4

Just out of curiosity: Could a hacker write a script to brute-force the Joomla admin login by trying random usernames/passwords, or is there a limit as to how many times a user can try to log in?

I've seen plugins in the Joomla Extensions Directory that (among other functions) claim to protect your site from brute-force attacks. Is it necesary to use such an extension?

Improve this question
2
  • Digest Access Authentication may protect the admin page. Make strong passwords and change the password frequently.
    – Farahmand
    Aug 10 '14 at 12:28
  • There are also full extensions supporting firewalling features. E.g. IP address blocking, white/black-lists, etc.
    – Anibal
    Aug 10 '14 at 20:50
3

Any login page with a input field of 'userid" and "pass" can be brute forced if no other protection is applied. The same is the case with Joomla!.

You can use the plugin you stated to mitigate the attack, and also having a " strong " password can delay a brute force relatively indefinitely (till the attacker gives up).

Another option would be to add a captcha to the login form after a certain no. of failed login attempts(like google does).

You could also use CDN to add another layer of security against brute force, like CloudeFlare provides one for free.

Improve this answer
1

Seeing as you haven't specified a Joomla version, I will assume you are referring to Joomla 3.3.

Joomla 3.3 uses BCrypt to hash passwords, inlike Joomla 2.5 which used md5 + salt.

Here is a little nice snippet I found from yorickpeterse.com:

I'm not going to cover all the technical details but basically BCrypt requires you to specify a cost/workfactor in order to generate a password. This workfactor not only makes the entire process slower but is also used to generate the end hash. This means that if somebody were to change the workfactor the hash would also be different. In other words, hackers, you're f***ed. In order for a hacker to gain the original password he must use the same workfactor and thus has to wait N times longer than when not using a workfactor.

Therefore to answer your initial question, yes, it is probably possible to brute force, however it would take most likely years. Bcrypt is considered one of the most advances hashing techniques out there today.

You may also want to look at Joomla's built in Two Factor Autentication, which is an additional layer of security. Have a read of the following for more information:

http://www.dart-creations.com/joomla/joomla-tutorials/enabling-and-using-joomla-two-factor-authentication.html

Not additional 3rd party plugins are required.

Improve this answer
2
  • well, IMHO op is asking about the specific sites login page being brute forced by the attacker rather than the attacker obtaining the hash and brute forcing it to get the password.
    – Mohd Abdul Mujib
    Aug 10 '14 at 10:42
  • 1
    @wardha-Web - yeah good point. Anyway I've updated my answer with some info regarding TFA, which can be used. 3rd party plugins aren't really required
    – Lodder
    Aug 10 '14 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.