Download - Secrets to a Hack-Proof Joomla Revealed

SECRETS TO A HACK-PROOF JOOMLA

REVEALED!Daniel Kanchev

Joomla Performance Guru

SiteGround.com - Expert Joomla Hosting

BEFORE WE BEGIN...

• 7+ years of Joomla! experience

• 4 years with SiteGround

• Love traveling the world

• Addicted to extreme and not secure sports

2 SiteGround.com - Expert Joomla Hosting


WHO SHOULD CARE ABOUT SECURITY?

• Application/Extension developers

• Hosting providers/system administrators

• YOU (end Joomla users)

3


WHO SHOULD CARE ABOUT SECURITY?

• Application/Extension developers

• Hosting providers/system administrators

• YOU (end Joomla users)

4

EVERYONE


Why should YOU care?

• Be trustworthy by protecting your clients’ data

• Have a healthy site - avoid substantial data loss/downtime

5


How hackers work?

6


Everyone’s responsible!

7


Security is a process!

KEEP

CALM IT’S NOT

ROCKET

SCIENCE

8


IS YOUR SERVER SETUP RIGHT?

9


Server config & tips• Update server software - Apache, ftp, mail, etc

• Harden the Linux kernel - grsecurity

• Chroot processes

• Use Suexec, secure PHP setup (fastCGI)

• Provide only restricted shell access

• Disable/remove unused services

✓Software solutions: 1H Hive, Better Linux, CloudLinux

10


Protect your web server with mod_security

• OWASP rules - http://goo.gl/rC7Uz

• Atomic rules - http://goo.gl/Fv3Vn

• Trustwave paid rules - http://goo.gl/9IAaB

11

http://goo.gl/rC7Uz

http://goo.gl/rC7Uz

http://goo.gl/9IAaB

http://goo.gl/9IAaB


PROTECT JOOMLA!

12


#1: Update Everything!

13


SiteGround Auto Updates

14


#2: Do The Basics

• Never user admin as username

• Use a secure password

15


Use Bullet-proof Passwords

• Avoid password generators

• Don’t use common words - love,pass, admin

• Avoid personal info, names, significant dates - daniel123

16


The Perfect Password

• Choose a favorite (not famous) movie quote/large phrase from a book:

We all go a little mad sometimes

• Add punctuation symbols ( ? ! . : ) and capital letters, remove whitespaces

Result: We.all?Go!Alittle1Mad2sometimes

17


#3: Password Protect Your Administrator Folder

18

cPanel

Password Protect Directories

Administrator


#4: Restrict The Admin Area Access By IP

• Step1: Check your IP -> whatismyip.com

• Step2: Add this rule in the administrator folder .htaccess file

deny from allallow from YOUR_IP_ADDRESS

19


#5: Fix your permissions & ownership

• Folders: 0755

• Files: 0644

• Configuration.php: 444

• NEVER EVER USE 777 permissions

20


Fix permissions in cPanel

21

cPanel

File Manager


#6: Keep PHP Scripts In The Right Folders

In media, libraries, logs, language folders:

<Files *.php>

deny from all

</Files>

22

SiteGround.com - Expert Joomla Hosting23

How To Do It In File Manager


#7: Legacy security issues

24

• Change the default admin username

• Change the default jos_ DB prefix

ForJoomla 1.5 or older


#8: Check Your Extensions

• Joomla Vulnerable Extensions List

http://vel.joomla.org/

• National Vulnerability Database

http://web.nvd.nist.gov/view/vuln/search

25

http://vel.joomla.org

http://vel.joomla.org




Stay On Top Of Security Updates

• Subscribe to the Joomla feeds:

✓http://feeds.joomla.org/JoomlaSecurityNews

✓http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions

26

http://feeds.joomla.org/JoomlaSecurityNews

http://feeds.joomla.org/JoomlaSecurityNews

http://feeds.joomla.org/JoomlaSecurityVulnerableExtensions





Build a Joomla security RSS feed

How to do it: http://is.gd/Vze1Zo

http://is.gd/Vze1Zo

http://is.gd/Vze1Zo


#9: Additional protection through .htaccess rules

• Remove PHP sensitive information

• Avoid Visual Fingerprinting

• Block some popular tools used by hackers

How to do it: http://is.gd/pGfVXQ

28

http://is.gd/pGfVXQ

http://is.gd/pGfVXQ


#10: Use Joomla Security Extensions for IDS/IPS

• jHackGuard

• Akeeba Admin Tools

• jomDefender

• jSecure

29


SQL Injection

• SQL code + search form screenshot

30

SELECT * FROM users WHERE name = 'a';DROP TABLE users; SELECT * FROM userinfo WHERE 't' = 't';!!!


jHackGuard setup

• SQL Injections

• Remote URL/File Inclusions

• Remote Code Executions

• XSS Based Attacks

Download it here: http://is.gd/01wLhH31

http://is.gd/01wLhH

http://is.gd/01wLhH


#11: Backup! Backup! Backup!

--Manual backups --Your host --Akeeba Backups


NOW WHAT?


DON’T PANIC!


DISASTER RECOVERY PLAN

1. Create a copy of the hacked site + all logs

2. Restore from a clean backup

3. Quarantine your site - enable maintenance mode

4. Check the logs for the malicious code

5. Resolve the security issues/Clean malicious code

6. Unquarantine* your site - disable maintenance mode

35


FEW THINGS TO TAKE AWAY

• Security is about making it harder to infiltrate - not making it impossible

• Security is an ongoing process

• Everyone is involved

36


QUESTIONS TIME!


WWW.SITEGROUND.COM/WEBINAR

http://WWW.SITEGROUND.COM/WEBINAR

http://WWW.SITEGROUND.COM/WEBINAR

THANK YOU!Daniel Kanchev

[email protected]

mailto:[email protected]

mailto:[email protected]

Download - Secrets to a Hack-Proof Joomla Revealed

Top Related