4

I have a serious issue here. Someone is trying Brute force login into my site. I already have plugins to nullify that attack. I give only 3 attempts for login and then it blocks that IP. Problem here is that he has used 1000 different IP's to login into administrator account.

It's a kind of DDoS attack. What is the best solution for this? My site is made with Joomla 3 CMS. Also I am not a security expert.

And in addition, recently I found out that there was a malicious file upload but luckily that was neutralised by a plugin I am using.

UPDATE:

I found something surprising. When i was attacked initially with malicious file upload my robots.txt was deleted by them. I was able to stop further upload by modifying .htaccess file but i failed to notice that robots.txt is missing. I think this gave free path to all robots. I am still on the job and searching other loopholes.

  • How did the attacker manage to upload files ? That should be your main concern, and posting that info here would be very important. – SantiBailors Jul 28 '16 at 8:30
  • There are basically three components that have forms in my site. One is the registration and login component, File download Codeseller component and the other kunena forum posts. I will go through complete details again, including code verification and in few hours I will give all the details. – Amit Ray Jul 28 '16 at 8:35
  • If you already know that your site allows users to upload files, then you already know in all likelihood how he/she uploaded the file. Only if your site doesn't allow users to upload files should you be concerned about how he/she did it, because one possibility would be that he/she cracked your FTP access to the web server. – SantiBailors Jul 28 '16 at 8:39
  • @SantiBailors I feel one of the component I am using is vulnerable. Though I give user only download access but hackers found out way to upload from frontend. I have taken down my site for now and will make it live after a thorough investigation. – Amit Ray Jul 28 '16 at 8:45
  • Try CloudFlare, the free service works sufficiently. – stemie Jul 28 '16 at 18:19
4

All the answers suggested I would do as well. If you want another level of security I would enable Apache Basic Authentication

http://httpd.apache.org/docs/current/howto/auth.html

with a username/password on your admin URL within Joomla (make sure that this URL is https accessible only). This is done within your httpd.conf file whereby you generate a password encrypted file which is compared to the username/password credentials when the URL pattern match is accessed.

This way the attacker needs to also know the Apache protected URL username/password before attempting a brute force attack. Apache will dismiss all requests with an "Authorization required" message and protect your joomla instance from being bombarded.

In my opinion, your admin URL path should never be exposed to the internet without some additional protection.

  • Thanks for the sugestion. Actually I already have that safety factor. No one can reach my site directly using example.com/administrator. In fact they can reach only through this link example.com/administrator/index.php?something=somesecretcode. Still they are able to breach my site security. Thanks for that Apache Basic Authentication, I will try to implement that and check. – Amit Ray Jul 29 '16 at 6:16
  • Apache Basic authentication will fix it - you can pattern match the URL so whatever combination of ..../administrator* in the pattern match will force apache to authorize the content. – Rob Mascaro Jul 29 '16 at 6:21
3

So, it's the same old story.

But, first, there are few things to do:

Firstly, scan your site with some antivirus tool. Then do this:

  1. Upgrade all components/plugins
  2. Upgrade your Joomla on latest version
  3. Limit the upload of files only to allowed extensions (e.g. .pdf, .doc, .docx)
  4. Maybe put some additional stuff before upload (let's say captcha or some question that needs an answer in order to upload the file.)
  5. Change your password

//If your component is compromised, try to look up for another option. There's a plenty of components that are doing the same thing.

In addition, there's one cool online tool that can help you here.

Compromised sites will often be linked to malicious JavaScript in an attempt to attack users of your Joomla installation.

  • 1
    Thanks @Josip Ivic but I have already done what you recommended except the Joomla update part. I downloaded the file fpa-en which joomla recommends in its forum and did a scan. Everything was green. I am checking the code for any loophole. I already edited .htaccess file to stop upload of any file even jpg, png etc from frontend. I only allow download. – Amit Ray Jul 28 '16 at 9:28
  • 1
    Joomla update is crucial, because every new version has some new fixtures. – Josip Ivic Jul 28 '16 at 9:32
  • Its joomla 3.4 but there was no security update after that. Anyways I have updated it now but I still feel I need to check 3rd party extensions that I am using. – Amit Ray Jul 28 '16 at 9:35
  • 1
    Yes you need. Also, scan the whole site. – Josip Ivic Jul 28 '16 at 9:39
  • Also maybe do a diff between your files and the default installation to see if they managed to alter any core code. – Buttle Butkus Jul 28 '16 at 18:07
2

I suggest you scan your whole server to find malicious files inside.

For the site's security, I think you already use Akeeba Admin Tools. If you do then change the administrator url with some random characters. With that way, the brute forces attack will fail even before they reach the login page.

Other then that, you better change all the passwords including ftp,joomla admin account and root accounts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.