Son of a... Client just got all her sites hacked

[Stephen]

Acronis is full imaging, we have to mount a virtual image then pull the files individually or from a search.

[gsaunders]

@Stephen

Acronis is full imaging, we have to mount a virtual image then pull the files individually or from a search.

Ahh… yea… they have many people hounding them for improving their scheduling and their restore file ability.

[Stephen]

It is good software but for file restores it takes a bit longer. At least it does not TAKE 15 hours to take a backup with it like a file based backup solution.

We can restore a full account or single domain in a matter of minutes however.

[gsaunders]

FYI: The client said that several of their sites are broke now and that it looks like some incorrect index files were restored.

I didn’t get a chance to look at it as they have replaced the bad ones and things are working… so far… so I don’t really know if something was incorrectly restored or what.

So at this point I am waiting for them to let me know if they need anything else at all.

[gsaunders]

My client has a question regarding security… she is seeing this in the Joomla admin area:

Following PHP Server Settings are not optimal for Security and it is recommended to change them: PHP register_globals setting is ‘ON’ instead of ‘OFF’

Recommendations? Isn’t this a JodoHost setting?

Thanks

[Stephen]

Hello Greg,

you user can use a custom php.ini but many apps will fail if this setting is off, a properly coded app does not have to worry about the register globals.

As for file problems, Prakash did exactly what was asked from the backup at the 26th morning about 3am. I guess it is POSSIBLE someone had planted some files before this time and only defaced at 6:21pm of the 26th.

[gsaunders]

@Stephen

Hello Greg,

you user can use a custom php.ini but many apps will fail if this setting is off, a properly coded app does not have to worry about the register globals.

As for file problems, Prakash did exactly what was asked from the backup at the 26th morning about 3am. I guess it is POSSIBLE someone had planted some files before this time and only defaced at 6:21pm of the 26th.

Well… it looks like the are good to go now… they are just trying to tighten everything down.

Thanks

[gsaunders]

@Stephen

Hello Greg,

you user can use a custom php.ini but many apps will fail if this setting is off, a properly coded app does not have to worry about the register globals.

As for file problems, Prakash did exactly what was asked from the backup at the 26th morning about 3am. I guess it is POSSIBLE someone had planted some files before this time and only defaced at 6:21pm of the 26th.

I just got this email from my client (They said this came from the lead developer of Joomla):

?Register_globals is only a security concern if allow_url_fopen is on. You should talk to your host about turning that off, and then you can use register_globals safely.?

Is allow_url_fopen on? Comments?

Thanks

[Prakash]

Yes, we are allowing allow_url_fopen as it is required programmer to access external links. You may use a custom php.ini and get it OFF for corresponding domain.