1

My Joomla website was the victim of a hacker attack recently.

Hackers had access to my server and added some PHP files and mostly modified some index.php files. THe code is unfortunately ununderstandable to me and obviously too long to show here (if you want some specific file, please ask in comments). All variable and folder names were obfuscated.

Each time they do so, my host (1and1) will switch the chmod to 200 and my website will go offline.

Of course I changed all my passwords but in vain.

From the few things I got from the modified/added files, the hackers seems to be Russian/Ukrainian and they seems to point to games/pornsites, as these links were somewhere in the code (I wont post pornsite links):

http://mobjava.ru/uploads/posts/2012-07/1343378677_i.png
https://www.google.fr/search?q=%D0%A1%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20java%20%D0%B8%D0%B3%D1%80%D1%83%20Fishing%20Legend&oq=%D0%A1%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20java%20%D0%B8%D0%B3%D1%80%D1%83%20Fishing%20Legend&aqs=chrome..69i57.3693j0j7&sourceid=chrome&ie=UTF-8

One folder was once full of 2 551 files without extensions and containing simple HTML and which names are pinterest posts.

I understand I should get the help of a professionnal but for now I cannot afford it.

What I'd need to know to go on is :

  • Could the security hole come from Joomla itself ?
  • Else, could it come from my template (Purity III) or module ?
  • Else, is there some "easy" way to find it ?

Joomla version: Joomla! 3.8.5 Stable [ Amani ] 6-February-2018 15:00 GMT
PHP version: 5.6.33

closed as primarily opinion-based by Anders, schroeder Mar 6 '18 at 18:00

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Possible duplicate of How do I deal with a compromised server? – AndrolGenhald Mar 6 '18 at 17:34
  • @AndrolGenhald I've seen this post, it's a little overcomplicated for me. More, I'm using a CMS so this makes it somehow irrelevant. – dench Mar 6 '18 at 17:37
  • 1
    There's nothing magical about a CMS that makes any of that post irrelevant. Ignore reasonable advice at your & your customers' peril. – tjd Mar 6 '18 at 17:42
  • OK, you made a point for the second part of my previous coment. But still, I should magicaly understand what is beyond my comprehension ? – dench Mar 6 '18 at 17:43
  • 1
    While the title does not match the body, I'll answer the body questions. "How did the hackers hack my site?" We cannot tell you without extensive review of logs, files, and cooperation from your hosting company. Could it be from a vulnerability in the CMS itself? Yes. Could it be from a template or module? Yes. Is there some easy way to find it? Maybe, maybe not. You need to do a full code and forensic review. – schroeder Mar 6 '18 at 18:03