Solved

Server Hack - IRC Daemon from Joomla

Posted on 2014-03-07
6
406 Views
Last Modified: 2014-06-16
Hi,

We have an older Joomla 2.5.? site on a shared host.

Our host emailed to say that the server was hacked and that our account was directly responsible (ish).

The hacker was attempting to turn the server into an IRC Daemon to join a botnet (as claimed by our hosting company).

This seems odd, as my limited understanding suggests that installing software into a server requires command prompt access.

Just want to see if it is possible / likely that an insecure version of Joomla could allow a hacker to compromise a server to the point where they could setup an IRC Daemon.

Or should I be chasing the hosting company to patch their server directly.

Cheers
0
Comment
Question by:stirlingit
6 Comments
 
LVL 58

Accepted Solution

by:
Gary earned 100 total points
ID: 39913017
It is very possible.  
You should always make sure your software is upto date (including extensions) - Joomla, WP etc are notorious for being hacked - it's the downfall of open source software

Obviously they have blocked it but you need to clean up your site.
0
 
LVL 61

Expert Comment

by:gheist
ID: 39913197
There are about 50 vulnerabilities allowing upload and execution of code in Joomla 2.5.0.
Did they notify you about security issue in advance? Any proof you are at fault? Are thay able to provide you with joomla-as-a-service like they do with PHP?
0
 
LVL 28

Assisted Solution

by:serialband
serialband earned 100 total points
ID: 39913827
There a lot of broken php code out there that allows for access to your disk.  An IRCbot server doesn't to be root to run on linux.  Did they tell you which IRCbot they've discovered?  That should help you narrow down the search.

You should run rootkit hunter.  

http://www.rootkit.nl/projects/rootkit_hunter.html
0
Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

 
LVL 58

Expert Comment

by:Gary
ID: 39913836
He's on shared hosting, he's not going to have root access. Anyway sounds like the host blocked it.
0
 
LVL 61

Assisted Solution

by:gheist
gheist earned 100 total points
ID: 39914325
The most logical would be to restore your content from backup on fresh joomla and make sure to update it sometimes (subscribing to Xss or anouncement mailing list is good idea)
0
 

Author Closing Comment

by:stirlingit
ID: 40137086
Was not a solution, rather was just looking for information :)
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

In Solr 4.0 it is possible to atomically (or partially) update individual fields in a document. This article will show the operations possible for atomic updating as well as setting up your Solr instance to be able to perform the actions. One major …
Introduction This article explores the design of a cache system that can improve the performance of a web site or web application.  The assumption is that the web site has many more “read” operations than “write” operations (this is commonly the ca…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

947 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now