Solved

Server Hack - IRC Daemon from Joomla

Posted on 2014-03-07
6
404 Views
Last Modified: 2014-06-16
Hi,

We have an older Joomla 2.5.? site on a shared host.

Our host emailed to say that the server was hacked and that our account was directly responsible (ish).

The hacker was attempting to turn the server into an IRC Daemon to join a botnet (as claimed by our hosting company).

This seems odd, as my limited understanding suggests that installing software into a server requires command prompt access.

Just want to see if it is possible / likely that an insecure version of Joomla could allow a hacker to compromise a server to the point where they could setup an IRC Daemon.

Or should I be chasing the hosting company to patch their server directly.

Cheers
0
Comment
Question by:stirlingit
6 Comments
 
LVL 58

Accepted Solution

by:
Gary earned 100 total points
ID: 39913017
It is very possible.  
You should always make sure your software is upto date (including extensions) - Joomla, WP etc are notorious for being hacked - it's the downfall of open source software

Obviously they have blocked it but you need to clean up your site.
0
 
LVL 61

Expert Comment

by:gheist
ID: 39913197
There are about 50 vulnerabilities allowing upload and execution of code in Joomla 2.5.0.
Did they notify you about security issue in advance? Any proof you are at fault? Are thay able to provide you with joomla-as-a-service like they do with PHP?
0
 
LVL 27

Assisted Solution

by:serialband
serialband earned 100 total points
ID: 39913827
There a lot of broken php code out there that allows for access to your disk.  An IRCbot server doesn't to be root to run on linux.  Did they tell you which IRCbot they've discovered?  That should help you narrow down the search.

You should run rootkit hunter.  

http://www.rootkit.nl/projects/rootkit_hunter.html
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 58

Expert Comment

by:Gary
ID: 39913836
He's on shared hosting, he's not going to have root access. Anyway sounds like the host blocked it.
0
 
LVL 61

Assisted Solution

by:gheist
gheist earned 100 total points
ID: 39914325
The most logical would be to restore your content from backup on fresh joomla and make sure to update it sometimes (subscribing to Xss or anouncement mailing list is good idea)
0
 

Author Closing Comment

by:stirlingit
ID: 40137086
Was not a solution, rather was just looking for information :)
0

Featured Post

Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

Join & Write a Comment

Introduction We as admins face situation where we need to redirect websites to another. This may be required as a part of an upgrade keeping the old URL but website should be served from new URL. This document would brief you on different ways ca…
Most ColdFusion developers get confused between the CFSet, Duplicate, and Structcopy methods of copying a Structure, especially which one to use when. This Article will explain the differences in the approaches with examples; therefore, after readin…
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now