Recently we our operation team found that accounts that are running Joomla and WordPress applications are being hacked. Most start with an automated scanner tool that scans for specific versions of Joomla and specific extensions versions. (Same with wordpress and others) Once vulnerabilities are identified then one of the below is used to gain access.

Here’s the main cause of it:

The _MACOSX folder is automatically generated when files are zipped on an Apple computer. Because the use of Mac you will find them after unzipping your downloaded Zip-archive on a Windows PC. Simply forget about this folder. You don´t need it.

Whats with __MACOSX in Zip files?

Recently people are using Mac’s for development these days. Most core developers from some of the leading web frameworks use Mac as their primary development platform. Several plugin and theme authors for WordPress also develop on Mac. This is good thing but also has side effects of this development.

The easiest way to archive something on Mac is to right click on directory of choice in Finder and select “Archive as…”. This creates a Zip file, which then the developer can distribute to users. After this procedure another folder suspiciously named”%%__MACOSX%%” gets created at the root of Zip archive. Bellow is an example:

==================================================================

/funvilla/wp-content/oqey_gallery/skins/__MACOSX

/images/stories/Halloween/__MACOSX

/wp-content/plugins/uBillboard/__MACOSX

/public_html/tmp/install_4a5e043578f85/__MACOSX

==================================================================

This folder contains other things, thumbnail for images in the original archive. These kind of unwanted undesirable things are really not necessary. It’s okay, try to keep cool. Bellow we are presenting a systematic analysis of what Mac OSX does is wrong, stupid and unnecessary:

In WordPress themes directory, if each theme starts creating its own”%%__MACOSX%%” folder, then themes directory would soon get crowded with useless garbage. This, creating an entire tree structure in the archive just breaks things in more ways. Example: each WordPress theme starts creating”%%__MACOSX%%” folders in the root of the archive. As a result the new theme will also try to extract in the”%%__MACOSX%%” folder. Not only this, some programs like Gallery ( Joomla ) also have the ability to load plugins/images directly from Zip files. Hence, people end up with unwanted images, themes and plugins in setup. This might just break the installation. Again, one did not explicitly create that folder. If someone creates a virus, that just modifies the default zip program on Mac to sneak in malicious payload via the”%%__MACOSX%%” folders in any new Zip archives, it’s a security risk.

This way we encountered that all the data inside”%%__MACOSX%%” folder is created from directory itself. No external information is used / needed. Think why anyone would ever need such new folder. The zip file has been produced on a system running Mac OSX, they’re irrelevant files (mac filesystem metadata) one can just delete the directory.

Next, we also encountered the Vulnerability Found in timthumb.php

We found a vulnerability in a popular image resizing library called TimThumb, used in many WordPress and Joomla themes and plugins. This allows one ( HACKER ) to upload and execute despotic PHP code in the TimThumb cache directory. Once, PHP code is uploaded and executed, any site can be compromised as per the HACKER.
We strongly recommend deleting timthumb.php / thumb.php / createthumb.php / showthumb.php / class.img2thumb.php / action.changethumb.php like file from the account. If the file exists in a theme or plugin that you’re no longer using you may want to remove the entire theme or plugin directory.
Still, one wish to use the TimThumb, then make sure to update the file the latest version and remember to check the TimThumb site regularly for updates. One should also set ALLOW_EXTERNAL to false and find the $allowedSites array inside the file and remove the domain names to prevent remote file downloading.

Please make sure it is as follows:

define( ‘ALLOW_EXTERNAL’, false );

Then make changes as following:

$allowedSites = array (

        'flickr.com',

        'picasa.com',

        'img.youtube.com',

        'upload.wikimedia.org',

);

Change it to look like bellow:

$allowedSites = array();

Always be sure to use the built-in WordPress functions for Themes and Plugins such as: add_image_size to resize images.

Kind Regards,
Daniel Smith
Level II Support Department
http://www.WebHost.Uk.Net
http://www.WebHosting.Uk.Net
Support Portal: https://secure.webhost.uk.net

Technorati Tags: Gallery, Joomla, Joomla Hack, Joomla Sites Hack, Joomla Vulnerability, MACOSX Vulnerability, Plugins, Themes, TimThumb Vulnerability, TimThumb.php file issue, WordPress, WordPress Hack, WordPress Plugins, WordPress Sites Hack, WordPress Themes, WordPress Vulneracility

Two of the three remaining vulnerabilities address issues in the Windows operating system as well. Security bulletin MS11-054 describes a vulnerability in Windows Kernel-Mode drivers that could allow elevation of privileges, while bulletin MS11-056 a vulnerability in the Windows Client and Server run-time subsystem.

All supported Microsoft client and server operating systems are affected by the two security vulnerabilities. The last issue is a vulnerability in Microsoft Visio.

Here is an overview of all four security bulletins with links to their pages at the Microsoft Technet website.

* MS11-053 – Vulnerability in Bluetooth Stack Could Allow Remote Code Execution (2566220)
* MS11-054 – Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2555917)
* MS11-056 – Vulnerabilities in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege (2507938)
* MS11-055 – Vulnerability in Microsoft Visio Could Allow Remote Code Execution (2560847)

The patches are as usual already available via Windows Update, Microsoft Update and via the Microsoft Download Center. The monthly exploit mitigation guide at the Technet Security blog provides additional information about the vulnerabilities and deployment strategies.

Probably the easiest way to deploy the security updates to a single system is via Windows Update.

Just click on Start > All Programs > Windows Update to open the update screen. You may need to click on Check for updates on the left sidebar if your computer has been up for some time and the updates are not displayed directly in the main window.

Technorati Tags: ASP hosting, Best Windows shared hosting 2011, Microsoft security patch, PCI Compliant hosting, UK Reseller Web Hosting 2011, Windows dedicated server hosting, Windows Security patch 2011

1. Begin by downloading the latest version of WHMCS, either from our client area here
2. Next, unzip the contents of the latest WHMCS zip file download to a folder on your computer
3. Now remove the /images/logo.jpg file to avoid overwriting your customised logo image
4. Next if you have customised your WHMCS admin folder name, you should rename the admin folder in the new files to match
5. Upload the new files to your existing installation folder overwriting any existing files
6. Visit the admin area as you normally would to login and you should then see the upgrade script
7. Accept the license agreement
8. Now take a full backup of your database using a tool such as phpMyAdmin
9. Tick to confirm you have backed up your database and click the upgrade button
10. Once the updates finish, delete the install folder from your server
11. Now proceed to update your custom templates with any new or changed files in the version you’ve upgraded to. These are listed in the Template Changes section of our Release Notes (see below).

Signup for any of our shared linux hosting, shared windows hosting, reseller linux hosting or reseller windows hosting for two years and get one additional year absouletely free..

Shared Linux Web Hosting plans : http://www.webhost.uk.net/shared_hosting.html

Shared Windows Web Hosting plans : http://www.webhost.uk.net/shared_win_hosting.html

Reseller Linux Web Hosting Plans : http://www.webhost.uk.net/reseller_hosting.html

Reseller Windows Web Hosting plans : http://www.webhost.uk.net/reseller_win_hosting.html

To claim your one year of free hosting, simply signup binennially for any of our shared or reseller web hosting plans and once your order is approved and accepted, the one additional year will be added to your account absouletely free of charge – which means you will be able to host your websites for 3 years by paying just for two years..

Additionally get free goodies and features such as :

• Free domain names
• Free SSL certificates (on selective shared and reseller hosting plans)
• Free Dedicated IP’s (on selective shared and reseller hosting plans)
• Free WHMCS billing system (on selective shared and reseller hosting plans)
• Free Vision helpdesk license (on reseller web hosting plans)
• Free ENOM reseller accounts (on reseller web hosting plans)
• Free private labelled nameservers (on reseller web hosting plans)
• Free Rvskin and Rvsitebuilder softwares (on Linux plans)
• Free account migration
• 24/7 lightening fast live chat and ticket support

So why wait for this limited opportunity to pass away when your business and websites can be secured with one of the UK’s most reliable and stable web hosting company http://www.webhost.uk.net

WEBHOSTUK LIMITED also offers cheap and reliable cpanel vps and dedicated servers, hosted in UK datacenter at http://www.webhosting.uk.net

If you respond to this letter, your domain will be transferred to the Domain Renewal Group, and WEBHOSTUK LIMITED will no longer be the registrar for your domain. The Domain Renewal Group charges much more for domains: £20 a year in comparison to our £9.99 GBP a year for .COM/.NET/.ORG domains.

If you receive a letter from Domain Renewal Group, we recommend you ignore the letter and simply throw it away. Here is a sample letter:

WebHosting.Uk.Net is a division of WebHost.Uk.Net specifically established for targeting the UK vps and dedicated hosting services. Webhosting.Uk.Net will be offering cheap, reliable and secure VPS and dedicated servers physically located in UK datacenter.

All dedicated and VPS plans include SLA network uptime along with their expertise, with 24/7 live chat and ticket support. Clients can now choose hosting from Linux & Windows vps and dedicated servers. Our Dell branded dedicated servers come with a choice of managed or self-managed dedicated servers while all VPS servers are fully managed by the company.

With all our VPS plans, we are offering free whm/cpanel control panel for linux vps servers while Plesk control panel for windows VPS servers. Our vps and dedicated servers are targetted for everyone who wish to have a troublefree web hosting experience for their personal, or business websites, hence offering the most affordable rates in UK web hosting industry.

Announcing this, the company spokesperson, Mr. Andrew Martin said, “We are very pleased to announce the launch of our new hosting site under the name webhosting.uk.net on the web aimed exclusively at the UK market. We’re proud to once again be leading the way in UK based hosting by offering the cheapest yet reliable, secure and quality VPS and dedicated hosting, with all plans providing 24/7 support.”

Technorati Tags: Best UK Web Hosting VPS, Cheap Dedicated server, Cheap UK VPS, Reliable UK VPS Server

An IPS TAG is a unique identifier given to each Tag-Holder with Nominet (the registry for all UK domain names). Tag-Holders are the ‘Domain Name Companies‘ that provide domain name registration services. They include specialist domain name companies, hosting companies, ISP’s and others such as web designers. The tag is used to identify the company responsible for the management of a .uk domain. It is a single alpha-numeric sequence, in uppercase, sometimes hyphenated.

If you want a different company to “look after your domain names” you can do this by changing your IPS Tag. For changing the IPS Tag you need to contact the company where you have registered the domain name and ask them to change the TAG to the TAG of your new provider. Some companies will charge a small fee for this change and are reluctant to “let you go” and want reasons for the change. The company you change your domain name to will provide you with their IPS TAG which you need to hand over to the current company, so that they can make the change. The new company might charge a small fee too for transferring a domain name to their business.

Technorati Tags: IPS TAG

The Domain Name System or Servers (DNS), is the way that Internet domain names are located and translated into Internet Protocol addresses. A domain name is a meaningful and easy-to-remember handle for an Internet address. Internet domain names are the names which we use to refer to hosts on the Internet, such as www.webhost.uk.com while internet protocol addresses are the numbers which routers use to move traffic across the Internet, such as 197.71.123.219 DNS is part of the application layer of the TCP/IP reference model. DNS is implemented using two software components: the DNS server and the DNS client (or resolver).

If you have a domain name with www.123-reg.co.uk, and your webhosting is with www.webhost.uk.com (for example), the domain name servers would have to be changed to ns1.webhost.uk.com and ns2.webhost.uk.com. Your domain name needs to “know” where your website files are. By pointing the DNS to the servers of
webhositng uk, your website will be displayed.

Technorati Tags: DNS: Domain Name System or Servers

Digg is a popular social bookmarking and content discovery website. Although site management and maintenance is done the website’s paid staff, everything on digg is submitted by the digg user community. These submissions are subject to peer review and are voted upon by other site visitors. The stories receiving enough diggs is posted on the websites front page, for the millions of digg visitors to see. According to Alexa, Digg is one of the most popular websites on the internet, reaching 1 out of every 100 internet users daily.

How to submit stories?

Submitting stories to digg is very easy. To submit stories you have to be a registered member of the digg, once you have registered and signed in, just click on the option submit story and then enter the URL of the story which you would like to submit. Then enter the title of the story with a short description and select the proper category for the story. You are only allowed to digg only original story and not any duplicate entry.

What can you do as a digg user?

Every digg user can digg (help promote), bury (help remove spam), and comment on stories. You can even digg and bury comments you like or dislike. Digg also allows you to track your friends’ activity throughout the site.

Technorati Tags: What is Dig

A mailserver is a family of programs that answer email automatically. These programs are also called list servers. A good mailserver will be able to filter out spam, and prevent your mailbox from being clogged. A mailserver can be installed on the main Web server, or on a separate server.

It has two programs installed: Sendmail program and POP program

1) Sendmail Program

This program allows the mailserver to process outgoing email. If an email address does not exist, the mailserver will return the mail to the sender.
If the sender sends the mail to a particular email address and if that email address does not exist then the mailserver send the mail back to the sender.
If any technical problem arises during the mail delivery, the mail might be returned back to the sender. In all cases in which mail is returned, it arrives with an explanation or error code. By reading the error code you can determine why the mail failed to reach its destination.

2) POP  Program

The POP (Post Office Protocol) program collects incoming email. As it receives mail, it creates a single text file of accumulated messages for each email address. If the end-user has configured his or her email client to delete mail from the server upon collection, the mailserver’s text file is wiped when the mail is collected. Some people, however, store email on the mailserver. This is not only a privacy concern, but can also lead to malfunctions on the mailserver when text files become too lengthy.

Technorati Tags: What is Mailserver