Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I run a small website on some Joomla 1.5 version. It appears that today it was hacked: The index.php and index2.php files were overwritten, the administrator account had its password changed, and the images folder contained a probably malicious executable file.

I was able to restore the index pages with a backup and reset the admin user with another privileged user account.

As I'm not that much of an expert in these things, my question is: How could this site have been infected? Like in: How was it possible to actually delete and replace certain files and store an executable in a folder. How could someone change the admin password, but leave the rest untouched?

(I am very aware of the importance of installing core version updates - I am more interested in how such an attack could have been executed.)

Thank you for any insightful answer.

share|improve this question
add comment

3 Answers 3

up vote 1 down vote accepted

There are several ways that an attacker could have gained access to the site. Here are some common possibilities:

  1. The attacker gained access to the server via FTP or some other availabe publication/admin channel. Perhaps there is a weak password and access was gained through a brute force attack, or maybe through social engineering, the password was obtained. Check the server's security log (though the attacker may have had access to delete the log).

  2. The web site may have XSS vulnerabilities or other code defects. For example, the code could be vulerable to SQL injection or PHP may be performing system calls formed with user data.

  3. Joomla may have known vulnerabilities. Make sure any security updates are applied.

Good luck!

share|improve this answer
add comment

You need to see your webserver logs. There you can find enough information about intrusion. It was hacked via web, and therefore all in apache (or another server which you use) logs

share|improve this answer
add comment

I've seen this a couple of times. It's not always possible to work out what has happened, but in several cases, a machine with the FTP details has been infected with some kind of malware/virus, that uses the FTP details to connect to the server and infect the machine.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.