My site has been hacked

Discussion in 'Security' started by Dehisce, Nov 2, 2009.

  1. #1
    One of the websites I did for a local business has been hacked. It was running Joomla 1.5.13 with a few addon modules. How can this be stopped?
     
    Dehisce, Nov 2, 2009 IP
  2. krishmk

    krishmk Well-Known Member

    Messages:
    1,376
    Likes Received:
    40
    Best Answers:
    0
    Trophy Points:
    185
    #2
    What happened? Did you lose the domain or someone added malicious code to your website's source file.
    Also a link to your site can drive proper responses.
     
    krishmk, Nov 2, 2009 IP
  3. Dehisce

    Dehisce Peon

    Messages:
    234
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Thankfully I had a backup which I did last week so the website was back up and running within a few hours. I suspect this was caused by a joomla addon rather than joomla itself. Does this sound right?
     
    Dehisce, Nov 2, 2009 IP
  4. Dehisce

    Dehisce Peon

    Messages:
    234
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #4
    I don't suppose there is any way of tracing how this was done or even who did it.
     
    Dehisce, Nov 2, 2009 IP
  5. AKSIN

    AKSIN Peon

    Messages:
    159
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #5
    4. Check the permissions of the files and folders and make sure that you have assigned the permissions correctly. [/QUOTE]

    I want to know how can I change and secure the permissions in my htaccess
     
    AKSIN, Nov 3, 2009 IP
  6. SecureCP

    SecureCP Guest

    Messages:
    226
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #6
    changing permissions can be done with the chmod command. It would be in the following syntax via ssh, "chmod 644 filename" or "chmod 755 directory". Those are proper permissions, but you may want to find out if your host is running suphp/cgi first. Some directories may need 777, usually upload folders, etc...
     
    SecureCP, Nov 3, 2009 IP
  7. Hotger

    Hotger Greenhorn

    Messages:
    6
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    11
    #7
    You can check your server apache logs to find who and how it was did.
    Usually free open source scripts like Joomla with some plugins are very easy to hack. Their code is open and anyone can find a problem and use it.
     
    Hotger, Nov 3, 2009 IP
  8. SecureCP

    SecureCP Guest

    Messages:
    226
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #8
    also may want to check out /var/log/messages. You can find some useful information, mainly ftp logins, changes etc...
     
    SecureCP, Nov 3, 2009 IP
  9. SteveWh

    SteveWh Member

    Messages:
    74
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    48
    #9
    That can be the case. You can check for known vulnerabilities in Joomla and its addons at http://secunia.com/advisories/search/?search=joomla .
     
    SteveWh, Nov 13, 2009 IP