Recently we our operation team found that accounts that are running Joomla and WordPress applications are being hacked. Most start with an automated scanner tool that scans for specific versions of Joomla and specific extensions versions. (Same with wordpress and others) Once vulnerabilities are identified then one of the below is used to gain access.

Here’s the main cause of it:

The _MACOSX folder is automatically generated when files are zipped on an Apple computer. Because the use of Mac you will find them after unzipping your downloaded Zip-archive on a Windows PC. Simply forget about this folder. You don´t need it.

Whats with __MACOSX in Zip files?

Recently people are using Mac’s for development these days. Most core developers from some of the leading web frameworks use Mac as their primary development platform. Several plugin and theme authors for WordPress also develop on Mac. This is good thing but also has side effects of this development.

The easiest way to archive something on Mac is to right click on directory of choice in Finder and select “Archive as…”. This creates a Zip file, which then the developer can distribute to users. After this procedure another folder suspiciously named”%%__MACOSX%%” gets created at the root of Zip archive. Bellow is an example:

==================================================================

/funvilla/wp-content/oqey_gallery/skins/__MACOSX

/images/stories/Halloween/__MACOSX

/wp-content/plugins/uBillboard/__MACOSX

/public_html/tmp/install_4a5e043578f85/__MACOSX

==================================================================

This folder contains other things, thumbnail for images in the original archive. These kind of unwanted undesirable things are really not necessary. It’s okay, try to keep cool. Bellow we are presenting a systematic analysis of what Mac OSX does is wrong, stupid and unnecessary:

In WordPress themes directory, if each theme starts creating its own”%%__MACOSX%%” folder, then themes directory would soon get crowded with useless garbage. This, creating an entire tree structure in the archive just breaks things in more ways. Example: each WordPress theme starts creating”%%__MACOSX%%” folders in the root of the archive. As a result the new theme will also try to extract in the”%%__MACOSX%%” folder. Not only this, some programs like Gallery ( Joomla ) also have the ability to load plugins/images directly from Zip files. Hence, people end up with unwanted images, themes and plugins in setup. This might just break the installation. Again, one did not explicitly create that folder. If someone creates a virus, that just modifies the default zip program on Mac to sneak in malicious payload via the”%%__MACOSX%%” folders in any new Zip archives, it’s a security risk.

This way we encountered that all the data inside”%%__MACOSX%%” folder is created from directory itself. No external information is used / needed. Think why anyone would ever need such new folder. The zip file has been produced on a system running Mac OSX, they’re irrelevant files (mac filesystem metadata) one can just delete the directory.

Next, we also encountered the Vulnerability Found in timthumb.php

We found a vulnerability in a popular image resizing library called TimThumb, used in many WordPress and Joomla themes and plugins. This allows one ( HACKER ) to upload and execute despotic PHP code in the TimThumb cache directory. Once, PHP code is uploaded and executed, any site can be compromised as per the HACKER.
We strongly recommend deleting timthumb.php / thumb.php / createthumb.php / showthumb.php / class.img2thumb.php / action.changethumb.php like file from the account. If the file exists in a theme or plugin that you’re no longer using you may want to remove the entire theme or plugin directory.
Still, one wish to use the TimThumb, then make sure to update the file the latest version and remember to check the TimThumb site regularly for updates. One should also set ALLOW_EXTERNAL to false and find the $allowedSites array inside the file and remove the domain names to prevent remote file downloading.

Please make sure it is as follows:

define( ‘ALLOW_EXTERNAL’, false );

Then make changes as following:

$allowedSites = array (

        'flickr.com',

        'picasa.com',

        'img.youtube.com',

        'upload.wikimedia.org',

);

Change it to look like bellow:

$allowedSites = array();

Always be sure to use the built-in WordPress functions for Themes and Plugins such as: add_image_size to resize images.

Kind Regards,
Daniel Smith
Level II Support Department
http://www.WebHost.Uk.Net
http://www.WebHosting.Uk.Net
Support Portal: https://secure.webhost.uk.net

Technorati Tags: Gallery, Joomla, Joomla Hack, Joomla Sites Hack, Joomla Vulnerability, MACOSX Vulnerability, Plugins, Themes, TimThumb Vulnerability, TimThumb.php file issue, WordPress, WordPress Hack, WordPress Plugins, WordPress Sites Hack, WordPress Themes, WordPress Vulneracility

2. On the E-mail tab, click New.

3. Select Microsoft Exchange, POP3, IMAP, or HTTP and click Next.

4. Check Manually configure server settings or additional server types and click Next.

5. Select Internet E-mail and click Next.

6. Enter the requested information:

* Your Name: your name
* Email Address: the email address the messages will be sent from
* Account Type: POP3
* Incoming Mail server: mail.domainname.com
* Outgoing Mail server: mail.domainname.com
* User Name: the full email address
* Password: the password for the email address

7. Click More Settings

8. On the Outgoing Server tab, check My outgoing server (SMTP) requires authentication

9. Select Use same settings as my incoming mail server and click OK.
10. Click Test Account Settings to verify everything is configured correctly.
11. Click Next and then click Finish.

Technorati Tags: Configure Microsoft Outlook, Configure Outlook 2003, Configure Outlook 2007, email hosting 2011, email UK hosting, Email web hosting, My outgoing server (SMTP) requires authentication, Outlook Email client, POP3 settings, SMTP settings

Mr. Andrew Martin, Head of Business Development for Webhost.US.Com (a division of WebHost.UK.Net) said, “We would like to thank all WebhostUK LTD customers for showing great faith in us and our services. Not only they have been a big part of our WebhostUK LTD family but also supported us and our company growth from past 7 years. Today after the over overwhelming response we got in UK market, we are very pleased to announce the launch of our new hosting website under the name Webhost.US.Com, targeting client base of US and other parts of the globe.” He further added, “With an intention of strengthening company roots across the world, we have tried to offer the lowest web hosting solutions, but at the same time giving the highest top priority to our customer support and services, to make sure our clients have a pleasant experience of choosing us as their online partner.“

The company claims that all shared Cloud, Dedicated and VPS plans include 100% SLA network uptime backed up with fast 24/7 live chat and ticket support. With a choice of Linux or Windows servers for all their shared hosting, reseller hosting, Cloud and Dedicated servers, the company claims to use branded DELL servers with free managed services and monitoring round the clock.

The company has also introduced with low cost Cloud web hosting solutions hosted in the infrastructure that includes wide range of unmatched performance, flexibility and fault tolerance datacenter’s in US. The parent company WebHost.Uk.Net Established in the year 2004 and hosting over 90000 websites, is UK’s fastest growing domain registration, web hosting provider.

For More details Please Visit :

http://www.webhost.US.Com

Technorati Tags: Affordable US Managed Server, Best US Web Hosting, Cheap US Shared Hosting, Cloud Web Hosting, US Business Website hosting, US Dedicated Servers, US E-commerce Hosting, US Reseller Hosting, US VPS Hosting

If you respond to this letter, your domain will be transferred to the Domain Renewal Group, and WEBHOSTUK LIMITED will no longer be the registrar for your domain. The Domain Renewal Group charges much more for domains: £20 a year in comparison to our £9.99 GBP a year for .COM/.NET/.ORG domains.

If you receive a letter from Domain Renewal Group, we recommend you ignore the letter and simply throw it away. Here is a sample letter:

An IPS TAG is a unique identifier given to each Tag-Holder with Nominet (the registry for all UK domain names). Tag-Holders are the ‘Domain Name Companies‘ that provide domain name registration services. They include specialist domain name companies, hosting companies, ISP’s and others such as web designers. The tag is used to identify the company responsible for the management of a .uk domain. It is a single alpha-numeric sequence, in uppercase, sometimes hyphenated.

If you want a different company to “look after your domain names” you can do this by changing your IPS Tag. For changing the IPS Tag you need to contact the company where you have registered the domain name and ask them to change the TAG to the TAG of your new provider. Some companies will charge a small fee for this change and are reluctant to “let you go” and want reasons for the change. The company you change your domain name to will provide you with their IPS TAG which you need to hand over to the current company, so that they can make the change. The new company might charge a small fee too for transferring a domain name to their business.

Technorati Tags: IPS TAG

The Domain Name System or Servers (DNS), is the way that Internet domain names are located and translated into Internet Protocol addresses. A domain name is a meaningful and easy-to-remember handle for an Internet address. Internet domain names are the names which we use to refer to hosts on the Internet, such as www.webhost.uk.com while internet protocol addresses are the numbers which routers use to move traffic across the Internet, such as 197.71.123.219 DNS is part of the application layer of the TCP/IP reference model. DNS is implemented using two software components: the DNS server and the DNS client (or resolver).

If you have a domain name with www.123-reg.co.uk, and your webhosting is with www.webhost.uk.com (for example), the domain name servers would have to be changed to ns1.webhost.uk.com and ns2.webhost.uk.com. Your domain name needs to “know” where your website files are. By pointing the DNS to the servers of
webhositng uk, your website will be displayed.

Technorati Tags: DNS: Domain Name System or Servers

Digg is a popular social bookmarking and content discovery website. Although site management and maintenance is done the website’s paid staff, everything on digg is submitted by the digg user community. These submissions are subject to peer review and are voted upon by other site visitors. The stories receiving enough diggs is posted on the websites front page, for the millions of digg visitors to see. According to Alexa, Digg is one of the most popular websites on the internet, reaching 1 out of every 100 internet users daily.

How to submit stories?

Submitting stories to digg is very easy. To submit stories you have to be a registered member of the digg, once you have registered and signed in, just click on the option submit story and then enter the URL of the story which you would like to submit. Then enter the title of the story with a short description and select the proper category for the story. You are only allowed to digg only original story and not any duplicate entry.

What can you do as a digg user?

Every digg user can digg (help promote), bury (help remove spam), and comment on stories. You can even digg and bury comments you like or dislike. Digg also allows you to track your friends’ activity throughout the site.

Technorati Tags: What is Dig

A mailserver is a family of programs that answer email automatically. These programs are also called list servers. A good mailserver will be able to filter out spam, and prevent your mailbox from being clogged. A mailserver can be installed on the main Web server, or on a separate server.

It has two programs installed: Sendmail program and POP program

1) Sendmail Program

This program allows the mailserver to process outgoing email. If an email address does not exist, the mailserver will return the mail to the sender.
If the sender sends the mail to a particular email address and if that email address does not exist then the mailserver send the mail back to the sender.
If any technical problem arises during the mail delivery, the mail might be returned back to the sender. In all cases in which mail is returned, it arrives with an explanation or error code. By reading the error code you can determine why the mail failed to reach its destination.

2) POP  Program

The POP (Post Office Protocol) program collects incoming email. As it receives mail, it creates a single text file of accumulated messages for each email address. If the end-user has configured his or her email client to delete mail from the server upon collection, the mailserver’s text file is wiped when the mail is collected. Some people, however, store email on the mailserver. This is not only a privacy concern, but can also lead to malfunctions on the mailserver when text files become too lengthy.

Technorati Tags: What is Mailserver