Joomla! Discussion Forums



It is currently Sun Nov 22, 2009 3:33 am (All times are UTC )

 


Forum rules

READ ME <-- please read before posting, this means YOU.



Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 195 posts ]  Go to page Previous  1, 2, 3, 4, 5, 6, 7  Next
Author Message
 Post subject: Re: joomla.org hacked?
Posted: Sat Aug 18, 2007 2:10 pm 
User avatar
Joomla! Explorer
Joomla! Explorer
Offline

Joined: Thu Aug 25, 2005 3:29 pm
Posts: 347
Location: Adelaide, South Australia
It would be far too soon to jump to such a wild conjecture at this time.

I have every faith in the Team telling us the full story once they have cleared everything up and found out for themselves just what happened. Be patient, many of us are waiting for some news.

_________________
Cheers, Ian
"Always remember. Love is the purest feeling, the wisest thought and the strongest reason. Always!"
by Sea-Life
Do Not PM me looking for Help! Un-requested Help PM's will be Deleted Unread, and your ID added to my Ignore List


Top
   
 
 Post subject: Re: joomla.org hacked?
Posted: Sat Aug 18, 2007 2:14 pm 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 11653
Location: **Translation Matters**
A search in Google shows it could be linked to a 3pd extension.

Investigations going on.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr · GMT +1
Qui vult dare parva non debet magna rogare.
---------------------------------
Joomla! Translation Coordination Team


Top
  E-mail  
 
 Post subject: Re: Joomla.org Hacked
Posted: Sat Aug 18, 2007 2:17 pm 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 11653
Location: **Translation Matters**
Merging threads.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr · GMT +1
Qui vult dare parva non debet magna rogare.
---------------------------------
Joomla! Translation Coordination Team


Top
  E-mail  
 
 Post subject: Re: Joomla.org hacked???
Posted: Sat Aug 18, 2007 2:24 pm 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Thu Aug 18, 2005 8:55 pm
Posts: 12894
Location: Nijmegen, The Netherlands
[MOD note: hacker reference removed, no need to encourage script kiddies]

_________________
Kind Regards,
Peter Martin, Global Moderator - Community & Leadership Team
www.db8.nl - Joomla specialist, Nijmegen, Nederland
Joomla 1.5 Quick Reference Guide: www.db8.nl/en/downloads/misc-downloads/ ... glish.html


Top
   
 
 Post subject: Re: Joomla.org hacked???
Posted: Sat Aug 18, 2007 2:25 pm 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 11653
Location: **Translation Matters**
Merging all these threads.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr · GMT +1
Qui vult dare parva non debet magna rogare.
---------------------------------
Joomla! Translation Coordination Team


Top
  E-mail  
 
 Post subject: Re: joomla.org hacked?
Posted: Sat Aug 18, 2007 2:25 pm 
User avatar
Joomla! Exemplar
Joomla! Exemplar
Offline

Joined: Thu Aug 18, 2005 9:58 am
Posts: 8099
Location: Hillerød - Denmark
delrica wrote:
How do I download 1.5 if I can't access it through the front page?

All downloads can be found here:
http://joomlacode.org/gf/project/joomla/frs/

_________________
Ole Bang Ottosen - Joomla! Translation Coordination Team
Joomla Leadership Team - Production Working Group - i18n/l10n/translation

Webløsninger og professionel support http://www.ot2sen.dk | Dansk Joomla! support - http://joomla.dk/


Top
  E-mail  
 
 Post subject: Re: joomla.org hacked?
Posted: Sat Aug 18, 2007 2:28 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Oct 10, 2005 1:46 pm
Posts: 46
Thank you!


Top
  E-mail  
 
Posted: Sat Aug 18, 2007 2:35 pm 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 11653
Location: **Translation Matters**
Merrging all cracker's related topics on shop and main site.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr · GMT +1
Qui vult dare parva non debet magna rogare.
---------------------------------
Joomla! Translation Coordination Team


Top
  E-mail  
 
Posted: Sat Aug 18, 2007 3:07 pm 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 11653
Location: **Translation Matters**
Shop and main are back online atm.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr · GMT +1
Qui vult dare parva non debet magna rogare.
---------------------------------
Joomla! Translation Coordination Team


Top
  E-mail  
 
Posted: Sat Aug 18, 2007 3:10 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Tue Apr 11, 2006 7:29 pm
Posts: 724
Looks like cracking happens to the best of us :(

You can never be safe enough, I guess the best solution is to always keep fully updated backups!

_________________
http://www.dart-creations.com - We make Joomla Easy: Tutorials, Tips and Tricks, Lots of Free Modules incl. Featured Articles, Popin Window, Visitors Map, Random Flash, Slide Menu (dropdown), 2CO / Paypal payment, YouTube module, and more!


Last edited by dattard on Sat Aug 18, 2007 6:04 pm, edited 1 time in total.

Top
  E-mail  
 
Posted: Sat Aug 18, 2007 3:12 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Wed Nov 09, 2005 4:25 am
Posts: 13
Nice to see Joomla is back on-line.

Very curious to see what the whole story was, what exploit was used and how they cleaned the site up.

The same scumbag script kiddy took down one of my sites running an old version of Mambo and I had to rebuild the site from scratch after manually editing the SQL data I recovered.

It took me a lot longer that it took the Joomla Admin(s)!  :)


Top
   
 
Posted: Sat Aug 18, 2007 3:26 pm 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 11653
Location: **Translation Matters**
As soon as full investigation has been done, results will be posted here.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr · GMT +1
Qui vult dare parva non debet magna rogare.
---------------------------------
Joomla! Translation Coordination Team


Top
  E-mail  
 
Posted: Sat Aug 18, 2007 3:44 pm 
User avatar
Joomla! Explorer
Joomla! Explorer
Offline

Joined: Thu Nov 09, 2006 5:56 pm
Posts: 312
i looked at the image file they have put,
it had the same name as joomla image name at images
directory. The output under image was normal joomla message from the configuration file.
It seemed to be seen as attack to webserver files images directory rather than file system including root directory.
Perhaps supported by many DoS to show their image file.

_________________
Generaldots.com


Top
  E-mail  
 
Posted: Sat Aug 18, 2007 4:04 pm 
User avatar
Joomla! Explorer
Joomla! Explorer
Offline

Joined: Thu Nov 09, 2006 5:56 pm
Posts: 312
sonvurus  means latest impact or latest hit in English
but i want to learn that why hacker has choosen joomla official site to hack?

Many [edit mod] people earn money from joomla.
Why didn"t he/she choosed [edit mod]joomla made sites instead of joomla official site?????????????

[Moderator note; this is an English board, non-English test removed]

_________________
Generaldots.com


Last edited by infograf768 on Sat Nov 10, 2007 5:07 pm, edited 1 time in total.

Top
  E-mail  
 
Posted: Sat Aug 18, 2007 4:12 pm 
User avatar
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Wed Aug 15, 2007 5:33 pm
Posts: 2
Location: Nabai
i saw it too, i wonder what should i do if i have multiple sites... i cant just stit and worried..  :'(  :pop :o


Top
  E-mail  
 
Posted: Sat Aug 18, 2007 4:18 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Thu Jun 29, 2006 11:55 am
Posts: 17
How silly to censor this thread and edit posts.

As if it wouldn't be all over the net already anyway...

If you want an unmoderated, uncensored discussion, better go here:

http://www.simplemachines.org/community ... c=189604.0

"Don't give them credit!" - what a stupid, stupid reason.  ;)

You guys really make a fool of yourself...  o.O


Last edited by stokedfish on Sat Aug 18, 2007 4:21 pm, edited 1 time in total.

Top
  E-mail  
 
Posted: Sat Aug 18, 2007 4:30 pm 
User avatar
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Wed Aug 15, 2007 5:33 pm
Posts: 2
Location: Nabai
i think their intention is nice  :-\ as long as they haven't fix this thing yet.. we shouldn't expose much about it unnecessarily, since these could attract more attackers to other joomla based sites..  :'( but i believe it would be fixed in no time.. OH... where's Superman when u need one?  :'(


Top
  E-mail  
 
 Post subject: Re: joomla.org hacked?
Posted: Sat Aug 18, 2007 4:45 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Thu Jul 26, 2007 3:13 pm
Posts: 21
MMMedia wrote:
This is a Sites and Infrastructure issue.  I am going to move this post to that forum. 

Please do not post screen shots and give advertising to the hackers, why anyone would want to give advertising to any person, group etc that hacks other's sites is beyond me and is so unbelievably rude and inconsiderate.

I don't think so, it isn't Infrastructure issue for my personal opinion, a lot of Joomla! 1.0.13 sites has been hacked, all joomla's site are in the same server?


Last edited by vistartony on Sat Aug 18, 2007 4:47 pm, edited 1 time in total.

Top
   
 
Posted: Sat Aug 18, 2007 4:47 pm 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 11653
Location: **Translation Matters**
stokedfish wrote:
How silly to censor this thread and edit posts.

As if it wouldn't be all over the net already anyway...

If you want an unmoderated, uncensored discussion, better go here:

http://www.simplemachines.org/community ... c=189604.0

"Don't give them credit!" - what a stupid, stupid reason.  ;)

You guys really make a fool of yourself...  o.O


Nothing has been censored except name/urls of exploiters as we have always been doing for obvious reasons.
At reading your last posts, I see you are here fighting your own little flame war.
This is against forum rules, as you may not know. http://forum.joomla.org/index.php/topic,65.0.html
Consider this as a warning.

What happened is serious and taken seriously.
@ vistartony

This hacking cycle has hit a lot of servers worldwide and not specifically joomla sites.

As stated above, when investigations are doned, we will post the result here.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr · GMT +1
Qui vult dare parva non debet magna rogare.
---------------------------------
Joomla! Translation Coordination Team


Top
  E-mail  
 
Posted: Sat Aug 18, 2007 4:52 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Thu Jun 29, 2006 11:55 am
Posts: 17
Nice, eh? It's a totally amateurish way to handle all this. "Hey, let's just censor our users posts!"  ;)

A good way to deal with this would have been a quick official statement with a screenshot. Yup, you heard that right. My English is not the best, but something like "Yes, we got hacked. We’re investigating now and will inform you about what exactly happened once we know more. You are welcome to discuss this in [link to thread] but we'd be happy if you refrained from speculations. We will inform you as soon we know more. Your Joomla! Team" - THIS would have been a good and honest way to deal with this.

What you are doing now is totally ridiculing yourself, nothing else...

This is not a good way to deal with what happened, sorry guys.


Top
  E-mail  
 
Posted: Sat Aug 18, 2007 4:53 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Thu Jul 26, 2007 3:13 pm
Posts: 21
infograf768 wrote:
[@ vistartony

This hacking cycle has hit a lot of servers worldwide and not specifically joomla sites.

As stated above, when investigations are doned, we will post the result here.

What you say is true but you consider that every program like every server can have its bug, and how you says perhaps is better to wait for the results of your investigation, I believe that everyone of we is waited honesty, that's all. Thanks.


Top
   
 
Posted: Sat Aug 18, 2007 4:56 pm 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 11653
Location: **Translation Matters**
vistartony wrote:
infograf768 wrote:
[@ vistartony

This hacking cycle has hit a lot of servers worldwide and not specifically joomla sites.

As stated above, when investigations are doned, we will post the result here.

What you say is true but you consider that every program like every server can have its bug, and how you says perhaps is better to wait for the results of your investigation, I believe that everyone of we is waited honesty, that's all. Thanks.


I am waiting also, as eagerly as you do.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr · GMT +1
Qui vult dare parva non debet magna rogare.
---------------------------------
Joomla! Translation Coordination Team


Top
  E-mail  
 
Posted: Sat Aug 18, 2007 4:56 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Thu Jul 26, 2007 3:13 pm
Posts: 21
stokedfish wrote:
Nice, eh? It's a totally amateurish way to handle all this. "Hey, let's just censor our users posts!"   ;)

A good way to deal with this would have been a quick official statement with a screenshot. Yup, you heard that right. My English is not the best, but something like "Yes, we got hacked. We’re investigating now and will inform you about what exactly happened once we know more. You are welcome to discuss this in [link to thread] but we'd be happy if you refrained from speculations. We will inform you as soon we know more. Your Joomla! Team" - THIS would have been a good and honest way to deal with this.

What you are doing now is totally ridiculing yourself, nothing else...

This is not a good way to deal with what happened, sorry guys.

Yup, I agree


Top
   
 
Posted: Sat Aug 18, 2007 5:03 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Thu Jun 29, 2006 11:55 am
Posts: 17
infograf768 wrote:
Nothing has been censored except name/urls of exploiters as we have always been doing for obvious reasons.


Haha, great statement.

That's like saying "China doesn't censor anything, except the internet as it has always been doing for obvious reasons"

Call it whatever you want, but DELETING (!) names/urls/pics that are not against US law  =  censorship

Quote:
At reading your last posts, I see you are here fighting your own little flame war.


Where exactly did I flame? I see nothing in my posts that is against the forum rules.

This is a civil discussion and I'm just stating my opinion on this...
You don't seem to like it, that's fine with me, but it can hardly be against the rules.


Last edited by stokedfish on Sat Aug 18, 2007 5:07 pm, edited 1 time in total.

Top
  E-mail  
 
Posted: Sat Aug 18, 2007 5:07 pm 
User avatar
Joomla! Explorer
Joomla! Explorer
Offline

Joined: Thu Aug 25, 2005 3:29 pm
Posts: 347
Location: Adelaide, South Australia
stokedfish wrote:
Nice, eh? It's a totally amateurish way to handle all this. "Hey, let's just censor our users posts!"  ;)
Not censor, sanitise. The standard in here has always been - and I have been here from the start - that there is never a link, a name, a screenshot or any other thing that might identify a hacker or their tools. There should never be any way for them to gain any credibility for their actions.
Quote:
A good way to deal with this would have been a quick official statement with a screenshot.
A statement, yes, agree that it would have been appropriate.
A screenshot? Nope, nothing that could lead to them gaining any reference. Zip. Nada. Nothing.
Quote:
What you are doing now is totally ridiculing yourself, nothing else...
This is not a good way to deal with what happened, sorry guys.
Now you are going off on a tangent without any facts to support your suggestion. The Team has led us wisely and I have no doubt they will be telling us the full story just as soon as they know what it is. They know that we all have sites out there that need to be protected and they are well aware of the need to advise us if there is an exploit that just might be heading our way.
Don't go off half-cocked, wait until they tell their story then see what is the most appropriate way to react.

_________________
Cheers, Ian
"Always remember. Love is the purest feeling, the wisest thought and the strongest reason. Always!"
by Sea-Life
Do Not PM me looking for Help! Un-requested Help PM's will be Deleted Unread, and your ID added to my Ignore List


Last edited by ilox on Sat Aug 18, 2007 5:10 pm, edited 1 time in total.

Top
   
 
Posted: Sat Aug 18, 2007 5:15 pm 
User avatar
Joomla! Virtuoso
Joomla! Virtuoso
Offline

Joined: Sun Aug 21, 2005 2:25 pm
Posts: 4103
Location: Somewhere Near Here
Actually uncivil comments are against the rules stokedfish.  You seem to have neglected to read the rules from the link provided so I will quote them directly to you here in this post.

Quote:
Keep all commentary civil, and be courteous at all times. Constructive criticism is welcome, but insults directed towards other users or the site admins will not be tolerated. Coarse/insulting language will not be tolerated.


If you need further clarification on this I would be more than happy to explain it further to you, but I fear you won't understand it because you seem to not understand the concept of not giving hackers credibility or promotion for their deeds.  I find it odd that you advocate for hackers, I have never seen that done unless it is being done by the hacker themselves or someone that knows the hacker, or someone who has inside knowledge of the hack.  It certainly doesn't shine a very good light on you, and that is unfortunate.

stokedfish wrote:
infograf768 wrote:
Nothing has been censored except name/urls of exploiters as we have always been doing for obvious reasons.


Haha, great statement.
That's like saying "China doesn't censor anything, except the internet as it has always been doing for obvious reasons"
Call it whatever you want, but DELETING (!) names/urls/pics that are not against US law  =  censorship
Quote:
At reading your last posts, I see you are here fighting your own little flame war.

Where exactly did I flame? I see nothing in my posts that is against the forum rules.
This is a civil discussion and I'm just stating my opinion on this...
You don't seem to like it, that's fine with me, but it can hardly be against the rules.

_________________
Love good music, especially the blues? http://www.jennifermarriott.com
Need a Joomla Consultant? http://www.marpomultimedia.com
JOOMLA ROCKS


Top
  E-mail  
 
Posted: Sat Aug 18, 2007 5:18 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Thu Jun 29, 2006 11:55 am
Posts: 17
ilox wrote:
Not censor, sanitise. The standard has always been - and I have been here from the start - that there is never a link, a name, a screenshot or any other thing that might identify a hacker or their tools. There should never be any way for them to gain any credibility for heir actions.


Well, I don't agree with that decision and, as I said, I think it's a VERY amateurish way to deal with this. Anyway, if this is the policy here then I suggest at least adding it to the forum rules so that everyone knows.

ilox wrote:
Nope, nothing that could lead to them gaining any reference. Zip. Nada. Nothing.


The more secretive you treat this incident the more speculations, rumours and misinformation will spread on the web and this can be in no way good for the Joomla! project. A much better way would have been to make an offical statement as fast as possible instead of trying to hide things from the public.

ilox wrote:
Now you are going off on a tangent without any facts to support your suggestion.


I stated more than enough facts to support my opinion. You may not agree with it, that's fine. but accusing me of "going off on a tangent without any facts" certainly isn't accurate. Instead I am still waiting for YOUR arguments. All I have heard so far is a ridiculous "they should not get any credits!" - it's too late for that now anyway, face it. We're giving them credit with this thread right now and this could have been avoided, had you dealt with this differently.

ilox wrote:
The Team has led us wisely and I have no doubt they will be telling us the full story just as soon as they know what it is.


Yes, I agree, they have indeed led us wisely. I've been reading the forums for quite some time and I agree. But now the Joomla! team didn't act clever at all and I think there's nothing wrong about speaking that out...


Last edited by stokedfish on Sat Aug 18, 2007 7:00 pm, edited 1 time in total.

Top
  E-mail  
 
Posted: Sat Aug 18, 2007 5:21 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Thu Aug 18, 2005 12:06 pm
Posts: 707
Location: Netherlands
This morning (GMT+2) the shop.joomla.org got compromised. We countered this within 40 minutes by restoring some default setting on the servers, for research reasons the site was put into maintenance mode. An hour after that, the front-page  was compromised also (shop.joomla.org and http://www.joomla.org run on the same server).

We investigated, and going through several hundreds of megabytes of logfiles just takes a lot of time. We decided to move away the current site, and replace it with a plain .html file to be able to investigate further. In the mean while the total installation was restored to get the site back up and running, this is our current status.

At this time we still are going through the massive logfiles and try to find the way we were compromised. This is certainly not an easy task. As soon as we have more information on this, we will share it with the community.

p.s. I have not been able to read all posts here, so maybe you ask for more info, feel free to do so. Will try to answer as good and fast as possible here.

_________________
Personal blogs can be found on http://JFoobar.org
/www.moovum.com - The Bird is in the air! Get Mollom Anti-Spam on your Joomla! website with Moovur...
www.abillo.com - The dream expierence


Top
   
 
Posted: Sat Aug 18, 2007 5:21 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Thu Jul 26, 2007 3:13 pm
Posts: 21
Please don't use the word "Hackers" they aren't Hackers who do that on this or on the other sites, the hacker are a great programmer and skiled averywhere on the pc and the net, the correct word for me is a cracker. Enough :)


Top
   
 
Posted: Sat Aug 18, 2007 5:21 pm 
User avatar
Joomla! Explorer
Joomla! Explorer
Offline

Joined: Tue Aug 23, 2005 4:55 am
Posts: 280
Location: On my CBR 1000rr...
stokedfish wrote:
Call it whatever you want, but DELETING (!) names/urls/pics that are not against US law  =  censorship

Law really has nothing to do with it.
http://en.wikipedia.org/wiki/Netiquette

_________________
Love, Live PHP.
Love, Live Joomla!
Super Sonic Man...do you want to buy a RockeTheme rocket? -Gary Jules


Top
  E-mail  
 
Display posts from previous:  Sort by  
Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 195 posts ]  Go to page Previous  1, 2, 3, 4, 5, 6, 7  Next

Quick reply

 



Who is online

Users browsing this forum: No registered users and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group