Website Hacked

Hi, one of the websites that I look after (It is a CMS that I look after for my dad) has been hacked. I won't give you the URL as the Hosts are looking into it, so I don't want to bombard the URl with a load of IP addresses just yet.

I am pretty sure they got in via my CMS php code (Just based on the fact the passwords where all randomly generated numbers), which is Joomla.

This ever happen to anyone else? They also left a gmail email address as a calling card. Is there anyway I can use that to get thier detials?

Your hosts will be able to tell you which IP address they used to gain access and exactly what they did.

With a bit of luck it'll just be a dumb teenager whos using a exploit techinique he found on google. That way he'll of left a huge trail behind him.

Mostly I hear of PHPBB forum attacks but hardly ever come across Joomla ones.

You could try doing a search on Google using his gmail address to see if he's left his calling card elsewhere. If so then get in contact with those site owners and see what info they have on him. Perhaps if you get a group together and report him to the police.

bummer man... some people should just have their fingers smashed into fragments...

--Mike

Well the guy who hacked it is part of an iranian hacking syndicate, who hack websites and leave messages like "Iran has the right to nuclear power" and stuff about not respecting muslims...it was just a community noticeboard site that was hardly used.

I guess my website is a casualty of 'global terror' :(

They should hack someone that can actually do something about that if they want to get their message across.

Pretty pathetic.

php scripts can be tricky to secure. Learning php is fairly easy, and getting it to do useful stuff is also fairly easy. Doing it securely requires you to be a php language guru.

I just about gave up learning php because of the paranoid state of mind you need to maintain whilst writing code. As mentioned elsewhere on the board just recently, SubDreamer is a good CMS which AFAIK has only seen one hack attack (fixed within a few hours). It has a large following and the support you get from the SubDreamer forum is tremendous.

Sounds like he did you a favour if he left a calling card.

Some people go after these hackers and they shouldn't. These hackers are "the good guys"... you know? the same people who say "Hey you left your front door open."

It's a challenge for them, and lame security on your part. Consider it a favour and smarten up your security.

lol how can you consider destroying my website a favour? So hes what? Saving me from someone worse?

I would be very nervous using a CMS like PHPNuke, or something similiar. Most freeware CMS systems constantly have security problems. If you are keeping up with the newest patches daily, you are really in trouble.

You should code your own CMS... it is not that difficult.

This particular one (the iran has rights to nuclear power) has been going on for a few months now - probaby for at least 6 months. They basically are just defacers that move from site to site.

One of the hacking gathering points has been discussing this topic which may have been inflaming things.

Both my personal web site and the french official Blitz web site (see french flag at the top) have been recently hacked. They are using the CMS e107.
I think the reason is that we used a not up-to-date version of e107, which had some security holes.
So : bottom line -> always use the latest version of your favorite CMS!!

You can't even be close to serious. These are exactly the kinds of idiots who need to be found and arrested.

"Oh, there's a security hole in some software that I have installed on my web server? Yes, by all means, let me put my life on hold and patch that up for you right now! I had nothing else to do today - thank you, Mr Hacker!"

One other thing, if you installed your forum or CMS via cPanel/Fantastico, check that you're getting the latest version. Dataflame.co.uk have some particularly old versions of most every script they have available to auto-install.