Macrotone Blogs

Macrotone blogs upon Joomla, our products and other matters.

Detected intrusion attempts

We have detected an unusual (for us) sudden spate of web attacks on our site by hackers which we thought we would share with the community.

These attacks have taken a different route to those we normally see. They have basically fallen into two separate categories:

Malicious User Agent:  
This attack vector describes where a hacker tries to access the site using a browser configured to send malicious PHP code in its user agent string (a small piece of text used to describe the browser to your server).  The idea behind it is that buggy log processing software will parse it and allow the hacker to gain control of the website.

Direct File Inclusion:
In this attack vector a hacker tries to trick vulnerable components into loading arbitrary files. Depending on the vulnerable component, the file will either be output verbatim or parsed as a PHP file. This allows attackers to disclose sensitive information about the site or to run malicious code uploaded to the site through another vulnerable vector, e.g. an unfiltered upload of executable PHP code.

Website Anti-Spam


A recent comment requested some additional anti-spam option in our Issue Tracker component. That triggered much though on a topic that obviously impact all website and their components, be it blogs, commenting systems etc.

There are a number of different parts to preventing spam on a website and this is to expand upon our own particular take on the subject.

Spam is one of the many problem that face web sites today. It is basically the proverbial ‘pain in the neck’ and if not handled correctly can be very time consuming. How often have you viewed web sites where there are totally unrelated comments /registrations/ forums posts which has to make one think about the site’s reputation and credibility.

Our site is not immune to this problem and the source is not restricted to any specific country although there does seem to be a preponderance from locations such as Turkey, China, Russian Federation and more recently Ukraine and Brazil.

Continue reading

PECR, ICO cookies regulations

The new Privacy and Electronic Communications Regulations (PECR), announced by the Information Commissioner’s Office (ICO) in 2011, comes into effect on 26th May 2012.  In advance of the ICO cookies compliance date, organisations are expected to take appropriate steps to be compliant, which include making proactive changes to their websites.

We have blogged about this topic before and reference should be made to the official EU cookie compliance guide (registration required) which contains news and advice for organisations in Europe and around the world for complying with the cookie law.

The ICO provides specific guidance on PECR compliance.  However this is not all that clear (to me at least), so the absence of clear guidance on cookie compliance, and the range of practical difficulties that will be encountered in determining what to do with each identified cookie, may lead many website operators to struggle with the compliance process.

Continue reading
Go To Top

Joomla! Debug Console

Session

Profile Information

Memory Usage

Database Queries