The Joomla! Forum ™

Download

Demo


Board index » Joomla! Announcements » Announcements » Announcements Discussions

Forum rules


Please click here to view the forum rules



Post new topic Reply to topic  Page 1 of 2
  [ 53 posts ]  Go to page 1, 2  Next
  Print view Previous topic | Next topic 
Author Message
louis.landry
 Post subject: Discuss: A long day...
PostPosted: Sun Aug 19, 2007 9:40 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Wed Aug 17, 2005 11:03 pm
Posts: 1387
Location: New Orleans, Louisiana
In reference to: http://forum.joomla.org/index.php/topic,203290.0.html

Discuss here.

Thanks,

Louis

_________________
Development Working Group Coordinator
http://webimagery.net - Consulting
http://jxtended.com - Solutions for Joomla! 1.5
A hacker does for love what others would not do for money.
Top
 Profile  
 
infograf768
PostPosted: Sun Aug 19, 2007 9:46 am 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 15407
Location: **Translation Matters**
A long day indeed... and night... hehe  :laugh:

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 1.7/2.5: http://help.joomla.org/files/EN-GB_mult ... torial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group
Top
 Profile  
 
louis.landry
PostPosted: Sun Aug 19, 2007 9:47 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Wed Aug 17, 2005 11:03 pm
Posts: 1387
Location: New Orleans, Louisiana
Yes ... it is nearly 5am now ... and I am exhausted .... we will be working to bring back as much as we can in the next few hours.

Louis

_________________
Development Working Group Coordinator
http://webimagery.net - Consulting
http://jxtended.com - Solutions for Joomla! 1.5
A hacker does for love what others would not do for money.
Top
 Profile  
 
Rochen
PostPosted: Sun Aug 19, 2007 9:48 am 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Wed Aug 17, 2005 3:19 pm
Posts: 142
Location: United Kingdom
As Louis says it has been a long day but I am glad the problem has been tracked down and isolated.

I think we are lucky that the particular component that was exploited is only used on the Joomla shop site and not by the community at large or this could be a much more serious problem.

You will see the main Joomla site coming up shortly and the others will follow not far behind. We are just sorting out the backups and then a final security sweep will be done before going live again.

- Chris

_________________
Chris Adams - CEO - Rochen Ltd.
http://www.rochen.com - Performance Joomla Hosting Solutions - Make your Joomla! install fly.
http://blog.rochen.com - Great security tips and more for Joomla!
Follow us on Twitter @rochenhost
Top
 Profile  
 
LorenzoG
PostPosted: Sun Aug 19, 2007 9:51 am 
User avatar
Joomla! Virtuoso
Joomla! Virtuoso
Offline

Joined: Fri Aug 19, 2005 8:46 am
Posts: 3010
Location: Stockholm, Sweden
Thanks Louis and the rest of the team.

Nice to hear that it seems to be a custom component that is the culprit and not the core itself.
I also think it's important to stress that we never should post who did it or any references and in this way give those hackers and script-kids any credits.

_________________
Industributik - http://www.industributiken.se
Top
 Profile  
 
Robin
PostPosted: Sun Aug 19, 2007 9:54 am 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Thu Aug 18, 2005 10:41 am
Posts: 15733
Thanks everyone, for all the hard work!

_________________
Regards Robin

http://www.linkedin.com/in/robinmuilwijk - http://twitter.com/i_robin
Top
 Profile  
 
infograf768
PostPosted: Sun Aug 19, 2007 9:55 am 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 15407
Location: **Translation Matters**
LorenzoG wrote:
I also think it's important to stress that we never should post who did it or any references and in this way give those hackers and script-kids any credits.

Can't agree more!
When reporting such events, the best way to act is to propose to mods in the forum concerned to send a pm with the details if these are no more available.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 1.7/2.5: http://help.joomla.org/files/EN-GB_mult ... torial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group
Top
 Profile  
 
JacquesR
PostPosted: Sun Aug 19, 2007 9:56 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Sat Aug 18, 2007 11:28 pm
Posts: 9
Thank you Louis for your open and frank announcement.

It does however still concern me that various other Joomla sites (mostly foreign language) were also defaced yesterday and today by the same person/group.

Since you state that the suspected component was (to your knowledge) never publicly released, was other exploits used for those sites, or do other components share a similar vulnerability?

regards,
Jacques
Top
 Profile  
 
RussW
PostPosted: Sun Aug 19, 2007 9:56 am 
User avatar
Joomla! Exemplar
Joomla! Exemplar
Offline

Joined: Sun Oct 22, 2006 4:42 am
Posts: 9317
Location: Sunshine Coast, Queensland, Australia
Louis

Thanks for the prompt and detailed announcement, I am sure it will put a lot of peoples minds at rest.

Also, a massive thank you to those "at-the-coal-face" behind the scenes .....


Maybe we can take some good away from this unfortunate occurrence and take this opportunity to remind the Joomla! Community at large to be vigilant in their configurations and mindful of their sites' security.

  - Joomla! Security Announcements
  - Joomla! Security Forum
  - Joomla! Administrators' Security Guide
  - Joomla! Security and Performance FAQ's Index
  - 3rd Party Extensions Security Forum

_________________
Joomla! on the fabulous Sunshine Coast...
http://www.networksmarts.com.au/
Top
 Profile  
 
Kursat
PostPosted: Sun Aug 19, 2007 9:58 am 
User avatar
Joomla! Explorer
Joomla! Explorer
Offline

Joined: Thu Nov 09, 2006 5:56 pm
Posts: 316
Now it is time to see these guys in jail.

I know Turkish Police Department has an efficient impact on hackers.
Most hackers are catch in 24-36 hours and put in to jail at least 2+ years.


Here some evidences to go hackers.


I http://forum.joomla.org/index.php/topic ... #msg954536

I have also contact phone numbers to help to reach these,
i can give them to joomla officials if needed.

_________________
Generaldots.com


Last edited by Kursat on Sun Aug 19, 2007 10:13 am, edited 1 time in total.

Top
 Profile  
 
Wendy
PostPosted: Sun Aug 19, 2007 9:59 am 
User avatar
Joomla! Hero
Joomla! Hero
Offline

Joined: Tue Nov 22, 2005 5:20 pm
Posts: 2008
Location: British Columbia, Canada
Many thanks to you all for the work and time you are putting in to this.  :)

_________________
Wendy Robinson
Joomla! Community Leadership Team member
Top
 Profile  
 
louis.landry
PostPosted: Sun Aug 19, 2007 10:01 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Wed Aug 17, 2005 11:03 pm
Posts: 1387
Location: New Orleans, Louisiana
JacquesR wrote:
Thank you Louis for your open and frank announcement.

It does however still concern me that various other Joomla sites (mostly foreign language) were also defaced yesterday and today by the same person/group.

Since you state that the suspected component was (to your knowledge) never publicly released, was other exploits used for those sites, or do other components share a similar vulnerability?

regards,
Jacques



I am sorry but I have no way of knowing what exploits may have been used to attack other sites.  There is just no way for me to know.  It does seem, however that the recent wave of vain and childish defacing is much bigger than just the Joomla! world.  I am guessing that this is a concerted effort that has been planned.

These site owners have IPs and such in logs, they should contact the ISPs and file complaints.  It is possible that nothing comes of it, probable in fact ... but it is something.

Louis

_________________
Development Working Group Coordinator
http://webimagery.net - Consulting
http://jxtended.com - Solutions for Joomla! 1.5
A hacker does for love what others would not do for money.
Top
 Profile  
 
JacquesR
PostPosted: Sun Aug 19, 2007 10:10 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Sat Aug 18, 2007 11:28 pm
Posts: 9
louis.landry wrote:
I am sorry but I have no way of knowing what exploits may have been used to attack other sites.  There is just no way for me to know.  It does seem, however that the recent wave of vain and childish defacing is much bigger than just the Joomla! world.  I am guessing that this is a concerted effort that has been planned.


I appreciate that you cannot possibly know the cause of the other sites's hacking.

There does seem to be a focus by this person on Joomla sites, and even though we now know how access was gained to joomla.org sites, it is still not clear how the other sites was hacked, and therefore the real concern remains that more sites could follow using a possible similar exploit.

In trying to find a common exploit, I'm trying to help to prevent this person (or copy-cats) from affecting other Joomla-based sites.

I sent a link to RobS (though your site) for your info. (mailboxes are full)

regards,
Jacques


Last edited by JacquesR on Sun Aug 19, 2007 10:16 am, edited 1 time in total.

Top
 Profile  
 
hornos
PostPosted: Sun Aug 19, 2007 10:15 am 
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Fri Aug 19, 2005 7:08 pm
Posts: 176
Location: France
JacquesR wrote:
In trying to find a common exploit, I'm trying to help to prevent this person (or copy-cats) from affecting other Joomla-based sites.

the answer:
Rochen wrote:
I think we are lucky that the particular component that was exploited is only used on the Joomla shop site and not by the community at large or this could be a much more serious problem.

_________________
Ivan

http://www.joomla.fr
http://www.lapatagonie.com
Top
 Profile  
 
TomT
PostPosted: Sun Aug 19, 2007 10:16 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Thu Aug 18, 2005 5:50 am
Posts: 1134
Location: Amsterdam
It's such a waist of time for everyone, this vandalism..... I hope you can all get some much deserved rest soon.

Thanks, Tom

_________________
http://www.tastymouse.com/]tastymouse.com
Top
 Profile  
 
masterflafer
PostPosted: Sun Aug 19, 2007 10:19 am 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Tue Aug 07, 2007 8:52 pm
Posts: 12
I hope they will end up in jail.

Googling their names I found couple sites where they show their "success". WTF ???
They have also site and forum.
There must be way to find them and bring them to justice.
Top
 Profile  
 
JacquesR
PostPosted: Sun Aug 19, 2007 10:22 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Sat Aug 18, 2007 11:28 pm
Posts: 9
hornos wrote:
JacquesR wrote:
In trying to find a common exploit, I'm trying to help to prevent this person (or copy-cats) from affecting other Joomla-based sites.

the answer:
Rochen wrote:
I think we are lucky that the particular component that was exploited is only used on the Joomla shop site and not by the community at large or this could be a much more serious problem.


You may be miss-understanding what I'm saying here.

I won't post the link here that confirms what I'm trying to say, but the same cracker defaced various private sites (yesterday and today) using an unknown exploit. These sites are not related to the joomla.org sites, but are community sites that are built on Joomla.

Though limited in number (currently), it does seem to suggest that this incident is not confined to joomla.org and needs further attention/investigation.

regards,
Jacques

edit: added clarification


Last edited by JacquesR on Sun Aug 19, 2007 10:28 am, edited 1 time in total.

Top
 Profile  
 
fw116
PostPosted: Sun Aug 19, 2007 10:33 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Tue Sep 06, 2005 11:18 am
Posts: 1364
Location: Germany
thanx for ur report and nice to hear thats not the joomla core..

_________________
Certified Linux Professional, Novell Linux Administrator, Novell Data Center Technical Specialist,
Microsoft Certified IT Professional , Microsoft IT Professional Enterprise Administrator
http://www.schrammen.net http://ballon.schrammen.net
Top
 Profile  
 
RobS
PostPosted: Sun Aug 19, 2007 10:34 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Mon Dec 05, 2005 10:17 am
Posts: 1367
Location: New Orleans, LA, USA
Alright, the main sites are up now.  Yes, I know... not all of them.  I am absolutely exhausted, it is 5:30 in the morning and I am going to bed.  We will finish the other sites  in the morning later.

_________________
Rob Schley - Open Source Matters
Webimagery - http://www.webimagery.net/ - Professional Consulting Services
JXtended - http://www.jxtended.com/ - Free and Commercial Joomla! Extensions
Top
 Profile  
 
masterchief
PostPosted: Sun Aug 19, 2007 10:50 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Fri Aug 12, 2005 2:45 am
Posts: 1932
Location: Toowoomba, Australia
Thanks everyone involved for working the problem and sacrificing the better parts of you collective weekends for the benefits of all.

_________________
Andrew Eddie - Tweet @AndrewEddie
<><
http://learn.theartofjoomla.com - Joomla 2.5 training videos!
http://www.kiva.org/team/joomla - Got Joomla for free? Pay it forward and help fight poverty.
Top
 Profile  
 
hornos
PostPosted: Sun Aug 19, 2007 11:15 am 
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Fri Aug 19, 2005 7:08 pm
Posts: 176
Location: France
JacquesR wrote:
I won't post the link here that confirms what I'm trying to say, but the same cracker defaced various private sites (yesterday and today) using an unknown exploit. These sites are not related to the joomla.org sites, but are community sites that are built on Joomla.
Attacks were not directed to joomla based sites exclusively !!

As mentionned in the annoucement:
Quote:
Of all of our sites, there was one that still had register globals emulation on.  Of all of our sites there was one that had the htaccess file missing and most importantly ... that one site has a remote file inclusion vulnerability
It just means that the guys in charge of http://shop.joomla.org didn't not follow security baselines :P : http://help.joomla.org/component/option ... temid,268/

_________________
Ivan

http://www.joomla.fr
http://www.lapatagonie.com


Last edited by hornos on Sun Aug 19, 2007 11:18 am, edited 1 time in total.

Top
 Profile  
 
brad
PostPosted: Sun Aug 19, 2007 11:17 am 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 12:38 am
Posts: 13169
Location: Sydney - Australia
Great work guys. Thanks for picking up the slack while I was busy this weekend.

_________________
Brad Baker - Follow me on Google+
http://www.rochen.com - Joomla! Hosting, the correct way.
http://www.joomlatutorials.com <-- Joomla Help
..somewhere in this hospital the anguished oink of a pig man cries out for help..
Top
 Profile  
 
jmc
PostPosted: Sun Aug 19, 2007 11:29 am 
Joomla! Guru
Joomla! Guru
Offline

Joined: Thu Aug 18, 2005 9:10 pm
Posts: 682
Location: Hey! I'm in Hartlepool! We hang monkeys!!!
Quote:
this incident is not confined to joomla.org and needs further attention/investigation.

Yes. By the site owners. Who are probably (just like every doofus who comes to these forums bleating about a hack/crack) running any number of insecure components, incorrect chmod, globals on ( :-[), Joomla 1.0.4 (upgrade? why would I wanna do that???) and God knows what else. I hope you'll be as diligent in your pursuit of their answers as you seem to be in hounding the Joomla! team.
There's only one sure-fire method of protecting yourself in these cases - backup - regularly and fully! Be ready to take the hit if you don't. And don't blame anyone but yourself!
And one other thing... what's with all of this "He's not a hacker... he's a cracker" crap that I've seen kicking around in the 6+ pages of posts. WTF??? It's almost like we're giving the scumbags recognised levels of professional qualification!
I've decided that, should I ever be a victim to a defacement of one of my sites, I will take this stance - I have NOT been "hacked" or "cracked" - I've been "SCUMMED". Seems a much more fitting term.  ;)

_________________
When all of your wishes are granted, many of your dreams will be destroyed...
Top
 Profile  
 
Kursat
PostPosted: Sun Aug 19, 2007 11:49 am 
User avatar
Joomla! Explorer
Joomla! Explorer
Offline

Joined: Thu Nov 09, 2006 5:56 pm
Posts: 316
This morning i spoke with one officer friend at Turkish Police Dep. on joomla case.
He told me that if the attacked server (as a starting point) is staying in Turkey they examine the hacked server with website personel and pick attacker to jail in a few days.

If the server is at EU and USA, these countries police dept.s are in tight connection with Turkish PDs. In this case server (area attacked) is examined by those PDs and evidences
examined by Turkish PDs concurrently. Necessary action is taken to the attacker.

In these cases when website owner claims the police help, the case becomes a public case
in all these countries. So the attacker has no chance to live freely at least a few years of time.

Officer said that police help is a necessary to find attacker because website owners can only investigate their own servers and their ISP's helps, but police depts have power to control all the related routers, equipments, related other ISPs/networks information globally.

_________________
Generaldots.com


Last edited by Kursat on Sun Aug 19, 2007 11:52 am, edited 1 time in total.

Top
 Profile  
 
JacquesR
PostPosted: Sun Aug 19, 2007 12:19 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Sat Aug 18, 2007 11:28 pm
Posts: 9
jmc wrote:
Quote:
this incident is not confined to joomla.org and needs further attention/investigation.

Yes. By the site owners. Who are probably (just like every doofus who comes to these forums bleating about a hack/crack) running any number of insecure components, incorrect chmod, globals on ( :-[), Joomla 1.0.4 (upgrade? why would I wanna do that???) and God knows what else. I hope you'll be as diligent in your pursuit of their answers as you seem to be in hounding the Joomla! team.


Not hounding anyone. Only attempting to gain better understanding of the defacement of various sites built on Joomla, yesterday and today (by a spesific individual/group).

The other sites are mostly in Russian or Italian, and I'm unaware if they have forums.

I ask the questions here, since it is a public forum for the Joomla community, and security issues would be of concern to us all.

There is no contradiction in sincerely thanking the Joomla team for all their efforts in restoring the joomla.org sites, and at the same time trying to figure out what commonality there may be between these defacements and those of the other sites.

The knowledge gained could prevent myself and others from falling victim to the same attacks.

I do agree with you that regular backups is a must, since no software or system can ever be 100% secure (mostly due to the human element).

regards,
Jacques
Top
 Profile  
 
cbh
PostPosted: Sun Aug 19, 2007 1:44 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Sun Aug 28, 2005 11:20 pm
Posts: 29
Location: Toronto, Ontario, Canada
Thanks for the detailed information. Just a suggestion - should this announcement not also be posted in the security forum, so that those of use who registered for updates by email can receive it that way as well?

Thanks for all your hard work on this.

Cheers
Chris Hutcheson
Top
 Profile  
 
Tonie
PostPosted: Sun Aug 19, 2007 1:59 pm 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Thu Aug 18, 2005 7:13 am
Posts: 16009
That's a hard one. Neither Joomla nor an extension has been hacked, so this luckily has no consequence for websites running Joomla. In that regard I would probably not mention it there.

_________________
Joomla forum global moderator.

Take care
Top
 Profile  
 
Kursat
PostPosted: Sun Aug 19, 2007 2:01 pm 
User avatar
Joomla! Explorer
Joomla! Explorer
Offline

Joined: Thu Nov 09, 2006 5:56 pm
Posts: 316
Tonie wrote:
Neither Joomla nor an extension has been hacked, so this luckily has no consequence for websites running Joomla.


very nice for community
this is the best new of the day,

_________________
Generaldots.com
Top
 Profile  
 
cbh
PostPosted: Sun Aug 19, 2007 2:06 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Sun Aug 28, 2005 11:20 pm
Posts: 29
Location: Toronto, Ontario, Canada
Tonie wrote:
That's a hard one. Neither Joomla nor an extension has been hacked, so this luckily has no consequence for websites running Joomla. In that regard I would probably not mention it there.


I see what you mean,  in terms of making the announcement and of it being a hard call. I'm not much on the technical side, so a lot of what's gone on, beyond the fact that there was a potential issue I should be watching out for. In that sense it some sort of heads up would be good just to make me aware. Perhaps an announcement along the lines of "not a Joomla issue diretly, but could be a problem" might be a good thing.

Cheers
Chris
Top
 Profile  
 
infograf768
PostPosted: Sun Aug 19, 2007 2:41 pm 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 15407
Location: **Translation Matters**
cbh wrote:
Tonie wrote:
That's a hard one. Neither Joomla nor an extension has been hacked, so this luckily has no consequence for websites running Joomla. In that regard I would probably not mention it there.


I see what you mean,  in terms of making the announcement and of it being a hard call. I'm not much on the technical side, so a lot of what's gone on, beyond the fact that there was a potential issue I should be watching out for. In that sense it some sort of heads up would be good just to make me aware. Perhaps an announcement along the lines of "not a Joomla issue diretly, but could be a problem" might be a good thing.

Cheers
Chris


I posted this as sooon as we got the News concerning the solution of the problem.
http://forum.joomla.org/index.php/topic,203293.0.html

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 1.7/2.5: http://help.joomla.org/files/EN-GB_mult ... torial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 2
  [ 53 posts ]  Go to page 1, 2  Next


Board index » Joomla! Announcements » Announcements » Announcements Discussions

Who is online

Users browsing this forum: No registered users and 6 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group