Over the past weekend (July 25th-26th), I got a notice from my Joomla sites that a file (index.php) had been modified on several sites on my Virtualmin server. Due to work timing, I didn’t get to dig into it until today, when I noticed I was getting 403 Access Denied errors when trying to log into the Joomla sites. Doing a check in Virtualmin, I was able to whack the .htaccess files and gain access, at which point I saw files and directories added to my site’s file structures. I quickly deleted the sites, then restored from a backup from before the compromise.
After this was done, I took a look at ALL my sites hosted on Virtualmin, and found several more that had the same files / folders added - some were simple proxy sites with no content, others were plain HTML sites.
Before I whack and restore them, I wanted to check - should I be doing anything with these file or sites, to find out how they were compromised? If there’s a weakness in my server, I’d like to patch it, but I am not sure how to find out how they got access in the first place - via Joomla, WP, Apache, or something else.
That’s a lead, thank you. Everything is up to date on all my Joomla sites, but at least one of them was compromised back in June - it’s likely they had access for a while, but didn’t take action until this past weekend.
Given the first thing most likely to happen is for the attacker to install more back doors, I’ll revert everything I can to before June, and work from there.
If you are using JCE editor, there was a recent hack back in June. What you describe sounds similar to what happened to me. There might be a cron job added or a program running that will add .htaccess files and modify your index.php files. Make sure you upgraded JCE editor to the most recent version to repair this vulnerability and look at the crontabs to eliminate unwanted programs.
Thank you for the heads up on the CRON jobs. I’ve rolled everything back, ran all updates, removed JCE from my installs (it wasn’t being used, I had it from years ago when it was), verified I don’t see any unusual CRON jobs, and then removed additional extensions that aren’t critical to the site’s functions any more. (I had a bunch of tools that were used to search & replace, etc., but the sites are archived and largely static now, so removing them is less potential vulnerabilities to deal with.)
