I think I've had no less than 5 customers this year get their sites defaced by worms / hackers wannabies etc...
Normally this is due to not being johnny on the spot with the patches that are out there.
I guess my question is why isn't there a better way to manage all these joomla sites... If you're a reseller and have 10/20/100 customers running joomla there needs to be an app for you (the reseller) to simply force a patch to all your joomla installed customer sites... Even with that, you're left with addons/coms that don't get updated as they should.
/sigh...
Personally I'm getting to the point where I don't even want to suggest it to customers anymore. I'm finding it more annoying than helpful.
the most likey culprit is permissions. if you run a secure set of permissions (ie no world readable stuff) you should be in pretty good shape. Joomla is one of the most secure cms' out there.
I too was hacked on February 3, 2008, my whole site was deleted.
That really sucks Peter. >
I hope that you have recent backups.
The member formerly known as Roland Deschain After your question is solved, please Edit your original post and choose the Solved message icon, thank you!
I forgot the most common cause of hacks - 3rd party components!!!! be wary of any 3rd party components and only run the absolute minimum of components. And remember in joomla 1.0, even if you are not using a component, but have it installed, you are still vulnerable. In 1.5 you can actually turn off components without uninstalling to combat this issue.
I have backup of the site, the problem I was using Joomla 1.0.12 or 11 can't recall, I didn't upgrade because I have Joomla bridged with SMF and the SMF bridge doesn't not support Joomla 1.0.13 and 14, the site remains down as it make no sense in restoring because I can't upgrade Joomla due to the bridge issue, I am looking for someone to code/fix the SMF bridge to work with Joomla 1.0.14
The member formerly known as Roland Deschain After your question is solved, please Edit your original post and choose the Solved message icon, thank you!
I would assume it has to do with 3rd party components requiring certain directories, etc to be world writeable when they shouldnt, however that's just my assumption.
Alot of 3rd party components don't focus on security like the joomla core does, and it's VERY easy to make a component that's not secure. Most hacks are the result of holes in 3rd party extensions.. just be wary, stay on top of updates, monitor forums, etc.