10

I have a Joomla 2.5 website. Yesterday I was not able to login administrator panel. I checked out users table. I was shocked when I saw that all the users' username field were 'admin' and passwords were '268e27056a3e52cf3755d193cbeb0594'. I generally do not use unfamous/unreliable third party extensions.

Is anyone here who has encountered the same issue? If yes, can you tell me what the reason is and what the solution is?

Improve this question
1

5 Answers 5

Reset to default
9

To keep you website always secured, you need a strict security policy:

  1. Update Joomla to the latest version
  2. Use ONLY themes from well-known developers (no exceptions), AND update to the latest version
  3. Use ONLY extensions from well-known developers (no exceptions), AND update to the latest version
  4. Implement a security extension for Joomla Hardening (Akeeba Admin is a must, and it's free)

Please, check this security checklist:

Security Checklist/You have been hacked or defaced http://docs.joomla.org/Security_Checklist/You_have_been_hacked_or_defaced

A Safe route for disaster relief

a. save the configuration.php file and your images and personal files one by one, (not the folder as it may contain unwanted files) b. wipe the entire folder where Joomla! is installed c. upload a new clean full package latest version of joomla 1.5.x or Joomla 2.5.x, joomla 3.x (minus the install folder) d. reupload your configuration file & images. e. reupload or reinstall the latest versions of your extensions , templates (even better is to use original clean copies to ensure that the hacker/defacer did not leave any shell script files in your site) f. To do this will take your site off line for around 15 minutes. To track down your hacked/defaced html may take hours or even longer.

Improve this answer
1
  • 1
    Note that only the paid version of Akeeba Admin Tools has the Web Application Firewall (WAF).
    – Neil Robertson
    Jun 18, 2014 at 9:17
8

What I recommend you do straight away is:

  1. Create a new installation of Joomla on a subdomain or localhost,
  2. Create a super user account with a strong password
  3. Copy the password hash from the #__users table from your newly created account and replace the old one.

I'm not sure how the hashes and usernames were changed but it could be down a few reasons. Always ensure you are running the latest version of Joomla and the latest version of extensions. There are quite a few extensions out there that makes sites vulnerable to SQL injections. I can't stress how important keeping things up to date is.

You might want to start considering migrating to Joomla 3.3 soon as possible, as this version provides one of the most secure password encryption methods (bcrypt).

And as @Brian has mentioned, updating your database password to something stronger is highly recommended. Another good thing to take into consideration is also changing your database table prefixes. A lot of Joomla sites use jos_ which you can change to something a bit more unique using an extension such as Admin Tools which was mentioned in the other answer

Improve this answer
1
  • 2
    I would add, change your database password to something stronger also.
    – Brian Peat
    Jun 16, 2014 at 12:02
6

This can be something very frustrating, sometimes a site can not stay updated for various reasons, though for the best help, please include the full version, like 2.5.9 or something. If you have already removed extensions as a possibility then an older version of Joomla could be the reason.

We have seen something similar on our sites before, was it on a shared server? This can happen even in a clean site on a shared server, if one account on the shared server gets hit, it could compromise the entire server. There is not much you can do about it either, nothing Joomla has can prevent such an exploit and its one reason why shared hosts can be problematic. Though this depends on the host, ones like siteground or hostgator are pretty good at keeping their infrastructure intact.

So I would recommend doing a malware scan to see what it picks up, most likely if they hit your database like that then they have a lot of files injected. Its best to restore from backup in this case and update, then malware scan.

Also look into Admin tools by akeeba, it has some useful tools to secure your site.

Improve this answer
4

It appears that your website has been hacked.

Reasons for a Hacked Joomla Website

Some of the reasons hackers gain access to your website are:

  1. a third party extension with a vulnerability
  2. a Joomla vulnerability
  3. another account with a vulnerability on the same shared server
  4. poorly configured / maintained server / hosting environment
  5. compromised local computer which has website credentials stored on it
  6. weak password(s) cracked via brute force attacks

Using a minimal number of well supported third party extensions from reputable developers is good practice but remember also that you need to keep Joomla and third party extensions up to date so that vulnerabilities are patched before they can be exploited by hackers.

Solutions for a Hacked Joomla Website

  1. Restore from a clean backup. Update Joomla and all third party extensions to the latest versions. This is a good solution if you know when exactly the website was compromised but timing is hard to determine with any confidence.

  2. Wipe the website and rebuild from scratch using up to date versions of Joomla and third party extensions. This is not usually a practical solution because of the work involved but can provide a high degree of confidence that the infection is eradicated.

  3. Clean the website using the commercial https://mysites.guru (formerly myjoomla.com) security tool or similar, restoring any changed core files back to the originals, removing malware and reinstalling third party extensions as needed. Update Joomla and all third party extensions to the latest versions.

You should also update the Joomla, hosting and database passwords.

In practice, option 3 usually works well for me.

Consider improving the security of the website as per the official Security Checklist and "How to secure a new Joomla installation?"

Improve this answer
3

Today I have encountered same problem again. It is not joomla or its extensions. It is because I have set all the files and directories' CHMOD to 775. I have done it just to update joomla easier.

After reading http://www.itoctopus.com/the-mass-username-password-update-hack-in-joomla, I have looked at the change dates of directories and investigate ones which have different values.

I use WinSCP for FTP access. I have seen 5 .php files with shortcut icon which I cannot open to view their contents.

  1. Settings.php
  2. e107_config.php
  3. config.php
  4. conf_global.php
  5. wp-config.php

and also in includes directory

  1. config.php
  2. configure.php

I have deleted them and restore the web sites from backup. And I promise, I will not give write access for www-data group except images directory.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.