Joomla! • View topic - Ultimate Joomla Security Concept

Board index » Joomla! Older Version Support » Joomla! 1.5 » Security in Joomla! 1.5

Forum rules

Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.

Ultimate Joomla Security Concept

Moderators: mandville, PhilD, General Support Moderators

Page 1 of 1

[ 20 posts ]

Print view

Previous topic | Next topic

Author

Message

C0nw0nk

Post subject: Ultimate Joomla Security Concept

Posted: Mon May 21, 2012 4:12 pm

Joomla! Enthusiast

Joined: Tue Jun 15, 2010 1:12 am
Posts: 208
Location: United Kingdom, London

So the following code will protect your entire joomla site from XSS exploits, MySQL Injections and other malicious activity.

Edit your joomla's root "index.php"

Above where the index.php reads :

Code:

<?php
define( '_JEXEC', 1 );

Insert the following :

Code:

<?php
if (strlen($_SERVER['REQUEST_URI']) > 255 ||
   strpos($_SERVER['REQUEST_URI'], "eval(") ||
   strpos($_SERVER['REQUEST_URI'], "*") ||
   strpos($_SERVER['REQUEST_URI'], ":") ||
   strpos($_SERVER['REQUEST_URI'], "!") ||
   strpos($_SERVER['REQUEST_URI'], "$") ||
   strpos($_SERVER['REQUEST_URI'], "£") ||
   strpos($_SERVER['REQUEST_URI'], "<") ||
   strpos($_SERVER['REQUEST_URI'], ">") ||
   strpos($_SERVER['REQUEST_URI'], "^") ||
   strpos($_SERVER['REQUEST_URI'], "(") ||
   strpos($_SERVER['REQUEST_URI'], ")") ||
   strpos($_SERVER['REQUEST_URI'], "}") ||
   strpos($_SERVER['REQUEST_URI'], "{") ||
   strpos($_SERVER['REQUEST_URI'], "]") ||
   strpos($_SERVER['REQUEST_URI'], "[") ||
   strpos($_SERVER['REQUEST_URI'], ";") ||
   strpos($_SERVER['REQUEST_URI'], "@") ||
   strpos($_SERVER['REQUEST_URI'], "~") ||
   strpos($_SERVER['REQUEST_URI'], "|") ||
   strpos($_SERVER['REQUEST_URI'], "%") ||
   strpos($_SERVER['REQUEST_URI'], "%08") ||
   strpos($_SERVER['REQUEST_URI'], "%09") ||
   strpos($_SERVER['REQUEST_URI'], "%0A") ||
   strpos($_SERVER['REQUEST_URI'], "%0D") ||
   strpos($_SERVER['REQUEST_URI'], "%20") ||
   strpos($_SERVER['REQUEST_URI'], "%21") ||
   strpos($_SERVER['REQUEST_URI'], "%22") ||
   strpos($_SERVER['REQUEST_URI'], "%23") ||
   strpos($_SERVER['REQUEST_URI'], "%24") ||
   strpos($_SERVER['REQUEST_URI'], "%25") ||
   strpos($_SERVER['REQUEST_URI'], "%26") ||
   strpos($_SERVER['REQUEST_URI'], "%27") ||
   strpos($_SERVER['REQUEST_URI'], "%28") ||
   strpos($_SERVER['REQUEST_URI'], "%29") ||
   strpos($_SERVER['REQUEST_URI'], "%2A") ||
   strpos($_SERVER['REQUEST_URI'], "%2B") ||
   strpos($_SERVER['REQUEST_URI'], "%2C") ||
   strpos($_SERVER['REQUEST_URI'], "%2D") ||
   strpos($_SERVER['REQUEST_URI'], "%2E") ||
   strpos($_SERVER['REQUEST_URI'], "%2F") ||
   strpos($_SERVER['REQUEST_URI'], "%30") ||
   strpos($_SERVER['REQUEST_URI'], "%31") ||
   strpos($_SERVER['REQUEST_URI'], "%32") ||
   strpos($_SERVER['REQUEST_URI'], "%33") ||
   strpos($_SERVER['REQUEST_URI'], "%34") ||
   strpos($_SERVER['REQUEST_URI'], "%35") ||
   strpos($_SERVER['REQUEST_URI'], "%36") ||
   strpos($_SERVER['REQUEST_URI'], "%37") ||
   strpos($_SERVER['REQUEST_URI'], "%38") ||
   strpos($_SERVER['REQUEST_URI'], "%39") ||
   strpos($_SERVER['REQUEST_URI'], "%3A") ||
   strpos($_SERVER['REQUEST_URI'], "%3B") ||
   strpos($_SERVER['REQUEST_URI'], "%3C") ||
   strpos($_SERVER['REQUEST_URI'], "%3D") ||
   strpos($_SERVER['REQUEST_URI'], "%3E") ||
   strpos($_SERVER['REQUEST_URI'], "%3F") ||
   strpos($_SERVER['REQUEST_URI'], "%40") ||
   strpos($_SERVER['REQUEST_URI'], "%41") ||
   strpos($_SERVER['REQUEST_URI'], "%42") ||
   strpos($_SERVER['REQUEST_URI'], "%43") ||
   strpos($_SERVER['REQUEST_URI'], "%44") ||
   strpos($_SERVER['REQUEST_URI'], "%45") ||
   strpos($_SERVER['REQUEST_URI'], "%46") ||
   strpos($_SERVER['REQUEST_URI'], "%47") ||
   strpos($_SERVER['REQUEST_URI'], "%48") ||
   strpos($_SERVER['REQUEST_URI'], "%49") ||
   strpos($_SERVER['REQUEST_URI'], "%4A") ||
   strpos($_SERVER['REQUEST_URI'], "%4B") ||
   strpos($_SERVER['REQUEST_URI'], "%4C") ||
   strpos($_SERVER['REQUEST_URI'], "%4D") ||
   strpos($_SERVER['REQUEST_URI'], "%4E") ||
   strpos($_SERVER['REQUEST_URI'], "%4F") ||
   strpos($_SERVER['REQUEST_URI'], "%50") ||
   strpos($_SERVER['REQUEST_URI'], "%51") ||
   strpos($_SERVER['REQUEST_URI'], "%52") ||
   strpos($_SERVER['REQUEST_URI'], "%53") ||
   strpos($_SERVER['REQUEST_URI'], "%54") ||
   strpos($_SERVER['REQUEST_URI'], "%55") ||
   strpos($_SERVER['REQUEST_URI'], "%56") ||
   strpos($_SERVER['REQUEST_URI'], "%57") ||
   strpos($_SERVER['REQUEST_URI'], "%58") ||
   strpos($_SERVER['REQUEST_URI'], "%59") ||
   strpos($_SERVER['REQUEST_URI'], "%5A") ||
   strpos($_SERVER['REQUEST_URI'], "%5B") ||
   strpos($_SERVER['REQUEST_URI'], "%5C") ||
   strpos($_SERVER['REQUEST_URI'], "%5D") ||
   strpos($_SERVER['REQUEST_URI'], "%5E") ||
   strpos($_SERVER['REQUEST_URI'], "%5F") ||
   strpos($_SERVER['REQUEST_URI'], "%60") ||
   strpos($_SERVER['REQUEST_URI'], "%61") ||
   strpos($_SERVER['REQUEST_URI'], "%62") ||
   strpos($_SERVER['REQUEST_URI'], "%63") ||
   strpos($_SERVER['REQUEST_URI'], "%64") ||
   strpos($_SERVER['REQUEST_URI'], "%65") ||
   strpos($_SERVER['REQUEST_URI'], "%66") ||
   strpos($_SERVER['REQUEST_URI'], "%67") ||
   strpos($_SERVER['REQUEST_URI'], "%68") ||
   strpos($_SERVER['REQUEST_URI'], "%69") ||
   strpos($_SERVER['REQUEST_URI'], "%6A") ||
   strpos($_SERVER['REQUEST_URI'], "%6B") ||
   strpos($_SERVER['REQUEST_URI'], "%6C") ||
   strpos($_SERVER['REQUEST_URI'], "%6D") ||
   strpos($_SERVER['REQUEST_URI'], "%6E") ||
   strpos($_SERVER['REQUEST_URI'], "%6F") ||
   strpos($_SERVER['REQUEST_URI'], "%70") ||
   strpos($_SERVER['REQUEST_URI'], "%71") ||
   strpos($_SERVER['REQUEST_URI'], "%72") ||
   strpos($_SERVER['REQUEST_URI'], "%73") ||
   strpos($_SERVER['REQUEST_URI'], "%74") ||
   strpos($_SERVER['REQUEST_URI'], "%75") ||
   strpos($_SERVER['REQUEST_URI'], "%76") ||
   strpos($_SERVER['REQUEST_URI'], "%77") ||
   strpos($_SERVER['REQUEST_URI'], "%78") ||
   strpos($_SERVER['REQUEST_URI'], "%79") ||
   strpos($_SERVER['REQUEST_URI'], "%7A") ||
   strpos($_SERVER['REQUEST_URI'], "%7B") ||
   strpos($_SERVER['REQUEST_URI'], "%7C") ||
   strpos($_SERVER['REQUEST_URI'], "%7D") ||
   strpos($_SERVER['REQUEST_URI'], "%7E") ||
   strpos($_SERVER['REQUEST_URI'], "%A2") ||
   strpos($_SERVER['REQUEST_URI'], "%A3") ||
   strpos($_SERVER['REQUEST_URI'], "%A5") ||
   strpos($_SERVER['REQUEST_URI'], "%A6") ||
   strpos($_SERVER['REQUEST_URI'], "%A7") ||
   strpos($_SERVER['REQUEST_URI'], "%AB") ||
   strpos($_SERVER['REQUEST_URI'], "%AC") ||
   strpos($_SERVER['REQUEST_URI'], "%AD") ||
   strpos($_SERVER['REQUEST_URI'], "%B0") ||
   strpos($_SERVER['REQUEST_URI'], "%B1") ||
   strpos($_SERVER['REQUEST_URI'], "%B2") ||
   strpos($_SERVER['REQUEST_URI'], "%B4") ||
   strpos($_SERVER['REQUEST_URI'], "%B5") ||
   strpos($_SERVER['REQUEST_URI'], "%BB") ||
   strpos($_SERVER['REQUEST_URI'], "%BC") ||
   strpos($_SERVER['REQUEST_URI'], "%BD") ||
   strpos($_SERVER['REQUEST_URI'], "%BF") ||
   strpos($_SERVER['REQUEST_URI'], "%C0") ||
   strpos($_SERVER['REQUEST_URI'], "%C1") ||
   strpos($_SERVER['REQUEST_URI'], "%C2") ||
   strpos($_SERVER['REQUEST_URI'], "%C3") ||
   strpos($_SERVER['REQUEST_URI'], "%C4") ||
   strpos($_SERVER['REQUEST_URI'], "%C5") ||
   strpos($_SERVER['REQUEST_URI'], "%C6") ||
   strpos($_SERVER['REQUEST_URI'], "%C7") ||
   strpos($_SERVER['REQUEST_URI'], "%C8") ||
   strpos($_SERVER['REQUEST_URI'], "%C9") ||
   strpos($_SERVER['REQUEST_URI'], "%CA") ||
   strpos($_SERVER['REQUEST_URI'], "%CB") ||
   strpos($_SERVER['REQUEST_URI'], "%CC") ||
   strpos($_SERVER['REQUEST_URI'], "%CD") ||
   strpos($_SERVER['REQUEST_URI'], "%CE") ||
   strpos($_SERVER['REQUEST_URI'], "%CF") ||
   strpos($_SERVER['REQUEST_URI'], "%D0") ||
   strpos($_SERVER['REQUEST_URI'], "%D1") ||
   strpos($_SERVER['REQUEST_URI'], "%D2") ||
   strpos($_SERVER['REQUEST_URI'], "%D3") ||
   strpos($_SERVER['REQUEST_URI'], "%D4") ||
   strpos($_SERVER['REQUEST_URI'], "%D5") ||
   strpos($_SERVER['REQUEST_URI'], "%D6") ||
   strpos($_SERVER['REQUEST_URI'], "%D8") ||
   strpos($_SERVER['REQUEST_URI'], "%D9") ||
   strpos($_SERVER['REQUEST_URI'], "%DA") ||
   strpos($_SERVER['REQUEST_URI'], "%DB") ||
   strpos($_SERVER['REQUEST_URI'], "%DC") ||
   strpos($_SERVER['REQUEST_URI'], "%DD") ||
   strpos($_SERVER['REQUEST_URI'], "%DE") ||
   strpos($_SERVER['REQUEST_URI'], "%DF") ||
   strpos($_SERVER['REQUEST_URI'], "%E0") ||
   strpos($_SERVER['REQUEST_URI'], "%E1") ||
   strpos($_SERVER['REQUEST_URI'], "%E2") ||
   strpos($_SERVER['REQUEST_URI'], "%E3") ||
   strpos($_SERVER['REQUEST_URI'], "%E4") ||
   strpos($_SERVER['REQUEST_URI'], "%E5") ||
   strpos($_SERVER['REQUEST_URI'], "%E6") ||
   strpos($_SERVER['REQUEST_URI'], "%E7") ||
   strpos($_SERVER['REQUEST_URI'], "%E8") ||
   strpos($_SERVER['REQUEST_URI'], "%E9") ||
   strpos($_SERVER['REQUEST_URI'], "%EA") ||
   strpos($_SERVER['REQUEST_URI'], "%EB") ||
   strpos($_SERVER['REQUEST_URI'], "%EC") ||
   strpos($_SERVER['REQUEST_URI'], "%ED") ||
   strpos($_SERVER['REQUEST_URI'], "%EE") ||
   strpos($_SERVER['REQUEST_URI'], "%EF") ||
   strpos($_SERVER['REQUEST_URI'], "%F0") ||
   strpos($_SERVER['REQUEST_URI'], "%F1") ||
   strpos($_SERVER['REQUEST_URI'], "%F2") ||
   strpos($_SERVER['REQUEST_URI'], "%F3") ||
   strpos($_SERVER['REQUEST_URI'], "%F4") ||
   strpos($_SERVER['REQUEST_URI'], "%F5") ||
   strpos($_SERVER['REQUEST_URI'], "%F6") ||
   strpos($_SERVER['REQUEST_URI'], "%F7") ||
   strpos($_SERVER['REQUEST_URI'], "%F8") ||
   strpos($_SERVER['REQUEST_URI'], "%F9") ||
   strpos($_SERVER['REQUEST_URI'], "%FA") ||
   strpos($_SERVER['REQUEST_URI'], "%FB") ||
   strpos($_SERVER['REQUEST_URI'], "%FC") ||
   strpos($_SERVER['REQUEST_URI'], "%FD") ||
   strpos($_SERVER['REQUEST_URI'], "%FE") ||
   strpos($_SERVER['REQUEST_URI'], "%FF") ||
   strpos($_SERVER['REQUEST_URI'], "CONCAT") ||
   strpos($_SERVER['REQUEST_URI'], "SQL") ||
   strpos($_SERVER['REQUEST_URI'], "\"") ||
   strpos($_SERVER['REQUEST_URI'], "UNION+SELECT") ||
   strpos($_SERVER['REQUEST_URI'], "UNION+ALL") ||
   strpos($_SERVER['REQUEST_URI'], "DELETE") ||
   strpos($_SERVER['REQUEST_URI'], "base64")) {
      @header("HTTP/1.1 414 Request-URI Too Long");
      @header("Status: 414 Request-URI Too Long");
      @header("Connection: Close");
      @exit;
}
?>

If you wish to add your own strings to be blocked just add another line of "strpos($_SERVER['REQUEST_URI'], "Test") ||"

To test it do something like this in your url.

http://www.steam-hacks.com/index.php?DELETE

If your running SEF url's the same applies

http://www.steam-hacks.com/?DELETE

http://www.steam-hacks.com/index.html#DELETE

Forgot to mention it is case sensative!

Last edited by C0nw0nk on Mon May 21, 2012 10:02 pm, edited 2 times in total.

Top

mailm

Post subject: Re: Ultimate Joomla Security Concept

Posted: Mon May 21, 2012 5:33 pm

Joomla! Intern

Joined: Sat Nov 20, 2010 11:51 pm
Posts: 72

I must take objection at your statement that this code will fix everything.
From what i can see , this code will be overwritten everytime you update the joomla installation and what about the 777 permission and other weakness ?

_________________
JUG Team - Is yours Registered and Legit
http://community.joomla.org/user-groups/

Top

PhilD

Post subject: Re: Ultimate Joomla Security Concept

Posted: Mon May 21, 2012 5:50 pm

Joomla! Hero

Joined: Sat Oct 21, 2006 10:20 pm
Posts: 2694
Location: Wisconsin USA

Personally, I think it is more bull than anything else.

If it were that simple something would have been added to the core long ago.

If it worked, how much of a server hit this would cause? Especially on a popular site.

Also will break the index.php unless the php open/close tags are removed.

As a core file is being modified, it may be overwritten on an update.

Also on my test (with 2.5) I saw no difference between using the added code and not using the added code.

mysite.com/?delete
and mysite.com/index.php?delete
reacted the same either way.

It is also not going to stop a hacker from direct access to an extensions security issue.

I would recommend to not make this addition. Follow the recommended security practices that are suggested in the forum stickies and in the security docs.

Hackers play by their own rules, not by the rules others play by.

_________________
PhilD -- Unrequested PM's and/or emails may not get a response.
Security Moderator

Top

Slackervaara

Post subject: Re: Ultimate Joomla Security Concept

Posted: Mon May 21, 2012 5:53 pm

Joomla! Explorer

Joined: Sat Aug 13, 2011 6:27 am
Posts: 299

Hopefully the team that supply the security fixes for 1.5 will look at this suggestion. If it works it would be good if it could be included as the last security fix for 1.5 in September.

Top

mandville

Post subject: Re: Ultimate Joomla Security Concept

Posted: Mon May 21, 2012 6:42 pm

Joomla! Master

Joined: Mon Mar 20, 2006 1:56 am
Posts: 11638
Location: The Girly Side of Joomla in Sussex

Slackervaara wrote:

Hopefully the team that supply the security fixes for 1.5 will look at this suggestion.

The team deal who deal with core security issues? see phild comment

Quote:

If it works it would be good if it could be included as the last security fix for 1.5 in September.

i think that the answer to that has been raise.
JBS would be the place to raise it IF it were proven to work as described

_________________
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be added to the foe list and possibly just deleted
{Community.Connect Administrator }{ Showcase & Security Moderator}

Top

C0nw0nk

Post subject: Re: Ultimate Joomla Security Concept

Posted: Mon May 21, 2012 7:15 pm

Joomla! Enthusiast

Joined: Tue Jun 15, 2010 1:12 am
Posts: 208
Location: United Kingdom, London

It works for me, If you doubt it works then test it and view the webpage's header response it should match with

Code:

@header("HTTP/1.1 414 Request-URI Too Long");
      @header("Status: 414 Request-URI Too Long");

For those who are intreasted in testing it try it out here <deleted see forum rules viewtopic.php?f=8&t=65>

Also for those who want to check the header response you can do that here.
http://web-sniffer.net/

Last edited by mandville on Tue May 22, 2012 4:45 pm, edited 1 time in total.

Do not propose/link to any site that contains warez/copyrighted software/materials that can be downloaded illegally.

Top

MickeyRoush

Post subject: Re: Ultimate Joomla Security Concept

Posted: Tue May 22, 2012 5:27 pm

Joomla! Apprentice

Joined: Fri Mar 18, 2011 5:46 am
Posts: 10

I use something similar for WordPress, but not that long. And it works. You might want to use preg_match instead of strpos. That way you can condense it. And to use Error Control Operators within the regex string to keep from throwing an errors to any hackers.

Something like this:

Code:

if (strlen($_SERVER['REQUEST_URI']) > 255 ||
preg_match('@(eval|\*|:|\!|\$|£|\<|\>|\^|\(|\)|\}|\{|\]|\[|;|@|~|\||\%|\"|\%0[89AD]|\%[2-6][\dA-F]|\%7[\dA-E]|\%A[23567B-D]|\%B[0-5BCDF]|\%[C-F][\dA-F]|CONCAT|SQL|UNION+(SELECT|ALL)|DELETE|base64)@si',$_SERVER['REQUEST_URI']))
{
     @header("HTTP/1.1 414 Request-URI Too Long");
     @header("Status: 414 Request-URI Too Long");
     @header("Connection: Close");
     @exit;
}

I haven't tested that, but it's a start.

That original idea was thought up by _ck_

http://ckon.wordpress.com/2008/11/11/si ... -requests/

Top

C0nw0nk

Post subject: Re: Ultimate Joomla Security Concept

Posted: Tue May 22, 2012 5:55 pm

Joomla! Enthusiast

Joined: Tue Jun 15, 2010 1:12 am
Posts: 208
Location: United Kingdom, London

MickeyRoush wrote:

Something like this:

Code:

if (strlen($_SERVER['REQUEST_URI']) > 255 ||
preg_match('@(eval|\*|:|\!|\$|£|\<|\>|\^|\(|\)|\}|\{|\]|\[|;|@|~|\||\%|\"|\%0[89AD]|\%[2-6][\dA-F]|\%7[\dA-E]|\%A[23567B-D]|\%B[0-5BCDF]|\%[C-F][\dA-F]|CONCAT|SQL|UNION+(SELECT|ALL)|DELETE|base64)@si',$_SERVER['REQUEST_URI']))
{
     @header("HTTP/1.1 414 Request-URI Too Long");
     @header("Status: 414 Request-URI Too Long");
     @header("Connection: Close");
     @exit;
}

That is good Mickey but joomla url's require us to allow use of "+,=,-,_,&,[,]" that is at a minimum for a well coded extension in other cases when a extension sef url has issues the url's require commas and all sorts.

I think the only issue with both our codes is that the deffined strings "DELETE,CONCAT,UNION,SQL, etc" will only work when case sensative if you enter them into the url lower cased the code will not intercept the url.

Top

MickeyRoush

Post subject: Re: Ultimate Joomla Security Concept

Posted: Tue May 22, 2012 6:14 pm

Joomla! Apprentice

Joined: Fri Mar 18, 2011 5:46 am
Posts: 10

C0nw0nk wrote:

MickeyRoush wrote:

Something like this:

Code:

if (strlen($_SERVER['REQUEST_URI']) > 255 ||
preg_match('@(eval|\*|:|\!|\$|£|\<|\>|\^|\(|\)|\}|\{|\]|\[|;|@|~|\||\%|\"|\%0[89AD]|\%[2-6][\dA-F]|\%7[\dA-E]|\%A[23567B-D]|\%B[0-5BCDF]|\%[C-F][\dA-F]|CONCAT|SQL|UNION+(SELECT|ALL)|DELETE|base64)@si',$_SERVER['REQUEST_URI']))
{
     @header("HTTP/1.1 414 Request-URI Too Long");
     @header("Status: 414 Request-URI Too Long");
     @header("Connection: Close");
     @exit;
}

Yeah, like I said it's a start. I haven't tested it, as I only have one Joomla site now. I love Joomla, but I've had to dedicate more time to WordPress, so someone else more experienced with Joomla will have to clean it up.

In my version it's using 'i' Pattern Modifier. So it will match both upper and lower case letters. But besides that it pretty much covers everything in your code. Except the 'eval(', I removed the literal '(' as it was making it look like I was missing something and it's covered again later on with '\(' anyways. Again, I'm not sure exactly what you were trying to cover, so some of the escaping may need to be removed, my REGEX may be a bit off.

Top

C0nw0nk

Post subject: Re: Ultimate Joomla Security Concept

Posted: Fri May 25, 2012 2:44 am

Joomla! Enthusiast

Joined: Tue Jun 15, 2010 1:12 am
Posts: 208
Location: United Kingdom, London

Asso another great security idea for joomla that every major CMS and site has online is User Authentication by a answer they will only know for there account.

Secret Questions and answers.

viewtopic.php?f=178&t=448844

I'm still supprised that nothing exsists for this yet not even extensions or third party have yet to do anything for it.

But if you look at sites like youtube, ebay, facebook, google, hotmail etc they all contain this same feature so why not joomla ?

Top

PhilD

Post subject: Re: Ultimate Joomla Security Concept

Posted: Fri May 25, 2012 4:03 pm

Joomla! Hero

Joined: Sat Oct 21, 2006 10:20 pm
Posts: 2694
Location: Wisconsin USA

Quote:

Following an initial investigation what occurred today was the result of a social engineering attack. “The person was able to impersonate the domain owner to the web hosting company, and provide correct answers to their verification questions. And thereby gain access to the account with the host, and ultimately change the email and then request a mailing of the access details.” attributed to Matt Pugh, company founder, WHMCS

So no real security there.

_________________
PhilD -- Unrequested PM's and/or emails may not get a response.
Security Moderator

Top

C0nw0nk

Post subject: Re: Ultimate Joomla Security Concept

Posted: Sun May 27, 2012 9:56 pm

Joomla! Enthusiast

Joined: Tue Jun 15, 2010 1:12 am
Posts: 208
Location: United Kingdom, London

If you based you'r investigation of the link to the hack i posted it would not suprise me i was just using it as a example with a few tweaks it could be made secure no doubt about it it would just be a extra feature incase a user forgets both username and email.

Top

leolam

Post subject: Re: Ultimate Joomla Security Concept

Posted: Mon May 28, 2012 2:26 am

Joomla! Master

Joined: Mon Aug 29, 2005 10:17 am
Posts: 11984
Location: Netherlands/ UK/ S'pore/Jakarta/ North America

PhilD wrote:

Quote:

So no real security there.

Which was on Hostgator btw and had nothing to do with WHMCS as application as such to set the record straight.

Leo

_________________
--- Joomla Professional Support Services :: http://gws-desk.com ---
--- Joomla Professional and Specialized Hosting :: http://gws-host.com ---
--- Ready to Roll Joomla! Web Sites : 1 - 7 days only! :: @ gws-market.com ---

Top

PhilD

Post subject: Re: Ultimate Joomla Security Concept

Posted: Mon May 28, 2012 3:06 pm

Joomla! Hero

Joined: Sat Oct 21, 2006 10:20 pm
Posts: 2694
Location: Wisconsin USA

No, you are entirely wrong Leolam. If it appears on HostGator, then they stole it.

So, to set the record straight:

Here is the WHMCS founder, Matt Pugh with exactly what he said from his own blog.
http://blog.whmcs.com/?t=47660

It is collaborated by this blog that gives some in depth coverage of the breach:
http://krebsonsecurity.com/2012/05/whmc ... e-trouble/

[Mod Note: Removed Comment]

_________________
PhilD -- Unrequested PM's and/or emails may not get a response.
Security Moderator

Last edited by ooffick on Mon May 28, 2012 9:18 pm, edited 1 time in total.

Mod Note: Removed what could have been understood as an attack.

Top

PhilD

Post subject: Re: Ultimate Joomla Security Concept

Posted: Mon May 28, 2012 3:18 pm

Joomla! Hero

Joined: Sat Oct 21, 2006 10:20 pm
Posts: 2694
Location: Wisconsin USA

My point [Mod Note: removed comment] was that the added security question is not needed. Most hacks of Joomla are from insecure 3rd party extensions and failure to keep the site as a whole up to date. Adding a security question does nothing to prevent that. Very few hacks are performed from the front end user login. Adding security questions only complicates things, no one pays any attention anyway to where the link is actually pointing to, it is easy for a hacker to spoof the site and is why social engineering is so successful. Based on experience, users will simply create a new user/password or simply ask for a new password rather than use any password recovery available to them.

If you are accepting credit directly on site (not through PayPal etc.), then you better be following what was set forth in your agreements with the clearing house and the card companies. This is way beyond the scope of this (and most other) security forum. You also better know much more about security than most people do.

_________________
PhilD -- Unrequested PM's and/or emails may not get a response.
Security Moderator

Last edited by ooffick on Mon May 28, 2012 9:15 pm, edited 1 time in total.

Mod Note: Removed what could have been understood as an attack.

Top

leolam

Post subject: Re: Ultimate Joomla Security Concept

Posted: Mon May 28, 2012 4:06 pm

Joomla! Master

Joined: Mon Aug 29, 2005 10:17 am
Posts: 11984
Location: Netherlands/ UK/ S'pore/Jakarta/ North America

PhilD wrote:

No, you are entirely wrong Leolam. So please alter your statement accordingly.

No PhilD, I am not wrong. We do happen to use WHMCS and have dozens of licenses and we have been informed from the very early beginning of what has been happening via extensive emails by the founder of WHMCS. The Hosting account was hacked/attacked through social engineering and WHMCS (As explained by Matt in all his correspondence: until further proven wrong why should I doubt his messages?) as such was not attacked. [Mod Note: Removed comment]

The second link is "opinion" and not build on facts by the writer. Posting that here on the Joomla forum and than asking me to accept a "view of a person" as real fact is simply far from good advise.

Quote:

My point since (...) was that the added security question is not needed.

Which is a patronizing remark since I did understood that very well and I even agree for a change so refrain from generalizing and alter your statement accordingly

Leo (sick ; )

Last edited by ooffick on Mon May 28, 2012 9:20 pm, edited 2 times in total.

Mod Note: Removed part of the quote and removed a comment which could have been understood as an attack.

Top

PhilD

Post subject: Re: Ultimate Joomla Security Concept

Posted: Mon May 28, 2012 5:54 pm

Joomla! Hero

Joined: Sat Oct 21, 2006 10:20 pm
Posts: 2694
Location: Wisconsin USA

[Mod Note: removed comment]

My point is that social engineering can and does get people to give out their secret security question, passwords, and user names and also tricks others in assisting in the hack. My point was in response to the specific posting viewtopic.php?f=432&t=719299#p2814649 that was made by C0nw0nk and suggested adding a security question. He has since not answered with his point of why he thinks it a good idea. [Mod Note: removed comment]

Again, Most Joomla sites are hacked not because of passwords, but because of insecure extensions and/or out of date installations. This is proven on these very forums. Because of this and the social engineering issue, the added security question is of little value.

The quote by Mr. Matt Pugh on his own blog and that his own WHMCS servers were hacked by social engineering and as a result the entire structure including billing servers, users, credentials, etc., was was made available on the underground just served as an example of how even people who should know better can give away information by social engineering tricks that can lead to hacking of a site.

[Mod Note: removed comment]

_________________
PhilD -- Unrequested PM's and/or emails may not get a response.
Security Moderator

Last edited by ooffick on Mon May 28, 2012 9:13 pm, edited 1 time in total.

Mod Note: Removed what could have been understood as an attack.

Top

mandville

Post subject: Re: Ultimate Joomla Security Concept

Posted: Mon May 28, 2012 7:00 pm

Joomla! Master

Joined: Mon Mar 20, 2006 1:56 am
Posts: 11638
Location: The Girly Side of Joomla in Sussex

This topic was locked under cooling off rules, and for global moderators to split off topic posts as they see fit.

_________________
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be added to the foe list and possibly just deleted
{Community.Connect Administrator }{ Showcase & Security Moderator}

Last edited by ooffick on Mon May 28, 2012 9:25 pm, edited 2 times in total.

Mod Note: Topic reopened. Please stay on topic.

Top

PhilD

Post subject: Re: Ultimate Joomla Security Concept

Posted: Tue May 29, 2012 4:44 am

Joomla! Hero

Joined: Sat Oct 21, 2006 10:20 pm
Posts: 2694
Location: Wisconsin USA

I apologize to the forum readers of this thread and anyone else who may have been offended for any comments that could have been perceived as attacks or were attacks against another forum member. It is not my habit to attack another forum member in a public forum. Furthermore it is not ok for anyone to attack another member in the forums. Sometimes I fail, sometimes I succeed. This time I failed to use proper judgment. Though this is no excuse, I am human and do make mistakes.

_________________
PhilD -- Unrequested PM's and/or emails may not get a response.
Security Moderator

Top

C0nw0nk

Post subject: Re: Ultimate Joomla Security Concept

Posted: Tue May 29, 2012 1:42 pm

Joomla! Enthusiast

Joined: Tue Jun 15, 2010 1:12 am
Posts: 208
Location: United Kingdom, London

PhilD wrote:

in response to the specific posting viewtopic.php?f=432&t=719299#p2814649 that was made by C0nw0nk and suggested adding a security question. He has since not answered with his point of why he thinks it a good idea.

The reason i think it is a good idea and would use it is because if a user forgets both email and password they have a method of getting there account back still.

It's just another account recovery option.

Top

Page 1 of 1

[ 20 posts ]

Board index » Joomla! Older Version Support » Joomla! 1.5 » Security in Joomla! 1.5

Who is online

Users browsing this forum: No registered users and 36 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:

Welcome to Joomla!

Recent Joomla! News

Support Joomla!

What Is Joomla?

Joomla! for Business

Joomla! for Developers

Learn more about Joomla!

Connect!

Support!

Read!

Get involved with Joomla!

Directories

Developers

Download Joomla! 2.5

Download Joomla! 3.1

Getting Started with Joomla!

Internationalization

The Joomla! Forum ™

Forum rules

Ultimate Joomla Security Concept

Who is online