Millions of Joomla websites at risk due to bug

/in , , /by

Joomla BugUh oh, this isn’t good.

It seems that for over two years there has been a SQL-injection vulnerability in the Joomla Platform (which is used in millions of websites) that will allow remote takeover hacks.

SQL-injection vulnerabilities allow end users to execute powerful commands on a website’s backend database by entering “special” text in search boxes or other input fields found on a website. The flaws, which are among the most commonly exploited website vulnerabilities, are the result of an insecure Web application failing to enforce the treatment of incoming data as plain text rather than executable code. Often, this makes it possible for hackers to download confidential files from the vulnerable server.

Joomla have now patched the platform, but if website owners do not install the update, they are still vulnerable.

It’s a good thing all of our websites are using the WordPress platform 🙂

You can read more about this issue at Joomla Bug.

News from Google – They will help with reinstating Search Rankings after a Hack Attack

/in , , , /by

Google will help after a Hack AttackYou may not be aware, but if your website gets hacked, it will affect your search rankings.

This is obvious when you think about it. Google’s main aim is to serve up the best results for the searcher’s query, and obviously, a hacked website is not the best result!!

Google has announced that they will endeavour to assist Webmasters with reinstating their Search Rankings after a hack attack through their revamped Reconsideration Request Process.

In a recent Google Blog Post, they say they have recorded a 180% increase in the number of websites that have been hacked this year, and there has been a 300% increase in the number of Reconsideration Requests they have received.

Google have realised the difficulties inherent in their previous Reconsideration Request process, and have made a few changes that they say will assist Webmasters getting the websites back up and running and restore their previous Search Positions.

Specifically, these three changes:

  1. Better communication
  2. Improved tools
  3. A continuous feedback loop

Google have also also said that the step up for victims of hacking is part of a wider support initiative designed to protect websites from being hacked in the first place.

Better Communication will be in the form of advice specifically tailored to your personal circumstances when responding to a Reconsideration Request. Google will also make more advice available to webmasters to help improve website security and quickly tackle hacking issues if the website is compromised.

Improved Tools will be in the form of better access to resources required to recover from a hack attack. These include the auto removal of hacked manual actions (still in beta testing). This manual action removal will take place when search engine spiders detect that hacked content has already been removed – however, the webmaster will still need to submit a reconsideration request.

A hacked website troubleshooter is also available, and will guides webmasters through the steps required to recover from the attack. The “Fetch as Google” tool can also be used by showing exactly how Google sees the site. This will make it easier for the Webmaster to detect hacked content, including injected content.

Feedback from website owners that have been hacked and who are going through the Reconsideration Request process will continue to mould Google’s practices.

 

Website Revamp

/in , , , , , /by

Our revamped websiteI’m pleased to announce our much anticipated Website Revamp.

I’ve spent the last two weeks designing, tweaking and generally re-doing everything to do with the website.

It features an awesome Home Page “Layered” Slider, animated thumbnails and images, Testimonials and elegant styling.

It is of course responsive, meaning that it will display on all different devices regardless of screen size.

Are the dot com & dot com.au TLD’s dead?

/in , /by

Is the dot com TLD dead?My personal opinion is no, .COM and .COM.AU TLD’s (Top Level Domains) are not dead by a long shot.

However, there are many prominent organistaions out there suggesting that they are going the way of the dinosaur and are dead and buried.

There are a whole raft of new TLD’s now available. For example, .SYDNEY, .MARKET, .DENTIST, .PROPERTY and the list goes on. As a consequence, there has been a concerted push by those selling these new TLD’s to encourage their take-up.

From where I sit, 30 years on from the introduction of the first domain using .COM, it has taken this long for consumers and businesses to get their heads around using and understanding other TLD’s like .NET and .ORG, never mind newer ones like .TV or .BIZ, which I have to say, not one of my customers have opted for.

Is there a benefit in using one of the new TLD’s?

Having said that, I can see the new TLD’s gradually becoming more prominent in the minds of those starting new businesses and looking to take advantage of a Domain Name that was previously unavailable. As an example, there may be a domain registered like www.mydomain.com, and it is therefore not available to a new business. But what if you could register www.mydomain.sydney? Now that would be attractive to a business that has the same name as someone else and is also based in Sydney, because it immediately shows where they are based, and there would be definite SEO advantages having that keyword in the Domain.

But for the meantime, I cannot see people moving away from the good old .COM or .COM.AU any time soon.

You may also be interested in reading Should I use Domain Name email instead of using my ISP assigned email address?

 

Websites are being Encrypted and held to Ransom

/in , , /by

Encrypted Website Database - RansomThere is a new security threat for website owners to contend with.

Similar to Crypto-locker and other Ransomware, there is a new threat that will encrypt the core database files of a website.

Dubbed “RansomWeb” by Security firm High-Tech Bridge, database files are encrypted, and an email is sent to the admin demanding the payment of a Ransom to unencrypt the files. In one case, the Ransom demanded was US$50,000.

Stop your website from being encrypted and being subjected to a Ransom

Now even though this particular website was doing backups of the database, they were doing automated backups that remained on the Server. Unfortunately for them, their website was compromised months before the attack occurred, and consequently all their backups were compromised. This is why it is so important to download backups and keep them separate from the Server.

One of the things that we do here at Website Design by Spotty Dog Computer Services as part of our Monthly Maintenance and Backups Service is to download backups of your website to a local hard drive. We will keep up to 12 mths of backups so that in the event that something like this happens to your website, we can restore an uninfected and uncompromised backup.

Apart from downloading backups to a local hard drive, the best thing you can do is have a secure website. That means installing security plug-in’s that close security holes, and keeping WordPress and all Plug-in’s up to date as new releases are made available. This is of course part of our Monthly Maintenance Services too.

So if you have a WordPress based website, we can take steps to protect your website (and your sanity), but please do not wait until it is too late!!!

Just one of the many services we offer.