The Joomla! Forum ™





Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 289 posts ]  Go to page 1, 2, 3, 4, 5 ... 10  Next
Author Message
PostPosted: Sun Jul 09, 2006 2:38 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Wed May 24, 2006 4:52 pm
Posts: 8
anyone know how this component was hacked?  Here are google results of other sites that have been hacked the same way: http://www.google.com/search?hl=en&lr=&q=irc.dal.nyet

Any info on this would be greatly appreciated!

MOD EDIT: Please see the link below for the post about the update.  -RobS
http://forum.joomla.org/index.php/topic,75390.msg402249.html#msg402249


Last edited by RobS on Wed Jul 19, 2006 7:47 pm, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Sun Jul 09, 2006 6:56 pm 
Joomla! Guru
Joomla! Guru

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 842
FYI:
Quote:
ExtCalendar Module for Mambo "mosConfig_absolute_path" File Inclusion Vulnerability
http://www.frsirt.com/english/advisories/2006/2711


edit: corrected url, don't know why last number was missing just by copy and paste ???

_________________
We may not be able to control the wind, but we can always adjust our sails


Last edited by friesengeist on Mon Jul 10, 2006 8:10 am, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Mon Jul 10, 2006 8:19 am 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Fri Aug 19, 2005 12:47 pm
Posts: 273
Any news from the developer?

_________________
Demetris Dimarelis
http://www.e-orama.com, Web Services & Internet Marketing in Greece & Albania


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Mon Jul 10, 2006 8:39 am 
User avatar
Joomla! Master
Joomla! Master

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 17321
Location: **Translation Matters**
THis issue has also been forwarded to the devs here.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 2.5: http://help.joomla.org/files/EN-GB_multilang_tutorial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group


Top
 Profile  
 
PostPosted: Mon Jul 10, 2006 12:48 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Thu Apr 20, 2006 2:13 pm
Posts: 10
A site that I built for a friend has just been hacked by someone claimed to necromance, they had basically replaced the configuration file with their own page. - I will look elsewhere but  I will trash the site and rebuild rather than recover and run the risk that something else is there.

I was puzzled how, but fortunatly I run a number of web logging progams which may reveal the route

They used a search via Yahoo to look for the string "Powered By ExtCalendar" that is the only page I can track.
My method was to note the timestamp of the file and compare to my logs, that was the only entry. The text left on the site was Turkish and lo and behold a visitor left a Tuirkish  IP and Hostname - not 100% sure where to go with this, but looks pretty convincing to me.

Any after a data of some stuff, its building a new site.

FYI
Joomla 1.0.10
Not sure on Ext Cal version
We have users on the site but no one is allowed to upload anything nor put entries into the calendar
Only user input  is via a message board to registered users, I have removed the contac form as personally I believe there is a security issue with that (previously posted)


Top
 Profile  
 
PostPosted: Mon Jul 10, 2006 12:52 pm 
User avatar
Joomla! Ace
Joomla! Ace

Joined: Mon Dec 05, 2005 10:17 am
Posts: 1367
Location: New Orleans, LA, USA
Toemik, could you please PM me the relevant log information for review.  Please don't publish it here.

_________________
Rob Schley - Open Source Matters
Webimagery - http://www.webimagery.net/ - Professional Consulting Services
JXtended - http://www.jxtended.com/ - Free and Commercial Joomla! Extensions


Top
 Profile  
 
PostPosted: Mon Jul 10, 2006 1:26 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Thu Apr 20, 2006 2:13 pm
Posts: 10
sent va conact on your website


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Mon Jul 10, 2006 1:27 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Wed Dec 14, 2005 8:38 pm
Posts: 5
2 of my joomla sites were recently hacked via extcal2. Looks like some sort of code injection which allows modification of configuration.php???

Luckily I have regular site/db backups so just gotta delete/restore (and remove extcal I guess  >:( )

Dunno if its any use but some bits of the apache log relating to the hack (my site replaced with zzzzzz):



REMOVED FOR SECURITY.
Please do not post these calls publicly.


Last edited by nathandiehl on Mon Jul 10, 2006 1:29 pm, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Mon Jul 10, 2006 1:29 pm 
User avatar
Joomla! Champion
Joomla! Champion

Joined: Fri Aug 19, 2005 3:03 pm
Posts: 6046
Location: Indiana, USA
FYI,

ExtCal2 hasn't been developed in like 2 years. i wasn't expecting it to be ported to 1.5 anyway, so i am going to switch calendars.

and i got hacked, too. The hack was 6 server calls in a matter of 26 seconds, so it certainly seems to be automated, and probably widespread.

also FYI,
the root index.php file was replaced, but the fix was simply to re-upload a new index.php file (from a new install).

_________________
If you're new to Joomla, Please read Anna's Joomla! Tips: viewtopic.php?t=5503

http://nathandiehl.com | Find out what makes me tick


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Mon Jul 10, 2006 2:11 pm 
User avatar
Joomla! Master
Joomla! Master

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 17321
Location: **Translation Matters**
We are expecting a fix for ext_calendar as the developper is no more active.
We will post here.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 2.5: http://help.joomla.org/files/EN-GB_multilang_tutorial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Mon Jul 10, 2006 3:00 pm 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Fri Aug 19, 2005 7:39 am
Posts: 63
Put the

defined('_VALID_MOS') or die('Direct Access to this location is not allowed.');

on the top of extcalendar.php..

It is a high level risk hole.

_________________
http://www.bestofjoomla.com


Last edited by danialt on Mon Jul 10, 2006 3:02 pm, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Mon Jul 10, 2006 3:02 pm 
User avatar
Joomla! Ace
Joomla! Ace

Joined: Mon Dec 05, 2005 10:17 am
Posts: 1367
Location: New Orleans, LA, USA
From the information I have received about the com_extcalendar (com_extcal2) vulnerabilities, there are currently two flavors of the exploit circling around.  To make matters worse, this component is no longer actively developed hence we don't expect a proper patch to come around soon enough to be effective so I can only recommend that you migrate to a newer/more actively developed calendar component.  For those that need time to do this type of thing, I have added another mod_rewrite condition to the ruleset I have been developing that will hopefully address the exploits that are going around (one version was actually already blocked by my mod_rewrite rule set, I like good surprises!)

If you would like to go this route, you can find the mod_rewrite rules in this thread http://forum.joomla.org/index.php/topic,75376.0.html 

Also, Elpie noticed that the vulnerability is caused by a lack of valid component checking that all Joomla files are supposed to do before they execute any code.  The code below should be in every 3rd party component file.

Code:
// no direct access
defined( '_VALID_MOS' ) or die( 'Restricted access' );


Another option for those of you that need time to migrate away from com_extCalender would be to manually insert those two lines of code toward the top (but underneat the first comment chunk that starts with /* and ends with */ ) of all the files that were installed by com_extCalender in the /path/to/Joomla/components/com_extcalender/ and /path/to/Joomla/administrator/components/com_extcalender/ directories.  That will be a rather labor intensive project though because there are quite a few files and I cannot guarantee that addition will fix the problem all together.

_________________
Rob Schley - Open Source Matters
Webimagery - http://www.webimagery.net/ - Professional Consulting Services
JXtended - http://www.jxtended.com/ - Free and Commercial Joomla! Extensions


Last edited by RobS on Mon Jul 10, 2006 3:05 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Mon Jul 10, 2006 3:16 pm 
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Mon Apr 17, 2006 10:03 pm
Posts: 111
I have had a similar experience with a site that was hacked and defaced. It seems it was hacked via extcalendar.


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Mon Jul 10, 2006 3:35 pm 
User avatar
Joomla! Champion
Joomla! Champion

Joined: Fri Aug 19, 2005 3:03 pm
Posts: 6046
Location: Indiana, USA
MOD NOTE: EXT Threads merged.
Please look for an existing thread before starting a new thread. Thanks!

_________________
If you're new to Joomla, Please read Anna's Joomla! Tips: viewtopic.php?t=5503

http://nathandiehl.com | Find out what makes me tick


Top
 Profile  
 
PostPosted: Mon Jul 10, 2006 5:15 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Fri Aug 19, 2005 12:47 pm
Posts: 273
RobS wrote:
Toemik, could you please PM me the relevant log information for review.  Please don't publish it here.


I sended logfiles

_________________
Demetris Dimarelis
http://www.e-orama.com, Web Services & Internet Marketing in Greece & Albania


Last edited by albi on Mon Jul 10, 2006 7:10 pm, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Mon Jul 10, 2006 9:14 pm 
User avatar
Joomla! Ace
Joomla! Ace

Joined: Mon Dec 05, 2005 10:17 am
Posts: 1367
Location: New Orleans, LA, USA
That email address is not valid anymore.  I have PMed you a new one.

_________________
Rob Schley - Open Source Matters
Webimagery - http://www.webimagery.net/ - Professional Consulting Services
JXtended - http://www.jxtended.com/ - Free and Commercial Joomla! Extensions


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 12:11 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Thu May 11, 2006 10:34 pm
Posts: 45
My version of extCalendar2 has a simliar "// no direct access
defined( '_VALID_MOS' ) or die( 'Restricted access' );
" statement in the file. 

What file has the "Powered by extCalendar" text?  I can't find it and at least thought I should delete that reference.

Anyone know of a good calendaring program to change over to?


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 12:22 am 
User avatar
Joomla! Ace
Joomla! Ace

Joined: Mon Dec 05, 2005 10:17 am
Posts: 1367
Location: New Orleans, LA, USA
Which file are you referring to?  The component installs quite a few files.

_________________
Rob Schley - Open Source Matters
Webimagery - http://www.webimagery.net/ - Professional Consulting Services
JXtended - http://www.jxtended.com/ - Free and Commercial Joomla! Extensions


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 1:53 am 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Mon Sep 19, 2005 6:29 pm
Posts: 177
Location: Lake Norman, North Carolina, USA
If extcalendar is dying out, will anyone be creating a com for a new calendar interface???  Would really like to have one up and running.  So far I've been lucky and I think it's mainly because I'm on VPS, but others hosted by the same company on shared servers have been hacked via extcalendar, at least thats what they think was the point of entry.


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 2:12 am 
User avatar
Joomla! Ace
Joomla! Ace

Joined: Mon Dec 05, 2005 10:17 am
Posts: 1367
Location: New Orleans, LA, USA
There is a com_events and another calender that I have heard will be released tomorrow so stay tuned to the Extensions page and check that out. 

_________________
Rob Schley - Open Source Matters
Webimagery - http://www.webimagery.net/ - Professional Consulting Services
JXtended - http://www.jxtended.com/ - Free and Commercial Joomla! Extensions


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 2:22 am 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Tue Aug 30, 2005 8:05 am
Posts: 53
Location: Virginia
From what I've read, the exploit was posted online on Friday July 7th and the hack attacks began on Saturday the 8th.  The hackers didn't seem to replace the index.php, they modified configuration.php.  Seemed like two different hackers, however, one from Indonesia that posted a green "hacked" graphic with an "I'll be back" message, and one from Turkey (with some military type graphic and a musical background).  Fortunately, they didn't damage any data, the database is still intact, it seemed like the access was limited to the equivalent of [drive] graffiti.  But I spent about 24 hours over the weekend patching and upgrading and replacing stuff because of these creeps.

I saw a calendar component today called Thyme that appears to be ported for Joomla.  Anyone have experience with it?  I'm running news and information sites, we HAVE to have an events calendar.  Never dreamed something like this would happen, especially since I'd upgraded to 1.10 in Joomla.  Just goes to show, it can happen anytime, anywhere.

Anyone in favor of promoting some sort of severe penalty for hackers, like the amputation of a hand or something? 


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 2:33 am 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Mon Sep 19, 2005 6:29 pm
Posts: 177
Location: Lake Norman, North Carolina, USA
I asked the question before doing the research and found at least three or four components/mods for calendar functions, however I'm going to wait and see how the upgrades go for these new issues.  I've still got extcalendar running fine for now.


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 4:57 am 
User avatar
Joomla! Guru
Joomla! Guru

Joined: Sun Aug 21, 2005 8:46 am
Posts: 575
Location: Perth, Western Australia
Yes I had a visit on one of my sites, however, could only see the alteration to the component file and an additional html file installed in site root. Checked config file, no changes there. Have uninstalled calendar as well as associated mods, will await to see new replacements.

_________________
Joomla! - enjoying every minute of the journey!


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 6:23 am 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Sat Aug 20, 2005 1:44 pm
Posts: 324
Location: Melbourne, Australia
Hi
Consolation for me, I am not alone.
Right midnight my site was hacked in front of me! They changed the admin password, and then dont know what did.
I had to request a site restore to my hosting, (I dont have the privilegde.)

Who can I blame!

alamgir

_________________
www.apona-bd.com Bangla OCR and other software.
www.joomla.org.bd Bangla Joomla Site


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 9:22 am 
Joomla! Explorer
Joomla! Explorer

Joined: Mon Sep 05, 2005 3:50 pm
Posts: 251
Has anyone tried Events Calendar? There's a fairly recent beta release.

david


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 11:00 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Thu Apr 20, 2006 2:13 pm
Posts: 10
HI RobS
Would like to PM the IP etc but unable to

You are not allowed to send personal messages

Am I missing a trick here on how to PMS


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 11:47 am 
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Sun Mar 12, 2006 7:11 pm
Posts: 160
Is there a new secure version of ExtCalender we can use?


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 12:20 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Tue May 23, 2006 3:33 pm
Posts: 34
// no direct access
defined( '_VALID_MOS' ) or die( 'Restricted access' );

insert this in extcal.php  as far as i read this fiexes the problem? RIGHT?


Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 12:22 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Fri Aug 19, 2005 12:47 pm
Posts: 273
Floranett wrote:
Is there a new secure version of ExtCalender we can use?


http://extensions.joomla.org/component/ ... Itemid,35/

_________________
Demetris Dimarelis
http://www.e-orama.com, Web Services & Internet Marketing in Greece & Albania


Last edited by albi on Tue Jul 11, 2006 12:26 pm, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: ExtCalendar
PostPosted: Tue Jul 11, 2006 12:27 pm 
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Sun Mar 12, 2006 7:11 pm
Posts: 160
albi wrote:
Floranett wrote:
Is there a new secure version of ExtCalender we can use?
Mod. note: Fixed end quote tag -RobS

http://extensions.joomla.org/component/ ... Itemid,35/


Thanks alot albi m8, but can this be used with Mambo 4.5.3?  :)


Last edited by RobS on Thu Jul 13, 2006 9:06 am, edited 1 time in total.

Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 289 posts ]  Go to page 1, 2, 3, 4, 5 ... 10  Next



Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group