How could this site have been infected?

Question

I run a small website on some Joomla 1.5 version. It appears that today it was hacked: The index.php and index2.php files were overwritten, the administrator account had its password changed, and the images folder contained a probably malicious executable file.

I was able to restore the index pages with a backup and reset the admin user with another privileged user account.

As I'm not that much of an expert in these things, my question is: How could this site have been infected? Like in: How was it possible to actually delete and replace certain files and store an executable in a folder. How could someone change the admin password, but leave the rest untouched?

(I am very aware of the importance of installing core version updates - I am more interested in how such an attack could have been executed.)

Thank you for any insightful answer.

Answer 1

There are several ways that an attacker could have gained access to the site. Here are some common possibilities:

1. The attacker gained access to the server via FTP or some other availabe publication/admin channel. Perhaps there is a weak password and access was gained through a brute force attack, or maybe through social engineering, the password was obtained. Check the server's security log (though the attacker may have had access to delete the log).

2. The web site may have XSS vulnerabilities or other code defects. For example, the code could be vulerable to SQL injection or PHP may be performing system calls formed with user data.

3. Joomla may have known vulnerabilities. Make sure any security updates are applied.

Good luck!

Answer 2

You need to see your webserver logs. There you can find enough information about intrusion. It was hacked via web, and therefore all in apache (or another server which you use) logs

Answer 3

I've seen this a couple of times. It's not always possible to work out what has happened, but in several cases, a machine with the FTP details has been infected with some kind of malware/virus, that uses the FTP details to connect to the server and infect the machine.