Strange “Joomla!” Behavior, Hackers, and Patching

Yesterday was a interesting day at the office for me. We received a call from a new do-it-myself client. A few days prior a woman had come to us with some website background was interested in Joomla! so we set her up. I created the hosting account for her, uploaded and installed Joomla! installed half a dozen extensions that I’ve written down on my Install on every Joomla! site” list, created her a user account as was done in less than 2 hours.

Or so I thought. Then comes the call. Of course her being a Joomla! newbie I expected multiple calls from her asking for assistance on various things; however the issue she was having had this “scene it all” Joomla! user mystified. I went to the site and saw that all the demo data was gone and my logins didn’t work. Weird – I thought for sure I had installed the demo data as I almost always do. I logged into phpMyAdmin and saw some very weird tables. What should have been “jos_x” tables were replaced by “bak_x” tables. What could cause this?

I decided my best bet to getting her site up and running again would be to simply re-upload the installation directory, drop all the database tables, and rerun the install. I did and everything returned to normal. But, what caused this!? It drove my nuts. I decided to contact my hosting company to ask them if they had been having server issues or something of that nature. “Hacked” came the word back from the help desk. How could I be hacked? The site wasn’t even live and it was unlike any other hack I had ever seen. My support technician razed me about upgrades. Upgrades? “Who has time for those?” I complained. I have over 100 Joomla! sites, 20 of which are running Joomla! 1.5 and I’m supposed to keep them all running the latest version? The answer is simple: “Yes”.

Here’s the low down of what I ended up doing. Upgrading. A lot. I downloaded probably 6 different patch packages from Joomla.org and applied them to over 20 websites. Now I realize that a lot of developers have hundreds of sites and caring for them all is a time consuming process. If your company is built on time and hours it can be very disruptive to have to download a patch and apply it to 20+ websites (I speak from experience!). However, out of the 20+ sites I upgraded at least one other one was hacked without anyone being aware.
My advice is simple: Get the patches. If you stay on top of them you will save yourself and your clients time in the long run. If you notice deleted content, strang e directory permissions or files or other seeming strange “Joomla!” behavior I strongly recommend you take a closer look. Your site might be compromised without your knowledge.

Resources:

Details: Published: 16 January 2009