1

My Joomla website was the victim of a hacker attack recently.

Hackers had access to my server and added some PHP files and mostly modified some index.php files. THe code is unfortunately ununderstandable to me and obviously too long to show here (if you want some specific file, please ask in comments). All variable and folder names were obfuscated.

Each time they do so, my host (1and1) will switch the chmod to 200 and my website will go offline.

Of course I changed all my passwords but in vain.

From the few things I got from the modified/added files, the hackers seems to be Russian/Ukrainian and they seems to point to games/pornsites, as these links were somewhere in the code (I wont post pornsite links):

http://mobjava.ru/uploads/posts/2012-07/1343378677_i.png
https://www.google.fr/search?q=%D0%A1%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20java%20%D0%B8%D0%B3%D1%80%D1%83%20Fishing%20Legend&oq=%D0%A1%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20java%20%D0%B8%D0%B3%D1%80%D1%83%20Fishing%20Legend&aqs=chrome..69i57.3693j0j7&sourceid=chrome&ie=UTF-8

One folder was once full of 2 551 files without extensions and containing simple HTML and which names are pinterest posts.

I understand I should get the help of a professionnal but for now I cannot afford it.

What I'd need to know to go on is :

  • Could the security hole come from Joomla itself ?
  • Else, could it come from my template (Purity III) or module ?
  • Else, is there some "easy" way to find it ?

Joomla version: Joomla! 3.8.5 Stable [ Amani ] 6-February-2018 15:00 GMT
PHP version: 5.6.33

11
  • 1
    Possible duplicate of How do I deal with a compromised server? Commented Mar 6, 2018 at 17:34
  • @AndrolGenhald I've seen this post, it's a little overcomplicated for me. More, I'm using a CMS so this makes it somehow irrelevant.
    – dench
    Commented Mar 6, 2018 at 17:37
  • 1
    There's nothing magical about a CMS that makes any of that post irrelevant. Ignore reasonable advice at your & your customers' peril.
    – tjd
    Commented Mar 6, 2018 at 17:42
  • OK, you made a point for the second part of my previous coment. But still, I should magicaly understand what is beyond my comprehension ?
    – dench
    Commented Mar 6, 2018 at 17:43
  • 1
    While the title does not match the body, I'll answer the body questions. "How did the hackers hack my site?" We cannot tell you without extensive review of logs, files, and cooperation from your hosting company. Could it be from a vulnerability in the CMS itself? Yes. Could it be from a template or module? Yes. Is there some easy way to find it? Maybe, maybe not. You need to do a full code and forensic review.
    – schroeder
    Commented Mar 6, 2018 at 18:03

0

Browse other questions tagged .