Is your Joomla Site Compromised?
If you have had your Joomla site compromised the steps below will assist you in recovery. It is important to make sure that you are using the latest version of Joomla and that you check the List of Vulnerable Extensions . Most attackers usually find their way into your site through security exploits in 3rd party extensions or outdated version of Joomla.
1. Change all relevant passwords
Assume your passwords have been harvested and immediately change all critical passwords, including shell access, FTP access, Joomla! Administrator accounts, and the database account.
2. Check raw logs
Identify when and how the attackers gained access to your site by carefully reviewing your raw server logs. Make careful note of the date/time and names of attacked files. Note that these logs may have been deleted or altered, so a lack of evidence does not prove a lack of activity.
3. List recently modified files
Before making any changes to your site, make a list of recently modified files. You can check file modification dates with most FTP clients.
4. Note suspicious newly-created files
Use this list to identify new files that don’t belong. Pay particular attention to their creation and modification dates, and correlate them to the dates of attacks shown in your log files.
5. Note suspicious recently-modified files
Check the modified files list for any files that were recently changed. Pay particular attention to the modification, and correlate them to the dates of attacks shown in your log files.
6. Coordinate with your host
If you have identified how you were cracked, report the method to your host. If you are on a shared server, you may have been attacked through another vulnerable site on your server. Report this to your host. A reputable host will appreciate your efforts in this area.
7. Delete the entire public_html directory
This is the best way to guarantee that every potential vulnerability in that site is removed.
8. Delete related database records
This step may only be possible if you have good backups. Simple script kiddies, who are only trying to mark your index page, may not attack your database, but professionals are usually very interested in confidential data, such as passwords. They may pose as script kiddies to avoid suspicion while repeatedly harvesting confidential information from your database.
9. Reinstall everything
Use pre-crack backups. If you don’t have good backups, go on to step 10.
10. Reset critical passwords again
You must reset your passwords again now that your server is finally cleaned of any possible, hidden trojan horses.
11. Rebuild site
If you are unable to rebuild from clean backups, rebuild your entire site using original installs, from prior to the compromising of your site. Use only the latest stable versions of all software, and check the List of Vulnerable Extensions
12. Review security processes
Follow standard security precautions for important settings in globals.php, configuration.php, .htaccess, etc.
13. Review backup processes
If you don’t already have one, add a dependable backup process to your site administration practices.
14. Stay watchful
Attackers often return repeatedly. Closely monitor your raw logs for suspicious activity.Joomla! is the perfect Content Management System for managing and developing your website with one of AUSWEB’s cPanel Hosting plans.
