My host suspend my site

crow · **Posted:** Tue Mar 07, 2006 11:52 am

Here is little story with my host (now old host).

It sims my site was hacked, and hacker have placed his files deep inside my site folder. THe files are from some UK Bank, and my host got email and tey immediately suspend my page. THe file site contains this:

Quote:

RSA Cyota, an anti-fraud and security company, acting on behalf of Barclays Bank PLC (a leading UK bank) has been made aware that you appear to be providing Internet Services to a fraudulent site, which is part of a “phishing scam”**, and which violates Barclays’ copyright, trade marks and other intellectual property rights.

E-mails have been sent to individuals by a fraudster pretending to be Barclays Bank, requesting them to verify and submit sensitive details related to their Barclays bank accounts.

These files was not mine, so someone have upload them somehow, i asked my host about this and here is they respond.

Replay on Ticked support:

Quote:

Your client is using numerous 777 permissions all over his account. This allows people to upload whatever they want, including phishing scams. I must insist that you changes these permissions immediately to stop this from ever happening again. If not, the client risks getting suspended for the same thing again. If there is anything else I can do to help, please let me know.

Then Another:

Quote:

oomla 1.0.7 does have a security vulnerability in it.

-------------
http://secunia.com/advisories/19105/
-------------

This does allow an attacker to create an arbitrary file in the cache directory. If they create a small shell script to wget the phishing site and writing it to a known 777 directory, like images, then they can upload a phishing scam. I would highly recommend you notify your current users to upgrade to prevent the same from happening again.

If you have any more questions on this issue, please feel free to reply to this ticket to open it back up and I will be happy to assist you further.

Last one:

Quote:

The location of the 777 folder is not the issue. Without the security hole in the Joomla script, there would be no need to worry about the 777 permissions in another folder.

The scripts can write to folders outside of its own folder if the permissions allow. They can load a php shell, then look for a suitable folder (i.e. 777) and then load the files there. As an attacker, if you know the scripts you are exploiting, you will also know which folders are world write by default. So you load a script to load a php shell to that dir. Then you either stay in that dir, or move somewhere more 'private' on the server where nobody will notice extra files.

Because these php scripts are running as the web user (i.e. 'nobody'), they need to find folders with 777 permissions as the nobody user does not have his own place to keep files for web execution. Thus, he searches for folders with 777 permissions, via PHP shells.

The 777 is not a security hole in the sense that you should not use. Sometimes, you cannot avoid it, as with the case of Joomla. But it is recommended that you do not use it unless you absolutely need it.

As always, if you ensure your scripts are secure, you remove the risk of being compromised and having these files put on your site, via your site.

Do you have any more questions on this issue?

Site was using Joomla 1.0.7 (untill 1.0.8 was relesed, i have immediately update to 1.0.8.)
First file in this "ilegal contents" was file with name: ziby.php and his header is:

Quote:

/*
******************************************************************************************************
*
* c99shell.php v.1.0 pre-release build #11
* Freeware license.
* © CCTeaM.
* c99shell - ôàéë-ìåíåäæåð ÷åðåç www-áðîóçåð, "çàòî÷åíûé" äëÿ âçëîìà.
* Âû ìîæåòå áåñïëàòíî ñêà÷àòü ïîñëåäíþþ âåðñèþ íà äîìàøíåé ñòðàíè÷êå ïðîäóêòà:
http://ccteam.ru/releases/c99shell
*
* WEB: http://ccteam.ru
* ICQ UIN #: 656555
*
* Îñîáåííîñòè:

Code is not in Russian language. The i think this script was upload rest of site with folder name: barclays which contain these files:

Quote:

02.03.2006 06:16 4.658 ibank.css
02.03.2006 06:16 138 index.html
02.03.2006 06:16 9.126 LoginMember.html
02.03.2006 06:16 17.038 LoginMembers.php
02.03.2006 06:16 1.212 LoginPasscode.php

I was talking whole way to my host that Joomla couldnt do this, and you see his replay.....
Just to inform that some host dont belive Joomla CMS; (i already changed these host) because suspend time was 14h without letting me know WHY page was suspended..

Thnx

pe7er · **Posted:** Tue Mar 07, 2006 1:06 pm

It's not a Joomla vulnerability. Other php packages had similar problems: http://www.simplephpblog.com/comments.p ... 903-215935
c99shell.php is a PHP/BackDoor.gen, a "remote access trojan written in PHP scripting language.": http://isc.sans.org/diary.php?date=2005-11-13

mad_gertje · **Posted:** Tue Mar 07, 2006 3:51 pm

You should always CHMOD the folders and files as stated on the forum :

kenmcd once wrote:

Quote:

The current Joomla installation defaults are:
- Files: 0644
- Directories: 0755

ok so in futere chmod them properly, but do you get charged for anything now?

CreepingDeath · **Joined:** Tue Mar 07, 2006 8:36 pm **Posts:** 2

If you were in a shared environment - I'm guessing yes - then the problem was actually bigger. They were SPAM mailing the little blurb. It's a PHISHING technique. Joomla is not the only CMS subject to this type of attack. Most PHP based CMS's are vulnerable by the nature of PHP. It's really a server hosting issue. Questions like chrooted environment, openbasedir restrictions, is the tmp mount executable, etc. etc. should always come up. I am new to Joomla as a 3PD - and have been watching one of my Joomla sites for some time. Many of the same scripts that I see hit other CMS's I support hit Joomla as well. Nothing new here, but too bad that your OLD host did that to you. My hosting company - I own - we don't do that. We actually dig in to the access_logs etc and block offenders or at the very least identify botnets and report them. Good luck!

crow · **Posted:** Tue Mar 07, 2006 8:55 pm

mad_gertje wrote:

You should always CHMOD the folders and files as stated on the forum :

kenmcd once wrote:

Quote:

The current Joomla installation defaults are:
- Files: 0644
- Directories: 0755

ok so in futere chmod them properly, but do you get charged for anything now?

Well i cant chmod to 755 because at my system it is not writable by Joomla.
Example: i chmod 755 to configuration.php and here is from Joomla:
configuration.php is : Unwriteable

Hackwar · **Posted:** Tue Mar 07, 2006 11:05 pm

mmmh, thats basically the idea behind this...

Will you (ever) need to write something into your configuration.php? Will you (ever) have to change files or folders besides images, etc.? If you can say no, after your site is set up, you should set your folders accordingly. Joomla does not need to be able to write to those files and folders, unless you specifically want to change something. Its not trying to write to the files each time it is loaded.

crow · **Posted:** Wed Mar 08, 2006 10:34 am

Hackwar wrote:

mmmh, thats basically the idea behind this...

Will you (ever) need to write something into your configuration.php? Will you (ever) have to change files or folders besides images, etc.? If you can say no, after your site is set up, you should set your folders accordingly. Joomla does not need to be able to write to those files and folders, unless you specifically want to change something. Its not trying to write to the files each time it is loaded.

Ok configuration.php is not always 707, only when i need to edit something in Global Configuration, i add that permission. That was only example.
But i think that some files must be writable by joomla. My site manages add news they need images folder to be able to write or?
What files need to be always 707 and what not, mybe that can be added to help.joomla.org... I always chmod folders on installation and live they permission....
My host sey that Joomla has been used to upload that shell script, they didint prove it only say that i have joomla and that it was used from attacker.

Thnx

Hackwar · **Posted:** Wed Mar 08, 2006 10:46 am

You would only have to have the folders and files writable that you have to write something to. Unless you are installing new extensions, this would only be the images-folder.

Joomla! Discussion Forums

Forum rules

My host suspend my site

Quick reply

Who is online