Our school website (with edugeek joomla package) HACKED

[dhasmet]

Please help

 

Our website is hacked. How could it be? Are there som security problem with 1.5 Joomla package?

[kmount]

We need more information in order to help.

 

What exactly has been hacked?

Is it running linux? (If so, check lastlog for connections to SSH)

Check your web access logs to see if anything suspicious occured.

What else does the box have on it? webmin? etc?

[dhasmet]

We need more information in order to help.

 

What exactly has been hacked?

Is it running linux? (If so, check lastlog for connections to SSH)

Check your web access logs to see if anything suspicious occured.

What else does the box have on it? webmin? etc?

 

I dont now what there has been hacked. When I tasted our site (vesterborgefterskole.dk), I get following message with black background:

 

"Hacked By Cw_BadBoOY"

 

We dont get any server, so I have build the site on my pc. And the page is hosted by "one.com".

[localzuk]

Ok, a brief search for the attacker turned up http://turk-h.org/defacement/list/filter/url/vesterborgefterskole and vesterborgefterskole.dk / Turk-h.Org which indicates it was attacked via a domain hack, for the reason of it being a nationalistic attack (ie. they're attacking it simply because they don't like Denmark I think (but then the online translators available for Turkish are a bit limited)). And the method translates as them taking control of your account at one.com (possibly be faking emails to one.com as if they had come from yourself to change the passwords for them, but then as I said before the online translators are limited).

 

I'd speak to one.com asap and get them to look at their logs.

[dhasmet]

Ok, a brief search for the attacker turned up http://turk-h.org/defacement/list/filter/url/vesterborgefterskole and vesterborgefterskole.dk / Turk-h.Org which indicates it was attacked via a domain hack, for the reason of it being a nationalistic attack (ie. they're attacking it simply because they don't like Denmark I think (but then the online translators available for Turkish are a bit limited)). And the method translates as them taking control of your account at one.com (possibly be faking emails to one.com as if they had come from yourself to change the passwords for them, but then as I said before the online translators are limited).

 

I'd speak to one.com asap and get them to look at their logs.

 

hmm, but the password was still the same. Do you now how I can set yhe site up again?? Should I install the Joomla package again?

[FN-GM]

Can you see your site in FTP?

 

your hosting company should be able to restore a backup for you

[dhasmet]

Can you see your site in FTP?

 

your hosting company should be able to restore a backup for you

 

yes, I have just changed my password and get the backup. What should I do now? Should I install joomla again or can I change some simple things??

[FN-GM]

Can you see the site in FTP?

 

There is no point doing a new install, if you site is gone the hosting company can bring the old one back from backups

[dhasmet]

Can you see the site in FTP?

 

There is no point doing a new install, if you site is gone the hosting company can bring the old one back from backups

 

I can see all the joomla package, its look like as before. I think, the hacker have only placed a frontpage. If its correkt, how can I erase the frontpage??

[FN-GM]

it looks like you might need the index.php file restoring form a backup

[dhasmet]

it looks like you might need the index.php file restoring form a backup

 

I did, but it still not working.

[Dos_Box]

Many ISPs don't do backups. There is simply too much information stored. Unless of course you pay out of the nose for a super dooper hosting package.

[dhasmet]

it looks like you might need the index.php file restoring form a backup

 

its the "configuration.php". but how du I change it?

[FN-GM]

its the "configuration.php". but how du I change it?

 

Whats wrong with it?

[dhasmet]

Whats wrong with it?

 

there was some code like

 

var $MetaTitle = '1';

var $lifetime = '15';

var $session_handler = 'database';

var .......... Hacked by blabla

var..............

 

I have erased the lines with name of the hacker, but it doesnt help. And I dont remember what the codes was, because I have erased it

[dhasmet]

it was the index.php in the templates. I get my site back, but its not look like as before, I think its in html. how can I change it?

[FN-GM]

it looks like it cannot find you style sheet.

[contink]

No offense to those who've commented before but generally it's not a good idea to assume that it's just a single point of entry and you've fixed it.

 

Once someone has got into your site (however they did it), you should assume that attempts have been made to subvert more than just a single page (rootkits, etc) and request your webhost do a thorough security scan of the account (and host environment).

 

I'd definitely get your joomla upgraded to the latest version as soon as possible and as suggested get yourself subscribed to the security watch list.

 

Also worth asking your host if mod_security is installed and asking them to include rules to cover common joomla and other PHP exploits.

 

good luck

[localzuk]

No offense to those who've commented before but generally it's not a good idea to assume that it's just a single point of entry and you've fixed it.

 

Once someone has got into your site (however they did it), you should assume that attempts have been made to subvert more than just a single page (rootkits, etc) and request your webhost do a thorough security scan of the account (and host environment).

 

I'd definitely get your joomla upgraded to the latest version as soon as possible and as suggested get yourself subscribed to the security watch list.

 

Also worth asking your host if mod_security is installed and asking them to include rules to cover common joomla and other PHP exploits.

 

good luck

 

Agree entirely. My personal advice for this sort of thing is to start from a clean slate - ie. one.com should do a complete rebuild of the server, and all sites should be re-installed, ensuring the latest patches are used. But then, this depends on how helpful one.com are.

[alonebfg]

if it is just the config file you can create another one but most of the time it is the index.php if you pm me i will talk to you and i will look at rebuilding it as long as sql is not damaged or template folder i can recover it for you.

 

to rebuild config file

 

var $sitename = 'your Web site name';

var $dbtype = 'mysql';

var $host = 'localhost';

var $user = 'your database username';

var $password = 'your database password';

var $db = 'database name';

var $dbprefix = 'jos_'; // This is the default database table prefix. Change this to whatever you change

the MySQL table prefix to in Step 2.

var $secret = 'FBVtggIk5lAzEU9H'; //Change this to a random mixture of upper and lower

alphanumeric characters. This is an important security feature and should not be neglected.

var $ftp_host = '127.0.0.1'; //This is the default localhost address reference. Your Web host may have

set this differently.

var $ftp_port = '21'; // Port 21 is the default FTP port on most operating systems, but may have been

configured differently by your host provider.

var $ftp_user = 'your ftp username';

var $ftp_pass = 'your ftp password';

var $ftp_root = 'the absolute path of the directory that the ftp client should open within';

$ftp_enable = '1'; Set to '1' to enable the FTP layer facility.

var $tmp_path = '/tmp'; //The absolute path to the tmp directory within the root directory of your

Joomla! installation. This should not be confused with the same named directory of your Web server.

var $log_path = '/var/logs'; //The absolute path to your Web server log directory.

var $mailfrom = 'your e-mail address';

var $fromname = 'your Web site name for example';

 

If you still have problems pm me.

Edited October 6, 2008 by alonebfg