • Previous Member
  • 20 posts
  • Karma: 0
The administrator has disabled public write access.
14 years 10 months ago
Dear Erica,

Could you provide a link to 'jAuthenticate'. I could not find it within the Joomla extension listings.

Thanks,
Ed
  • Ed's Avatar
  • Ed
  • LIfetime Developer - Big Bamboo
  • 1693 posts
  • 45 Thanks
  • Karma: 60
The administrator has disabled public write access.
14 years 10 months ago
Hey Ed,

Sorry, I mis-typed that extension name... did a search and here is the link.

jSecure Authentication Plugin :
extensions.joomla.org/extensions/access-&-security/site-security/5809/details
  • Erica K. Frei's Avatar
  • Erica K. Frei
  • Previous Member
  • 20 posts
  • Karma: 0
The administrator has disabled public write access.
14 years 10 months ago
Dear Erica,

In between my reply post and your response, I found this plugin... WOW!:woohoo: I had no idea this was available and now, OMG what a blessing! Thanks for you follow-up post I'll feel a little safer once I distribute this application across all of my Joomla sites.

Ed
  • Ed's Avatar
  • Ed
  • LIfetime Developer - Big Bamboo
  • 1693 posts
  • 45 Thanks
  • Karma: 60
The administrator has disabled public write access.
14 years 10 months ago
Ed,

Glad I could help! :) Don't you just love little extensions that make your Joomla life easier and more secure? ;)
  • Erica K. Frei's Avatar
  • Erica K. Frei
  • Previous Member
  • 20 posts
  • Karma: 0
The administrator has disabled public write access.
14 years 10 months ago
Yeah thanks Erica that looks great - I'll definitely be using it on the JB reboot :)

Thanks Anthony
  • Anthony Olsen's Avatar
  • Anthony Olsen
  • LIfetime Developer - Big Bamboo
  • 23925 posts
  • 788 Thanks
  • Karma: 433
The administrator has disabled public write access.
14 years 10 months ago
In order to trick source code snoppers from seeing,
'<meta name="generator" content="Joomla! 1.5 - Open Source Content Management" />'
place the following code string inside your index.php file.

Joomla Bamboo templates:
Right under, '<jdoc:include type="head" />' add this code string and replace 'ANY TEXT HERE' with whatever you wish
<?php $this->setGenerator('ANY TEXT HERE'); ?>

In other non Joomla Bamboo templates you'll need to use the following code string
<?php $document->setGenerator('ANY TEXT HERE'); ?>

Finally, you'll have to play around with the placement of the last code string. In some templates it works above the <head> calls while others need it in between the <head>.

If placed correctly inside your index.php file you'll now see;
<meta name="generator" content="ANY TEXT HERE" />

Hope this helps anyone out... It's a must do on every Joomla install I do!

Ed
  • Ed's Avatar
  • Ed
  • LIfetime Developer - Big Bamboo
  • 1693 posts
  • 45 Thanks
  • Karma: 60
The administrator has disabled public write access.
14 years 10 months ago
Awesome thanks Ed - just made this topic a sticky I think its pretty handy :)
  • Anthony Olsen's Avatar
  • Anthony Olsen
  • LIfetime Developer - Big Bamboo
  • 23925 posts
  • 788 Thanks
  • Karma: 433
The administrator has disabled public write access.
14 years 10 months ago
Yep, thankyou very much Erica and Ed! This one goes straight into my bag of tricks no questions asked :lol:
  • Craig's Avatar
  • Craig
  • 12 Month Developer
  • 2G rocks
  • 418 posts
  • Karma: 17
The administrator has disabled public write access.
14 years 9 months ago
I have a Joomla site that was recently hacked as well. It's definitely going around! Even though the other sites I've built are not Joomla, I'm upgrading the security on all of them. I was able to restore the Joomla site and change all the admin & user login info, and I was planning to change the administrator login link as well. It sounds like the plugin you mention here will work well for that.

I'm using the Max Biz template and need to upgrade the site from Joomla 1.5.5 to the current version 1.5.12. Should I just follow the standard Joomla upgrade instructions, or is there anything specific I need to take into account with this template?
  • Kristin Singhasemanon's Avatar
  • Kristin Singhasemanon
  • Free Extensions
  • 13 posts
  • Karma: 0
The administrator has disabled public write access.
14 years 9 months ago
Hi Kristin,

Sorry to hear that :(

Yes standard upgrade is fine with MaxBiz.

Good luck with it.

Anthony
  • Anthony Olsen's Avatar
  • Anthony Olsen
  • LIfetime Developer - Big Bamboo
  • 23925 posts
  • 788 Thanks
  • Karma: 433
The administrator has disabled public write access.
12 years 10 months ago
some other suggestion also never send any information such as hosting or administrator username and password through yahoo email account
its happened with 1 of my client's site
i was though since my clients is my friend, so i can send him every information regarding to his site through yahoo mail
someday, i saw his email account keep spamming , and i still didnt pay attention on that. until after a few days later, i realized that someone has deface his site :(
  • Robin Tan's Avatar
  • Robin Tan
  • 3 Month Basic
  • 42 posts
  • 3 Thanks
  • Karma: 1
The administrator has disabled public write access.
12 years 10 months ago
Ouch sorry to hear that Robyn but it's certainly a good point.

Anthony
  • Anthony Olsen's Avatar
  • Anthony Olsen
  • LIfetime Developer - Big Bamboo
  • 23925 posts
  • 788 Thanks
  • Karma: 433
The administrator has disabled public write access.

zentoolsIf you use Zentools please post a review at the Joomla! Extensions Directory.

Happy Campers

Close