Recently we our operation team found that accounts that are running Joomla and WordPress applications are being hacked. Most start with an automated scanner tool that scans for specific versions of Joomla and specific extensions versions. (Same with wordpress and others) Once vulnerabilities are identified then one of the below is used to gain access.

Here’s the main cause of it:

The _MACOSX folder is automatically generated when files are zipped on an Apple computer. Because the use of Mac you will find them after unzipping your downloaded Zip-archive on a Windows PC. Simply forget about this folder. You don´t need it.

Whats with __MACOSX in Zip files?

Recently people are using Mac’s for development these days. Most core developers from some of the leading web frameworks use Mac as their primary development platform. Several plugin and theme authors for WordPress also develop on Mac. This is good thing but also has side effects of this development.

The easiest way to archive something on Mac is to right click on directory of choice in Finder and select “Archive as…”. This creates a Zip file, which then the developer can distribute to users. After this procedure another folder suspiciously named”%%__MACOSX%%” gets created at the root of Zip archive. Bellow is an example:

==================================================================

/funvilla/wp-content/oqey_gallery/skins/__MACOSX

/images/stories/Halloween/__MACOSX

/wp-content/plugins/uBillboard/__MACOSX

/public_html/tmp/install_4a5e043578f85/__MACOSX

==================================================================

This folder contains other things, thumbnail for images in the original archive. These kind of unwanted undesirable things are really not necessary. It’s okay, try to keep cool. Bellow we are presenting a systematic analysis of what Mac OSX does is wrong, stupid and unnecessary:

In WordPress themes directory, if each theme starts creating its own”%%__MACOSX%%” folder, then themes directory would soon get crowded with useless garbage. This, creating an entire tree structure in the archive just breaks things in more ways. Example: each WordPress theme starts creating”%%__MACOSX%%” folders in the root of the archive. As a result the new theme will also try to extract in the”%%__MACOSX%%” folder. Not only this, some programs like Gallery ( Joomla ) also have the ability to load plugins/images directly from Zip files. Hence, people end up with unwanted images, themes and plugins in setup. This might just break the installation. Again, one did not explicitly create that folder. If someone creates a virus, that just modifies the default zip program on Mac to sneak in malicious payload via the”%%__MACOSX%%” folders in any new Zip archives, it’s a security risk.

This way we encountered that all the data inside”%%__MACOSX%%” folder is created from directory itself. No external information is used / needed. Think why anyone would ever need such new folder. The zip file has been produced on a system running Mac OSX, they’re irrelevant files (mac filesystem metadata) one can just delete the directory.

Next, we also encountered the Vulnerability Found in timthumb.php

We found a vulnerability in a popular image resizing library called TimThumb, used in many WordPress and Joomla themes and plugins. This allows one ( HACKER ) to upload and execute despotic PHP code in the TimThumb cache directory. Once, PHP code is uploaded and executed, any site can be compromised as per the HACKER.
We strongly recommend deleting timthumb.php / thumb.php / createthumb.php / showthumb.php / class.img2thumb.php / action.changethumb.php like file from the account. If the file exists in a theme or plugin that you’re no longer using you may want to remove the entire theme or plugin directory.
Still, one wish to use the TimThumb, then make sure to update the file the latest version and remember to check the TimThumb site regularly for updates. One should also set ALLOW_EXTERNAL to false and find the $allowedSites array inside the file and remove the domain names to prevent remote file downloading.

Please make sure it is as follows:

define( ‘ALLOW_EXTERNAL’, false );

Then make changes as following:

$allowedSites = array (

        'flickr.com',

        'picasa.com',

        'img.youtube.com',

        'upload.wikimedia.org',

);

Change it to look like bellow:

$allowedSites = array();

Always be sure to use the built-in WordPress functions for Themes and Plugins such as: add_image_size to resize images.

Kind Regards,
Daniel Smith
Level II Support Department
http://www.WebHost.Uk.Net
http://www.WebHosting.Uk.Net
Support Portal: https://secure.webhost.uk.net

Technorati Tags: Gallery, Joomla, Joomla Hack, Joomla Sites Hack, Joomla Vulnerability, MACOSX Vulnerability, Plugins, Themes, TimThumb Vulnerability, TimThumb.php file issue, WordPress, WordPress Hack, WordPress Plugins, WordPress Sites Hack, WordPress Themes, WordPress Vulneracility

As reliable Web Hosting provider webhost.uk.net advice website owner , good, quality-led content is an exceptionally important element (if not, the most important aspect) of any good, reputable, successful and profitable web site in online Market.

Now the most important question that will rise in your mind is ” Does a select a right Web Hosting provider and choice between UK web Hosting  provider or US Web Host matters for search engine ranking?”  The and answer is surely YES.

While selecting a web Hosting provider website owners should avoid cheap or free Web hosting provider , who over stuff there servers. The first draw back is they have lots of downtime Secondly as they are offering free hosting can result in spammy ,porn or gambling website Hosting. This can result in backlisting of your server IP. Ultimately such free host can risk your online business.

And now with the new Google Panda updates in progress and also google plus importants,Website owner should look upon web hosting providers that offer reliable, fast and good uptime web hosting provider.

This can only be achieved by doing a good reacearch on internet  reading reviews on forums , review sites etc… contacting the web hosting provider on Email ,chat and confirming things before you sign up.

Also due to google panda updates it has become really important that your site load fast. So if a UK website owner targetting UK Market selects a reliable UK Web Hosting provider with high uptime and good connectivity will result in fast loading of there site , which will surely help you rank high in search engine.

Technorati Tags: Alternative UK Web Hosting, Fast UK Hosting, Fastest UK Hosting provider, Google Panda optimization, Google Panda ranking, Looking for UK Hosting, panda update, Profitable Hosting provider, SEO Hosting Provider, Server Hosting, Top UK Hosting, UK Managed Servers, UK VPS Hosting

If you respond to this letter, your domain will be transferred to the Domain Renewal Group, and WEBHOSTUK LIMITED will no longer be the registrar for your domain. The Domain Renewal Group charges much more for domains: £20 a year in comparison to our £9.99 GBP a year for .COM/.NET/.ORG domains.

If you receive a letter from Domain Renewal Group, we recommend you ignore the letter and simply throw it away. Here is a sample letter:

An IPS TAG is a unique identifier given to each Tag-Holder with Nominet (the registry for all UK domain names). Tag-Holders are the ‘Domain Name Companies‘ that provide domain name registration services. They include specialist domain name companies, hosting companies, ISP’s and others such as web designers. The tag is used to identify the company responsible for the management of a .uk domain. It is a single alpha-numeric sequence, in uppercase, sometimes hyphenated.

If you want a different company to “look after your domain names” you can do this by changing your IPS Tag. For changing the IPS Tag you need to contact the company where you have registered the domain name and ask them to change the TAG to the TAG of your new provider. Some companies will charge a small fee for this change and are reluctant to “let you go” and want reasons for the change. The company you change your domain name to will provide you with their IPS TAG which you need to hand over to the current company, so that they can make the change. The new company might charge a small fee too for transferring a domain name to their business.

Technorati Tags: IPS TAG

The Domain Name System or Servers (DNS), is the way that Internet domain names are located and translated into Internet Protocol addresses. A domain name is a meaningful and easy-to-remember handle for an Internet address. Internet domain names are the names which we use to refer to hosts on the Internet, such as www.webhost.uk.com while internet protocol addresses are the numbers which routers use to move traffic across the Internet, such as 197.71.123.219 DNS is part of the application layer of the TCP/IP reference model. DNS is implemented using two software components: the DNS server and the DNS client (or resolver).

If you have a domain name with www.123-reg.co.uk, and your webhosting is with www.webhost.uk.com (for example), the domain name servers would have to be changed to ns1.webhost.uk.com and ns2.webhost.uk.com. Your domain name needs to “know” where your website files are. By pointing the DNS to the servers of
webhositng uk, your website will be displayed.

Technorati Tags: DNS: Domain Name System or Servers

Digg is a popular social bookmarking and content discovery website. Although site management and maintenance is done the website’s paid staff, everything on digg is submitted by the digg user community. These submissions are subject to peer review and are voted upon by other site visitors. The stories receiving enough diggs is posted on the websites front page, for the millions of digg visitors to see. According to Alexa, Digg is one of the most popular websites on the internet, reaching 1 out of every 100 internet users daily.

How to submit stories?

Submitting stories to digg is very easy. To submit stories you have to be a registered member of the digg, once you have registered and signed in, just click on the option submit story and then enter the URL of the story which you would like to submit. Then enter the title of the story with a short description and select the proper category for the story. You are only allowed to digg only original story and not any duplicate entry.

What can you do as a digg user?

Every digg user can digg (help promote), bury (help remove spam), and comment on stories. You can even digg and bury comments you like or dislike. Digg also allows you to track your friends’ activity throughout the site.

Technorati Tags: What is Dig

A mailserver is a family of programs that answer email automatically. These programs are also called list servers. A good mailserver will be able to filter out spam, and prevent your mailbox from being clogged. A mailserver can be installed on the main Web server, or on a separate server.

It has two programs installed: Sendmail program and POP program

1) Sendmail Program

This program allows the mailserver to process outgoing email. If an email address does not exist, the mailserver will return the mail to the sender.
If the sender sends the mail to a particular email address and if that email address does not exist then the mailserver send the mail back to the sender.
If any technical problem arises during the mail delivery, the mail might be returned back to the sender. In all cases in which mail is returned, it arrives with an explanation or error code. By reading the error code you can determine why the mail failed to reach its destination.

2) POP  Program

The POP (Post Office Protocol) program collects incoming email. As it receives mail, it creates a single text file of accumulated messages for each email address. If the end-user has configured his or her email client to delete mail from the server upon collection, the mailserver’s text file is wiped when the mail is collected. Some people, however, store email on the mailserver. This is not only a privacy concern, but can also lead to malfunctions on the mailserver when text files become too lengthy.

Technorati Tags: What is Mailserver

* Who is visiting our Web site * What browsers do they use?
* Where do they go in the site * What pages do they look at?
* How long they stay at our site? etc.

The answers to these questions would be found in  Server log files

A server log is a file (or several files) automatically created and maintained by a server.
Your Web server log files contain much useful information such as :

• Which pages get the most traffic – and the least.
• What sites are referring visitors to you.
• Which pages visitors look at.
• What browsers and operating systems are most popular with visitors.
• When search engine spiders and directory editors visit.

This information often helps webmasters to figure out problems on our web site. Using log file we get detail information of our visitors. Once we know from where we are getting targeted traffic then it becomes easy for us to take necessary steps for maintaining and improving traffic from particular search engine.

The server stores visitor information in files with the .log extension, nearly all of the major Web servers use a common format for this log files. These log files contain information such as the IP address of the remote host, the document that was requested, and a timestamp.

The syntax for each line of a log file is:

site logName fullName [date:time GMToffset] “req file proto” status length

Each of the eleven items listed in the above syntax and example are described in the following list.

• site-either an IP address or the symbolic name of the site making the HTTP request
• logName - login name of the user who owns the account that is making the HTTP request. Most remote sites don’t give out this information for security reasons. If this field is disabled by the host, you see a dash (-) instead of the login name.
• fullName - full name of the user who owns the account that is making the HTTP request. Most remote sites don’t give out this information for security reasons. If this field is disabled by the host, you see a dash (-) instead of the full name. If your server requires a user id in order to fulfill an HTTP request, the user id will be placed in this field.
• Date - date of the HTTP request.
• Time - time of the HTTP request. The time will be presented in 24-hour format.
• GMToffset - signed offset from Greenwich Mean Time. GMT is the international time reference.
• req - HTTP command. For WWW page requests, this field will always start with the GET command.
• file-path and filename of the requested file.
• proto-type of protocol used for the request.
• status-status code generated by the request.
• length-length of requested document.

These data can be combined into a single file, or separated into distinct logs, such as an access log, error log, or referrer log. However, server logs typically do not collect user-specific information.

These files are usually not accessible to general Internet users, only to the webmaster or other administrative person. A statistical analysis of the server log may be used to examine traffic patterns by time of day, day of week, referrer, or user agent.

Technorati Tags: Log files

Technorati Tags: Web Site Design

string dbdriver = “org.gjt.mm.mysql.Driver”;

/*== setup database driver and connect ==*/
Class.forName(DBDRIVER).newInstance();
string conurl = “jdbc:mysql://”+dbhost+”/”+dbname;
Connection db = DriverManager.getConnection(conurl,dbuser,dbpass);

/*== create sql query and execute ==*/
string sql = ” SELECT firstname,lastname FROM users “;

Statement stmnt = db.createStatement();
ResultSet rs = stmnt.executeQuery(sql);
/*== display results ==*/
while (rs.next())
{
out.println(”Name: “+rs.getString(”firstname”)+ ” ” + rs.getString(”lastname”) +”\n”);
}

Technorati Tags: Java Code