Take the 2-minute tour ×
Joomla Stack Exchange is a question and answer site for Joomla! administrators, users, developers and designers. It's 100% free, no registration required.

I have a Joomla 2.5 website. Yesterday I was not able to login administrator panel. I checked out users table. I was shocked when I saw that all the users' username field were 'admin' and passwords were '268e27056a3e52cf3755d193cbeb0594'. I generally do not use unfamous/unreliable third party extensions.

Is anyone here who has encountered the same issue? If yes, can you tell me what the reason is and what the solution is?

share|improve this question
3  
You might want to check the Joomla vulnerable extension list to see if any of your extensions are listed. –  moomoochoo Jun 16 at 10:13
add comment

4 Answers 4

What I recommend you do straight away is:

  1. Create a new installation of Joomla on a subdomain or localhost,
  2. Create a super user account with a strong password
  3. Copy the password hash from the #__users table from your newly created account and replace the old one.

I'm not sure how the hashes and usernames were changed but it could be down a few reasons. Always ensure you are running the latest version of Joomla and the latest version of extensions. There are quite a few extensions out there that makes sites vulnerable to SQL injections. I can't stress how important keeping things up to date is.

You might want to start considering migrating to Joomla 3.3 soon as possible, as this version provides one of the most secure password encryption methods (bcrypt).

And as @Brian has mentioned, updating your database password to something stronger is highly recommended. Another good thing to take into consideration is also changing your database table prefixes. A lot of Joomla sites use jos_ which you can change to something a bit more unique using an extension such as Admin Tools which was mentioned in the other answer

share|improve this answer
1  
I would add, change your database password to something stronger also. –  Brian Peat Jun 16 at 12:02
add comment

This can be something very frustrating, sometimes a site can not stay updated for various reasons, though for the best help, please include the full version, like 2.5.9 or something. If you have already removed extensions as a possibility then an older version of Joomla could be the reason.

We have seen something similar on our sites before, was it on a shared server? This can happen even in a clean site on a shared server, if one account on the shared server gets hit, it could compromise the entire server. There is not much you can do about it either, nothing Joomla has can prevent such an exploit and its one reason why shared hosts can be problematic. Though this depends on the host, ones like siteground or hostgator are pretty good at keeping their infrastructure intact.

So I would recommend doing a malware scan to see what it picks up, most likely if they hit your database like that then they have a lot of files injected. Its best to restore from backup in this case and update, then malware scan.

Also look into Admin tools by akeeba, it has some useful tools to secure your site.

share|improve this answer
add comment

To keep you website always secured, you need a strict security policy:

  1. Update Joomla to the latest version
  2. Use ONLY themes from well-known developers (no exceptions), AND update to the latest version
  3. Use ONLY extensions from well-known developers (no exceptions), AND update to the latest version
  4. Implement a security extension for Joomla Hardening (Akeeba Admin is a must, and it's free)

Please, check this security checklist:

Security Checklist/You have been hacked or defaced http://docs.joomla.org/Security_Checklist/You_have_been_hacked_or_defaced

A Safe route for disaster relief

a. save the configuration.php file and your images and personal files one by one, (not the folder as it may contain unwanted files) b. wipe the entire folder where Joomla! is installed c. upload a new clean full package latest version of joomla 1.5.x or Joomla 2.5.x, joomla 3.x (minus the install folder) d. reupload your configuration file & images. e. reupload or reinstall the latest versions of your extensions , templates (even better is to use original clean copies to ensure that the hacker/defacer did not leave any shell script files in your site) f. To do this will take your site off line for around 15 minutes. To track down your hacked/defaced html may take hours or even longer.

share|improve this answer
    
Note that only the paid version of Akeeba Admin Tools has the Web Application Firewall (WAF). –  Neil Robertson Jun 18 at 9:17
add comment

It appears that your website has been hacked.

Reasons for a Hacked Joomla Website

Some of the reasons hackers gain access to your website are:

  1. a third party extension with a vulnerability
  2. a Joomla vulnerability
  3. another account with a vulnerability on the same shared server
  4. poorly configured / maintained server / hosting environment
  5. compromised local computer which has website credentials stored on it
  6. weak password(s) cracked via brute force attacks

Using a minimal number of well supported third party extensions from reputable developers is good practice but remember also that you need to keep Joomla and third party extensions up to date so that vulnerabilities are patched before they can be exploited by hackers.

Solutions for a Hacked Joomla Website

  1. Restore from a clean backup. Update Joomla and all third party extensions to the latest versions. This is a good solution if you know when exactly the website was compromised but timing is hard to determine with any confidence.

  2. Wipe the website and rebuild from scratch using up to date versions of Joomla and third party extensions. This is not usually a practical solution because of the work involved but can provide a high degree of confidence that the infection is eradicated.

  3. Clean the website using the commercial myjoomla.com security tool or similar, restoring any changed core files back to the originals and reinstalling third party extensions as needed. Update Joomla and all third party extensions to the latest versions.

You should also update the Joomla, hosting and database passwords.

In practice, option 3 usually works well for me.

Consider improving the security of the website as per the official Security Checklist and "How to secure a new Joomla installation?"

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.