A Site Still Running Joomla 1.5

Built in 2009, still running

Around 2009, Joomla 1.5 was a popular choice for clubs, associations and small businesses. It was free, extensions added galleries, calendars, forms and forums, and a member or a local developer could set it up.

Many are still running, with content updated over the years, so from the front they seem well cared for.

Underneath, nothing has changed. The Joomla project ended support for 1.5 in September 2012, and many of the extensions on these sites were abandoned by their authors before that.

These are the sites that get hacked, cleaned up, and hacked again within weeks.

What sits on a Joomla 1.5 site

• The Joomla 1.5 core, unpatched since the project stopped fixing it.
• A photo gallery or upload extension nobody has updated in years.
• A calendar, form or forum add-on from a developer who moved on.
• A template built for 1.5 that nothing newer can use.
• An old PHP version kept on the account so it all still runs.
• Administrator accounts for people who left long ago.

The second is the usual way in. Anything that accepts uploaded files is a favourite target, and a flaw in an abandoned extension stays open permanently, because nobody is left to close it.

How these sites are found

Nobody picks a club's website by hand. Automated scanners visit site after site, looking for software they already know how to break into.

Joomla 1.5 makes that easy. By default every page announces the version in its code, in a line naming Joomla 1.5, and extensions leave their own fingerprints in folder names and addresses.

Once a flaw in 1.5 or a popular extension is published, every site still running it is on a list. Being small does not help.

What a hack looks like

Most hacks on these sites are not visible on the home page. Pages advertising pills or knock-off goods appear in folders nobody looks in, and only search engines find them.

Some sites send visitors who arrive from a search to another site entirely, while showing the normal page to anyone who types the address. The owner never sees it.

Others host a fake login page for a bank, or send spam from the hosting account. Then the host suspends the account, or search results start warning that the site may be hacked.

Why cleaning up is not enough

A cleanup removes what the attackers added. It does not remove the way they got in, because that is part of the software the site depends on.

Attackers also leave themselves a back door: a small file tucked among hundreds of others, or an extra administrator account. A cleanup that misses one is undone the same week.

Restoring a backup has the same problem. The backup contains the same Joomla 1.5 and the same extensions, so the restored site is exactly as open as the one that was hacked.

Each cleanup costs money and days offline. Paying for three of them is usually paying for most of a new site.

Why patching is no longer an option

On a supported system, a published flaw is followed by a fix. With Joomla 1.5 no fix is coming, from the project or from the authors of abandoned extensions.

Moving to the current version, Joomla 3, is not a normal upgrade. Templates and most extensions written for 1.5 do not work in it, so the content is carried across and everything around it is rebuilt.

Joomla 2.5, the version in between, reached the end of its own support on December 31. A site that moved only that far has the same decision to make.

Many 1.5 sites also stop working on newer PHP versions, so the hosting account stays on an old, unsupported PHP as well. The old site holds back everything around it.

A worked example

A model railway club with about forty members meets twice a week in a rented clubroom, where its layout fills most of the floor, and holds an open house every spring.

Its website was built in 2009 by a member, on Joomla 1.5, with a photo gallery extension, an events calendar and a members' forum.

In two years it was hacked three times: once with pages selling pills, once redirecting visitors from search to a betting site, and once with a fake bank login hidden in a folder.

Each time a member cleaned it and restored a backup. Each time the attackers came back through the gallery extension, whose author had stopped updating it in 2011.

After the host shut the account down for sending spam, the committee paid for a rebuild on a current version of WordPress, with the open house page, the calendar and a maintained gallery.

The forum, used by six members, became an email list. Security releases now install themselves, and a named member checks every month that everything else is up to date.

Until the new site is ready

A rebuild takes weeks. In the meantime, some steps reduce the odds of another hack, though none of them makes Joomla 1.5 safe.

Remove every extension the site no longer uses, delete old administrator accounts, and change the passwords on the rest. Take a full backup of the files and database and keep a copy off the server.

Ask the host whether it can add a second password in front of the administrator pages. If the site has already been hacked twice, consider replacing it with a single holding page until the new one is ready.

The counter-case

Not every Joomla 1.5 site needs a large rebuild. A site that is really six pages of text and a contact form may be better replaced by something smaller and simpler than what it was.

A club or association with little money can rebuild the essentials first, the pages members and visitors actually use, and add the gallery or calendar later.

What does not work is waiting. A Joomla 1.5 site will be hacked again; the only choice is whether the rebuild is planned before that, or rushed after it.

Before the next cleanup

1. Check the Joomla version in the administrator panel.
2. List every extension and when it was last updated.
3. Delete old administrator accounts and change passwords.
4. Take a full backup and keep it off the server.
5. Write down what the site must do.
6. Get a quote for a rebuild on a supported system.
7. Set a launch date and hold to it.

Step five is the one that keeps the rebuild affordable. A club or business that knows which features it actually uses can leave the rest behind with Joomla 1.5.

The other common way in, through the office inbox rather than the website, is covered in the document that asks you to enable macros.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.