If you didn’t update your Joomla site by last Thursday, it’s probably been hacked.
Last week we told you about the critical Joomla update. Joomla released it on Wednesday. Two hacks, combined, would allow a bad guy to create a Joomla user and then elevate it’s privileges to the point that they had complete control of your site.
Sucuri, one of the good guys who track security issues and help fix hacked sites, reverse engineered the fix to see what had been broken. Then they created a way to check if someone had hacked the site. Within 24 hours of the release, they found nearly 30,000 hacked sites.
Hackers in Romania and elsewhere had already automated the hack and Sucuri says that if your site hasn’t been updated, it is most likely already hacked. One sign from the early hack campaign was a new user named “db_cfg.” Of course, now that there are others looking for sites to hack, that may not be the only new user to your site. You may have been hacked more than once!
Ouch.
If you didn’t update your site, give us a call and we’ll help you clean it up.
Freddy is about to learn who the real scam victim is. Instant Karma.
“Instant Karma’s gonna get you…”
I got an email from Freddy scot (sic), he’s got a new company that will be importing Kola Nuts and other Central American ag products.
Freddy is also deaf so we can’t talk on the phone.
He needs a website right away and his budget is from $4000 to $8000. It should look similar to and function just like www.somewebsite.com.
Oh, he needs to pay by credit card.
And he has a consultant who will provide the text and images. But this consultant can’t take credit cards so he wants to overpay me and then have me send a check to the consultant. (Then the scam kicks in: they’ll go for a refund from the credit card company and I’ll be left holding the bag.)
I’ve gotten this exact (word for word) proposal about 8 times in the last 2 years from a number of people, all with Gmail accounts (which can’t be traced) This has led me to believe that somewhere on the dark web some huckster is selling this as a turnkey, cut and paste scam operation and bragging about all the money he’s made. I’m sure it sounds impressive: make thousands of dollars with just a gmail account.
In fact, I would like to see the pitch. Here are the emails I sent to Freddy:
Freddy, I’m sorry, but I’ve already seen this scam. I hope it didn’t cost a lot of money to buy this “money making opportunity.” Most of my web design friends have all gotten this dozens of times already. It might have worked the first time, but by now I’m afraid the market has been saturated. You’ve wasted your money. Good luck on finding an honest way to make a living, its much easier on your karma.
Then a second one:
Hey Freddy, where did you buy this scam? It’s obviously a cut and paste get rich quick thing. As a student of marketing I would like to see the sales pitch.
Over the last six months I’ve asked several of the would-be scammers for the info, but they never get back to me.
Freddy is just learning who the real victim is in this scam. The original scammer probably did get some web designers to bite, but I bet he’s making more selling his template for a scam than he did actually scamming designers.
McColley Marketing Media didn’t take Freddy up on his offer, so we have time on the schedule to build your new website, help you better market the site you have, or help you improve and maintain your website. Call us today. We do take credit cards, but once we get your money, we promise to keep it for ourselves.
Joomla Update: 12% of the sites we listed were hacked in the last month!
Before Christmas I posted about a new Joomla update that had been released to fix a new security issue. The Joomla team did something unprecedented – they released an update for Joomla 1.5, which has been “end of life” since 2012.
Good intentions
At that time, I made a short list of 81 sites in Arizona still using Joomla 1.5. And I emailed them to let them know they need to secure their site. Of course, I made an attractive offer to update them. Which means for many site owners they went to the trash. I understand.
But 15 of those 81 site owners took action and got their sites secured. They didn’t all use my Joomla update service, some had their own web designers who took care of updating them.
Now comes the scary part
10 of the remaining 66 sites have been compromised. Some are down, some have an “SEO Hack” that siphons off Google ranking and some are blacklisted because of malicious code that could infect visitors. This is far worse than I expected.
If you have a site running Joomla 1.5 or even later, you need a Joomla Update
There are still more sites than the 81 I put on my short list running Joomla 1.5. And sites running 2.5 and even versions of Joomla 3 earlier than the 3.4.5. Some will just be a one-click update, others take more effort.
Call your web developer and give him a serious kick in the pants. If your developer isn’t available, call me and we’ll get you updated. This doesn’t end well unless you take action right away.
A followup to yesterday’s Joomla Update notice. Yesterday I said that we were in the middle of updating all the Joomla sites in our care to the latest version because of a critical security patch.
What I didn’t know at that moment was that the problem was as serious as it is. An attacker could very easily gain access to your site in order to execute their own code.
Critical Update Released for Joomla 1.5, Too
Its so serious that Joomla has even issued a fix for Joomla 1.5. Despite the fact that it reached its official “end of life” at the end of 2012 (after 5 years of updates). This would be like Microsoft updating Windows 98 instead of pushing you to the newer Windows 10.
Lets Fix This Right Away!
If your site is running an old version of Joomla, give me a call and we’ll help you gain control of the situation. All version from Joomla 1.5 to 3.45 are affected. Later versions are 1-click updates, but you should backup your site first just in case. Joomla 1.5 needs a lot more work to update. If you’re not ready to do an update to the latest, I can apply today’s fix for a lot less (you’ll still have other vulnerabilities, but not this critical one).
McColley Marketing Media has been offering special prices on Joomla updates. If you update to the latest Joomla 3, we’ll discount the cost of making your website mobile ready, too. Call 480-704-4286.
Joomla Update Security Release! Special Offer: we’ll upgrade Joomla 1.5 sites for just $400
It’s Joomla update time! Joomla Version 3.46 was released today. It has one critical and 3 lower level security updates. Regular McColley Marketing Media clients are being updated free today and tomorrow.
Don’t Get Hacked – Important Joomla Update!
I know a business not 5 miles from here that has been hacked. Their design is gone and their home page, which is now just text on a white background, has several links to casinos. I’d post a link but I’m not 100% sure it doesn’t have a virus or other malware that could infect your computer. That site was running an outdated (and very insecure) version of Joomla.
Every couple of weeks there’s a new Joomla update to fix problems and introduce new features. Its free. What I find amazing is that there are still sites running the Joomla 1.5 version that first came out in 2012. It very insecure and does not get updates. The only solution is to upgrade.
Special Joomla 1.5 Offer
Unfortunately, upgrading from Joomla 1.5 isn’t a small task. While today’s 3.46 Joomla update is just a click to update from 3.45, that’s not the story with Joomla 1.5. Lots of manual changes means more time spent and a higher price. I’m offering an upgrade special of $400 for anyone who wants to secure their site (limited time).
That price doesn’t include the cost of paid extensions or upgrading a site using VirtueMart, since there are many other considerations there (we’ll upgrade those for you, but there is more labor involved).
If a $400 Joomla update seems high, think about the cost of a new website should you get hacked. Give me a call and we’ll lock your site up.
McColley Marketing Media has been working with Joomla since before Version 1.0. Since Joomla just turned 10, that’s a lot of Joomla update experience!
