CiviCRM Community Forums (archive)

Hi,

I am posting to see if anyone knows or has any info about this?  My admin backend site was not accessible this morning and after getting my site audited reviewed, etc. this were the findings (see below):

Is there anything I should do to prevent this in the future - I was running the latest Civi for Joomla when this happened.

QUOTE from Auditor/Security Expert:
(Im just running a mop up audit on the site, but here are my main findings:)


I have now completed the automated and manual parts of the audit of your site with the following results. I have audited the complete folders and files in your webspace, however we have only checked the verson of the Joomla install that powers the domain. It is clear your site was hacked, I have reverted/deleted the files that were found still to be hacked.

You were hacked through com_civicrm OpenFlashChart which has allowed hackers to upload files to
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/

and then to use those files to spread more into your website
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/yarragim.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/x.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/upx.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/ttt.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/sh.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/r57.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/proshell.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/php.ini
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/ismu.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/ini.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/images
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/error_log
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/codee.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/bozload.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/images/load.php
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/images/index.html
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/images/bozload.txt.6
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/images/bozload.txt.5
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/images/bozload.txt.4
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/images/bozload.txt.3
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/images/bozload.txt.2
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/images/bozload.txt.1
/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/images/bozload.txt

I have removed the whole OpenFlashChart folder to give you time to upgrade com_civicrm to patch this, I assume the latest version of CivicCrm fixes this although I cannot see definitive changes in the change log for this.

Thanks Lobo....