After several infections on Joomla we have decided to change to static content (it will require less administration time, and we just change one page per day).
However, we would like to know how Joomla could be attacked so easily. Here I will explain a summary of the changes we unsuccessfully did.
NOTE: we already checked basics and read many Joomla community followers defending its safety.
Is there an easy way to have Joomla really safe from attack penetrations? Any way to know for sure which the last vulnerability was? provided that we improve the installation infection after infection until we have something really lasting.
Please, we are not asking for basics. There is a lot of information over there (repeating information). The installed plugins were minimum, popular and maintained.
We began with a Spanish adapted version 2.5.X . First problems arouse (infections) because update dependencies with that distro would not allow an update from the main source of Joomla. The installed version was 2.5.9 and it was already released the version 2.5.28
NOTE: first infections seemed to come from the template ('seemed', because I am not an expert of Joomla).
After getting a proper update to 2.5.28 (last version for 2.5), it was infected again. So we updated to 3.X last version with PDO, preserving only the template (made time before with a free version of some software to make Joomla and Wordpress templates), and installing plugins available for 3.X PDO.
The week that 3.4 was released (if I remember well), it got infected again. This was the drop that spilled the glass. After restoring the backup and updating to the last version, it were added some functionalities such as, double password for the administrator, admin panel forced by https and cached webpages to reduce probability to get infected (I do not know if this last strategy is really effective).
In fact, we wanted to generate a completely static webpage extracting it from Joomla configuration, but I did not find any tool to do so (generate static content from the Admin Panel after every change, and never allow dynamic content to be executed, except for the administration panel)... Finally I installed a cache component (with the limitations it entails in that sense).
Last two infections were in two weeks of difference. At the second one, spam was sent by using email@example.com (with sendmail, not with authenticated email addresses). So they figured out the apache user and owner of the files at infected-domain.tld . The mail logs increased so significantly that the server went out of disk memory. The server configuration to reject sendmail for forged source email accounts did not work (look here, first answer, to know how header_checks was configured)
We guess that the problem comes from the template. But, how to be sure of that. Every time there is an infection, how can you know where it started? which was the source of the problem? It is like going blind. You just can try some basics to make it safer and hope for updates solving it.