Public Forums 71,145 posts

[BigSky Friend BigSkyJoin date: December 2005Posts: 49Downloads:0Uploads:1 Thanks: 2 Thanked: 3 times in 1 posts]

#132246

You guys might want to fix this–not terribly encouraging to any potential customers.

http://demo.joomlart.com/contest_opt/index.php?option=com_content&view=frontpage&Itemid=1&theme_header=0&theme_background=purewhite&theme_elements=red

[questbg Friend questbgJoin date: May 2008Posts: 1912Downloads:0Uploads:1 Thanks: 146 Thanked: 339 times in 197 posts]

#265431

Wow. That’s bad. Was this the old Joomla 1.5.x rather than the new security fix in 1.5.6?

[Sherlock Friend SherlockJoin date: September 2014Posts: 11453Downloads:0Uploads:88 Thanks: 221 Thanked: 2478 times in 2162 posts]

#265450

Thanks
We will fix it now

[njbarbour Friend njbarbourJoin date: June 2008Posts: 23Downloads:0Uploads:0 Thanks: 3]

#265455

Hi,

Is there a solution to your site being hacked ?

njb

[TomC Moderator TomCJoin date: October 2014Posts: 14077Downloads:58Uploads:137 Thanks: 948 Thanked: 3155 times in 2495 posts]

#265472

<em>@njbarbour 73672 wrote:</em><blockquote>Hi,

Is there a solution to your site being hacked ?

njb</blockquote>

It’s been fixed

[questbg Friend questbgJoin date: May 2008Posts: 1912Downloads:0Uploads:1 Thanks: 146 Thanked: 339 times in 197 posts]

#265474

Could you guys actually explain how this was ‘fixed’ please? I’m going live next week and I’m still on Joomla 1.5.3 … if there’s any protection for my site, then please share with me!

[njbarbour Friend njbarbourJoin date: June 2008Posts: 23Downloads:0Uploads:0 Thanks: 3]

#265475

<em>@tcraw1010 73698 wrote:</em><blockquote>It’s been fixed</blockquote>
Hi,

I had the hosting company reset the site to the version before the time of the attack.
Thing is, I do not now have admin control of the site in order to make my upgrade and fix it permanently.

njb

[mj1256 Friend mj1256Join date: June 2007Posts: 1473Downloads:10Uploads:35 Thanks: 84 Thanked: 225 times in 118 posts]

#265494

I don’t think that security is really a template issue,

security lies with the server, the hosting company, and joomla itself

and the first rule of the internet,
There is no such thing as a totally secure site.

As for restoring a site after being hacked.
make sure you hosting company knows you’ve been hacked
delete your site and database completely
reinstall from a backup (hopefully made prior to the hack) and change all of the old logins and passwords once the site is reinstalled.

as for the hosting company and joomla
cheap hosting is just that, cheap, don’t rely on a cheap host for anything, especially security.
find a hosting company that offers PHPsuexec, its recommended for joomla hosting and will change your file ownerships, file permissions (777 not allowed) disable your php.ini and make it more difficult for nefarious forces to inject and run programs on your website.
more info is here
http://www.joomlatutorials.com/faq/view/joomla_security_tips/permissions_under_phpsuexec/60.html

as for joomla, always make sure your running the latest versions and install all the security options recommended on the joomla website.

security is as much the users responsibility as it is the providers.

as for the hosting company restoring the site, in my experience, their backups will not restore an operational joomla site, paths will be broken. best case is to have them reset up the server and then you install from your backup. Most hosts backup the server, not your website.

I recommend joomlapack for joomla, its free, it works, and it installs just like a ja quickstart package.

everyone should be backing up their websites everytime they make a change and then storing the backup locally.

1 user says Thank You to mj1256 for this useful post

1. njbarbour

[TomC Moderator TomCJoin date: October 2014Posts: 14077Downloads:58Uploads:137 Thanks: 948 Thanked: 3155 times in 2495 posts]

#265498

<em>@mj1256 73721 wrote:</em><blockquote>
everyone should be backing up their websites everytime they make a change and then storing the backup locally.</blockquote>
Exactly what I do with each and every little change – edit / test first on my localhost server, then upload it to my web host.
All the while having two identical copies of the files.

Additionally, about once every month or so, I back the entire thing up onto a CD.

1 user says Thank You to TomC for this useful post

1. njbarbour

[njbarbour Friend njbarbourJoin date: June 2008Posts: 23Downloads:0Uploads:0 Thanks: 3]

#265499

mj1256,

Finally somebody is speaking plain and helpful English about this issue. I have gone round and round today trying to repair the sites. My Hosting company did it in the end. I am not too experienced with Joomla! and the backup piece I know I am weak on this causes me to rely more than I should on the hosting company. I dont have a local host (only the real site) to test the patch on. Its a fingers crossed job later when I do the 1.5.3 to 1.5.6 upgrade.

Thanks

njb

[mj1256 Friend mj1256Join date: June 2007Posts: 1473Downloads:10Uploads:35 Thanks: 84 Thanked: 225 times in 118 posts]

#265500

I think hostgator offers PHPsuexec and of course Rocken, the host for the joomla website offers it.

[njbarbour Friend njbarbourJoin date: June 2008Posts: 23Downloads:0Uploads:0 Thanks: 3]

#265502

Tom,

As I mentioned, Im not the best expert on Joomla! or backing up for that matter. At the moment Im in the process of backing up everything in my www directory via FTP.

I will also backup my databases.

Thanks for the comment.

njb

[njbarbour Friend njbarbourJoin date: June 2008Posts: 23Downloads:0Uploads:0 Thanks: 3]

#265504

mj1256

Pardon my ignorance but can you summarise what these packages will allow me to do ?

njb

[mj1256 Friend mj1256Join date: June 2007Posts: 1473Downloads:10Uploads:35 Thanks: 84 Thanked: 225 times in 118 posts]

#265515

joomlapack will let you backup your site so that if it breaks or gets hacked you can restore the site to your server or host. it works just like the JA quickstart package, except it will be your site. It installs as a component and is very intuitive.

as for PHPsuexec, as I said, it is a security program that is recommended for use with joomla. You cannot install this, it needs to be done by the host and works at the server level. So, try to find a host that has it, (like RochenHost or HostGator), or, if your host does not have it on the server you are on, see if they have one they can move your site to.

Now, how it works and what it does is explained in the link I gave. Basically, it changes file ownership to the user (admin), forbids the use or chmod 777, and makes it tough for nefarious hackers to do site injections of files and executable programs, it also disables the global php.ini which has the php directives for your site.

[njbarbour Friend njbarbourJoin date: June 2008Posts: 23Downloads:0Uploads:0 Thanks: 3]

#265522

Hi,

Thanks again for your mail. Your very knowledgable on the whole topic. Your photograph is pretty good, it seems to depict a smart person answering the most basic of questions. – Kind of like the ones Ive been asking.

Anyway. I will take your advice and make these changes and if I have to I will move server or company to get the protection I need.

Much appreciated.

njb

[Author]

Posts