Hacking and security

[PaddyDisplays]

When you say dedicated do you mean a "managed" dedicated server? or are you in charge of server maintenance?

As for joomla I think there are security updates for 1.5 (best check if its still supported, just make sure you have them upto date.  to late now unless you have a backup before the hack then, update straight away and change passwords (there is a  how to recover from a hack guide for this on the joomla site)

If the hacker got into you joomla site and was able to get you database passwords and if that was a master user account that also had access to the wordpress database then I could see how they could have gotten into both.  Of if the word press site is on the same domain  as the hacked joomla site, then again they could get into the wordpress site. Or if you used common usernames or passwords for the different sites.

But the most important with any opensource software is to make sure that your uptodate with security fixes, because as soon as there is a exploit found script kiddies search the web for vulnerable site and have there fun.  I'm know what "cloudlinux with cageFS" is but as your host says it would not have stopped this hack.

[ClaireH-184886]

hi, it is a managed dedicated server where they look after everything.

there is a joomla site on there that was not hacked but all the other sites were hacked including wordpress.

all the wordpress sites were upto date but there were three joomla sites that were in joomla 1.5 instead of joomla 3.

we were told when we moved up to a bigger and newer dedicated server it was secure from hacking but we have now been hacked.

i am trying to find out, how this has happened, this happened over 24 hours ago and still they are sorting out putting the back up of the sites live but it seems to be taking a long time.

we have another site on there which is not ours who we let use the space and they have a it expert on board who claims this should not have happened even if there was a older joomla site on there.

they claim that the hosting company should have made everything secure and has suggested we move to a better server that is secure.

i am not technically minded so not sure what we should do, if it was the hosting company fault or not.

[PaddyDisplays]

If each site was on a different domain and were completely separate (separate ftp access, separate mysql database access,  no master/common username and passwords etc)  then that might point to a problem with the hosting side, but to be honest it really hard to know, with our proper investigation.

Since your not technically minded you would be better getting someone with more technical knowledge to review you current setup to see if it was the hosts failing or it was the way you have your sites set up, there is just too many unknowns to get conclusive help from a forum.

Hope that helps

[ClaireH-184886]

ok thanks. The sites all have their own access but are all on the dedicated server. they can all be gained through a whm where we can change cpanel passwords and usernames but besides that they have no connection.

[PaddyDisplays]

I'm not an expert (but have some experience) , but if they are truly separated, and the word press sites were up to date but were hacked too, then there is something very wrong.

[ClaireH-184886]

i am waiting for the hosting company to get back to me, they have been working on this now for over 24 hours, i have sent them some questions but they have said they cannot answer them yet. it seems strange that the wordpress sites were hacked and they were all hacked even though they all had seperate logins

[ClaireH-184886]

just got this from my hosting company

Hello,

1. The server was not hacked. The application on these account has been compromised. In order to have the exact reason and coding vulnerability which allowed this to happen you may contact certified developer as we do not offer development services at this point.

2. Review the above. What we do is secure the service on the server by applying all the patches available for the same. The coding and the updates on your website functions and coding is your responsibility. The review and patching of any script you use for your website is development related task.

3. Again you will have to request this from expert web developer as s/he may review the coding of your website and provide the reason why and how it has been compromised.

4. Contact certified developer with proven feedback to review and patch your websites coding.

5. The answer to this question you may check here:

http://docs.cloudlinux.com/

Should you have any further questions or comments please do not hesitate to contact us.

Best regards,

[PaddyDisplays]

Yeah standard, "its not our problem" response.

As I said before, if the joomla site shared something like mysql database access then it was most likely not the hosts fault.

I have seen hosts blame opensource cms when actually they were just trying to hide their issues.  Its going to be impossible to know until someone looks properly into it (which hosts will not do, which is fair enough).

[AlanMosley]

I don't think its the server, wordpress and other cms are continually hacked. The server can not stop much at all. your code needs stop most hacks, and since wordpress is used by so many, all some one needs to do is hack their own and then they can go out and hack all wordpress sites of the same version.

[PaddyDisplays]

What your saying is true, but I have never heard of anyone getting hacked (bar brute forcing password or poor passwords), if they keep upto date with the security fixes.

Some hosts eg dreamhost will auto update installs for you , so you don't have to worry about  updating.

[ClaireH-184886]

will have to look at dreamhost and see how much they charge for dedicated server. do they offer managed dedicated server. also the hosting company is not taking any responsibility.

would you expect the hosting company to let you know that your site has been hacked or is it down to yourself to know

[PaddyDisplays]

I have only used dreamhosts shared hosting, don't know about dedicated.

"would you expect the hosting company to let you know that your site has been hacked or is it down to yourself to know"

Generally no, that you be your responsibility (or if your have a maintenance contact with the web developer).

Again dreamhost has some cool auto safe guards eg one of my clients had malware/virus on his pc and was sending out spam, they auto reset the password when it was picked up.  I also think they have other auto features to inform you about hacking, but its guaranteed service, its just a bonus they do.

I'm not saying you should go with dreamhost, I'm just telling you what they can/have done, (i have only use a few host companies)  but I'm sure there are alot of hosts that do that too (maybe even more).

[altecdesign]

The wordpress hacking was almost surely due to having outdated version of WP, or having a vulnerable plugin installed.  There are a few helpful plugins you can use to secure your WP site, plugins like (http://wordpress.org/plugins/better-wp-security/).

also a couple things to note, you should also take basic measures to project the site by changing the default table prefixes of your DB from _wp,  create a new admin user and delete the default "admin" accoun & limit access to your wp-admin section in your .htaccess file.... these security plugins will give you a whole checklist of items to "secure".