Macrotone Blogs

Macrotone blogs upon Joomla, our products and other matters.
Categories
Tags
Archives
Calendar
Categories:   All Categories
Suggested keywords
x
Miscellaneous
Blogs that do not fit into any other of our specified categories.
Geoffrey Chapman

Detected intrusion attempts

We have detected an unusual (for us) sudden spate of web attacks on our site by hackers which we thought we would share with the community.

These attacks have taken a different route to those we normally see. They have basically fallen into two separate categories:

Malicious User Agent:  
This attack vector describes where a hacker tries to access the site using a browser configured to send malicious PHP code in its user agent string (a small piece of text used to describe the browser to your server).  The idea behind it is that buggy log processing software will parse it and allow the hacker to gain control of the website.

Direct File Inclusion:
In this attack vector a hacker tries to trick vulnerable components into loading arbitrary files. Depending on the vulnerable component, the file will either be output verbatim or parsed as a PHP file. This allows attackers to disclose sensitive information about the site or to run malicious code uploaded to the site through another vulnerable vector, e.g. an unfiltered upload of executable PHP code.

Tags:
website joomla security
Geoffrey Chapman

Strange PHP error on live web site.

Noticed late yesterday a strange error occurring on our website when a specific article was accessed.

image

 

The error is :  DateTime::__construct(): Failed to parse time string (about 5 months ago) at position 0 (a): The timezone could not be found in the database

 

Nothing had been changed on the page for some time so I think this is some form of PHP bug.  [Currently running 5.4.11].

To resolve it I had to copy the offending article and then just point the menu items to the copy.  This indicates that it wasn’t anything specific about the article itself that was wrong.

Since the error is not specifically related to something that I/we have done, it is obviously something to report to the hosting company.

Not reproducible on any of our test instances, and of course it had to occur on the ‘live site’.  Isn’t that always the way. Smile

Tags:
PHP joomla
Geoffrey Chapman

Private IP addresses visible on Internet?

This should not happen, BUT we have observed a few private IP addresses being used by visitors to our site.

An IP address is considered private if the IP number falls within one of the IP address ranges reserved for private uses by Internet standards groups. The following  private IP address ranges exist:

      10.0.0.0 to 10.255.255.255
      169.254.0.0 to 169.254.255.255 (APIPA only)
      172.16.0.0 to 172.31.255.255
    192.168.0.0 to 192.168.255.255

These private IP addresses are (normally) used on local networks which includes homes, schools business LANs etc.  Devices with private IP addresses cannot (should not be possible to) connect directly to the Internet. Similarly devices outside of the local network cannot (should not be able to) connect directly to a device with a private IP.  Typically access to such devices are brokered by a router or similar device that supports Network Address Translation (NAT).  NAT effectively hides the private IP numbers but can selectively transfer messages to these devices, affording a layer of security to the local network.

Standards groups created the private IP addressing to prevent a shortage of public IP addresses available to Internet service providers and subscribers.

So given that these private IP addresses should not be visible on the Internet, how is it possible therefore for our site to have recorded access from devices with addresses in the 10.x.x.x and 192.168.x.x ranges? 

One can always block these devices from access to web pages by including the private address ranges within ‘blocked’ ranges, using commonly available tools available upon the web, but it still doesn’t explain how there are visible in the first place! If in doubt it is possibly wise to block them as a matter of course for a site on the Internet. Remember if the site is on a ‘local’ LAN that blocking them is not an option.

One wonders if there is a connection with the implementation of IP v6, and whether somehow these address ranges are getting through.  Alternatively perhaps a particular NAT provisioning mechanism is faulty?  Another possibility is that  dubious entities are using them to ‘mask’ their activities.  We are led to the latter possibility since the 10.x.x.x devices were attempting access to our site ‘back end’.

Despite some extensive searching we do not currently know the source of these connections, which raises a few possibly serious security concerns. We will continue our investigations.

Tags:
security Privacy Communications
Geoffrey Chapman

Doing more with LESS.

http://lesscss.org/images/logo.pngAs part of our ongoing work on our Joomla components we have been looking at the ‘next’ logical change that we want to implement with the CCS styles.  This is of course making use of the LESS compiler.

What is LESS you might ask.  Well LESS is a dynamic stylesheet language, which extends CSS with dynamic behaviour such as variables, mixins, operations and functions.  It can run upon both the server-side or client-side (modern browsers only) on a site.

Continue reading
Tags:
browser developers
Geoffrey Chapman

Web Standards

   I am reminded of the quote “The nice thing about standards is that there are so many of them to choose from.” attributed to  “Andrew S. Tanenbaum”, whilst looking into the structure of web pages.

The Firefox browser add in ‘FireBug’ provides a nice tool under ‘Tools- Validate HTML’ which enables the page one is viewing to be checked by the W3C Markup Validation Service.   By default it uses the standard defined at the start of most web pages, but the number and variety of possible standards is most interesting.  The output is a nice listing of ‘errors' and ‘warnings’ upon the page structure and its elements. [Note that it excludes the ‘new’ standards mentioned below, although it does have ‘HTML5 Experimental’]

Whilst one can then proceed to correct and eliminate the errors and warnings it does raise the question as to what standard should one be writing web pages to:  HTML5, XHTML 1.0 Transitional, XHTHL 1.0 Standard, XHTML 1.0 Framework, HTML 4.01 Strict etc.  The list goes on to provide about 15 possible standards.

Continue reading
Tags:
Tools Javascript browser compliance regulations
Geoffrey Chapman

Problem accessing some sites and HTTPS Everywhere.


We have noticed a small problem recently when trying to access a specific site ‘www.joomla.org’.  Not a particularly unusual place to access given some of our work. What was confusing was that other sites in the same domain were all accessible.

After much head scratching and trial and error, clearing cache’s and disabling cookies etc.  we eventually discovered the cause.

We use an extension names HTTPS Everywhere in our Chrome and Firefox browsers and it was this that was forcing the use of the HTTPS protocol on the site.  The result was that the site was always timing out.  Once identified the resolution was (as usual) simple, and involved disabling the use of HTTPS for that specific address.  Once this was done the problem was solved.

This type of problem may of course impact other web addresses, but after six months of use we must admit it is the only site that has every given us any problem. One for others to note in case they have the same type of problem.

Geoffrey Chapman

SPAM and IP blocking

spamSince we started mapping IP addresses of persistent attempts to submit SPAM on our live site, it is obvious that Miami in the US is one of the most persistemt source. Already even though it is only the fourth day of the month we can see 128 attempts to submit SPAM messages.

This is annoying since it just increases the size of the server logs that are inspected for system problems and adds a lot of background noise.

I have decided therefore to start blocking the persistent IP addresses being used. The effect is virtually immediate with the incidences which were occuring very 5 minutes or so having ceased. It is a pity that some individuals feel the need to insert advertisements for 'personal' products on sites where they are totally inappropriate.

We therefore apologise to anyone inadvertantly who may be refused site access because they are given an IP address in our blocked range.  If you are caught then please contact support who will investigate and if necessary 'unblock' the IP address.

Tags:
SPAM
Geoffrey Chapman

Farewell to Microsoft Messenger

With the imminent demise of Microsoft Messenger (25th March 2013), which we have used for a number of years without any problems, we have made the upgrade to using Microsoft Skype.  This being the product that Microsoft brought in and has decided to replace the ‘old’ Messenger service.

The upgrade went clean enough and the ‘old’ Messenger software was successfully uninstalled.. Now to see how it measures up.

Noticed the upgrade tried to ‘push’ the use of Bing, and MSN as a homepage in the browser, which can be easily overlooked, but somehow one expects that!

Now to see how it works in practise.

Addresses etc. remain unchanged, so current contacts should all continue to work.

Geoffrey Chapman

Strong Passwords

Just read an interesting article on Wired that I thought I would share.

It reflects current thinking, and invoked a lot of comments.  Now if Joomla just applied some of the options.

Now that is a suggestion for a good plugin!

Geoffrey Chapman

Apple tracking iOS 6 users

apple
Apple's launch of the iPhone 5 in September came with a bunch of new commercials to promote the device. Not surprisingly Apple didn't shout quite so loud about an enhancement to its new mobile operating system, iOS 6, which also occurred in September: The company has started tracking users so that advertisers can target them again, through a new tracking technology called IFA or IDFA.

See Business Insider

Tags:
security Apple
Go To Top

Joomla! Debug Console

Session

Profile Information

Memory Usage

Database Queries