Joomla! Discussion Forums

anyone know how this component was hacked?  Here are google results of other sites that have been hacked the same way: http://www.google.com/search?hl=en&lr=&q=irc.dal.nyet

Any info on this would be greatly appreciated!

MOD EDIT: Please see the link below for the post about the update.  -RobS
http://forum.joomla.org/index.php/topic,75390.msg402249.html#msg402249

FYI:


edit: corrected url, don't know why last number was missing just by copy and paste

Any news from the developer?

THis issue has also been forwarded to the devs here.

A site that I built for a friend has just been hacked by someone claimed to necromance, they had basically replaced the configuration file with their own page. - I will look elsewhere but  I will trash the site and rebuild rather than recover and run the risk that something else is there.

I was puzzled how, but fortunatly I run a number of web logging progams which may reveal the route

They used a search via Yahoo to look for the string "Powered By ExtCalendar" that is the only page I can track.
My method was to note the timestamp of the file and compare to my logs, that was the only entry. The text left on the site was Turkish and lo and behold a visitor left a Tuirkish  IP and Hostname - not 100% sure where to go with this, but looks pretty convincing to me.

Any after a data of some stuff, its building a new site.

FYI
Joomla 1.0.10
Not sure on Ext Cal version
We have users on the site but no one is allowed to upload anything nor put entries into the calendar
Only user input  is via a message board to registered users, I have removed the contac form as personally I believe there is a security issue with that (previously posted)

Toemik, could you please PM me the relevant log information for review.  Please don't publish it here.

sent va conact on your website

2 of my joomla sites were recently hacked via extcal2. Looks like some sort of code injection which allows modification of configuration.php???

Luckily I have regular site/db backups so just gotta delete/restore (and remove extcal I guess  )

Dunno if its any use but some bits of the apache log relating to the hack (my site replaced with zzzzzz):



REMOVED FOR SECURITY.
Please do not post these calls publicly.

FYI,

ExtCal2 hasn't been developed in like 2 years. i wasn't expecting it to be ported to 1.5 anyway, so i am going to switch calendars.

and i got hacked, too. The hack was 6 server calls in a matter of 26 seconds, so it certainly seems to be automated, and probably widespread.

also FYI,
the root index.php file was replaced, but the fix was simply to re-upload a new index.php file (from a new install).

We are expecting a fix for ext_calendar as the developper is no more active.
We will post here.

Put the

defined('_VALID_MOS') or die('Direct Access to this location is not allowed.');

on the top of extcalendar.php..

It is a high level risk hole.

From the information I have received about the com_extcalendar (com_extcal2) vulnerabilities, there are currently two flavors of the exploit circling around.  To make matters worse, this component is no longer actively developed hence we don't expect a proper patch to come around soon enough to be effective so I can only recommend that you migrate to a newer/more actively developed calendar component.  For those that need time to do this type of thing, I have added another mod_rewrite condition to the ruleset I have been developing that will hopefully address the exploits that are going around (one version was actually already blocked by my mod_rewrite rule set, I like good surprises!)

If you would like to go this route, you can find the mod_rewrite rules in this thread http://forum.joomla.org/index.php/topic,75376.0.html 

Also, Elpie noticed that the vulnerability is caused by a lack of valid component checking that all Joomla files are supposed to do before they execute any code.  The code below should be in every 3rd party component file.



Another option for those of you that need time to migrate away from com_extCalender would be to manually insert those two lines of code toward the top (but underneat the first comment chunk that starts with /* and ends with */ ) of all the files that were installed by com_extCalender in the /path/to/Joomla/components/com_extcalender/ and /path/to/Joomla/administrator/components/com_extcalender/ directories.  That will be a rather labor intensive project though because there are quite a few files and I cannot guarantee that addition will fix the problem all together.

I have had a similar experience with a site that was hacked and defaced. It seems it was hacked via extcalendar.

MOD NOTE: EXT Threads merged.
Please look for an existing thread before starting a new thread. Thanks!

I sended logfiles

That email address is not valid anymore.  I have PMed you a new one.

My version of extCalendar2 has a simliar "// no direct access
defined( '_VALID_MOS' ) or die( 'Restricted access' );
" statement in the file. 

What file has the "Powered by extCalendar" text?  I can't find it and at least thought I should delete that reference.

Anyone know of a good calendaring program to change over to?

Which file are you referring to?  The component installs quite a few files.

If extcalendar is dying out, will anyone be creating a com for a new calendar interface???  Would really like to have one up and running.  So far I've been lucky and I think it's mainly because I'm on VPS, but others hosted by the same company on shared servers have been hacked via extcalendar, at least thats what they think was the point of entry.

There is a com_events and another calender that I have heard will be released tomorrow so stay tuned to the Extensions page and check that out. 

From what I've read, the exploit was posted online on Friday July 7th and the hack attacks began on Saturday the 8th.  The hackers didn't seem to replace the index.php, they modified configuration.php.  Seemed like two different hackers, however, one from Indonesia that posted a green "hacked" graphic with an "I'll be back" message, and one from Turkey (with some military type graphic and a musical background).  Fortunately, they didn't damage any data, the database is still intact, it seemed like the access was limited to the equivalent of drive-by graffiti.  But I spent about 24 hours over the weekend patching and upgrading and replacing stuff because of these creeps.

I saw a calendar component today called Thyme that appears to be ported for Joomla.  Anyone have experience with it?  I'm running news and information sites, we HAVE to have an events calendar.  Never dreamed something like this would happen, especially since I'd upgraded to 1.10 in Joomla.  Just goes to show, it can happen anytime, anywhere.

Anyone in favor of promoting some sort of severe penalty for hackers, like the amputation of a hand or something? 

I asked the question before doing the research and found at least three or four components/mods for calendar functions, however I'm going to wait and see how the upgrades go for these new issues.  I've still got extcalendar running fine for now.

Yes I had a visit on one of my sites, however, could only see the alteration to the component file and an additional html file installed in site root. Checked config file, no changes there. Have uninstalled calendar as well as associated mods, will await to see new replacements.

Hi
Consolation for me, I am not alone.
Right midnight my site was hacked in front of me! They changed the admin password, and then dont know what did.
I had to request a site restore to my hosting, (I dont have the privilegde.)

Who can I blame!

alamgir

Has anyone tried Events Calendar? There's a fairly recent beta release.

david

HI RobS
Would like to PM the IP etc but unable to

You are not allowed to send personal messages

Am I missing a trick here on how to PMS

Is there a new secure version of ExtCalender we can use?

// no direct access
defined( '_VALID_MOS' ) or die( 'Restricted access' );

insert this in extcal.php  as far as i read this fiexes the problem? RIGHT?

Thanks alot albi m8, but can this be used with Mambo 4.5.3?