.htaccess File Being Rewritten Every 30 Minutes on Joomla

We have worked with weird Joomla problems before, but this problem took the concept of weirdness to a whole new level! Here’s what was happening:

1. The .htaccess file is hacked (hacking the .htaccess file is common and is easily remediable) and is redirecting traffic to the website when using Google Chrome to google.com, while traffic from both Mozilla Firefox and Internet Explorer was redirecting to a virus infected website.

2. We upload a clean version of the .htaccess file and the site works fine.

3. After 30 minutes, the .htaccess file is automatically changed to the hacked version.

4. Repeat the above forever. (or at least until we knew the real reason of the problem)

Our first guess at the problem was that the permissions on the .htaccess were wrong, and so we set to them to 444 (which are the normal permissions on such critical files – if someone wants to change the .htaccess file then he’ll need to do it manually). This hasn’t worked, and the problem still existed.

We then called the hosting company to ask them if they have any tools that log file changes (e.g. which process/file is making a change to a file, which user is doing that change, and when is that change taking place). They said that they don’t maintain such logs.

We then wondered, what about the web logs? And so we checked them to see if there were any weird calls in these logs, and there were. In fact, we saw requests every 30 minutes from a specific IP (starting with the number 5) which was calling a file called .cache_*.php (located under images/banners), where * is usually a combination of 6 characters. That file was actually a duplicate of the file administrator/includes/toolbar.php with one difference: at the end of that file there was a very long preg_replace command, which was the actual hack! We deleted that file, and everything went OK – for a while!

A few hours later, the problem re-appeared, and the file .cache_*.php was restored. The thing is, there was another file, with a very innocent name, called script.php (located under the root of the website), which was being called if the .cache_*.php file was deleted. So, in other words, a program on the hacker’s end was doing the following:

• Calling images/banners/.cache_*.php every 30 minutes and rewriting the .htaccess file to redirect to a malware site.

• If it doesn’t find the .cache_*.php after approximately 10 retries, it was calling the file script.php, which will recreate the .cache_*.php, and then it will run the code in the .cache_*.php

We have to admit that this was one of the more advanced hacking techniques we have seen – but we did fix it by deleting the two files above and temporarily setting the permissions on the images/banners directory to 555 (r-xr-xr-x). It took us several hours to do that, but we did fix it eventually! And our customer couldn’t be happier as she was able to enjoy her weekend!

So what was the cause of this hack?

Well, the website was running Joomla 1.5.26 – which is now an unsupported version of Joomla since May of 2012 – which means that any vulnerabilities that exist on this version will no longer be addressed by the Joomla team. We have educated our customer about the benefits (especially when it comes to security) of migrating to Joomla 2.5.x as well as the complexity of such migration. We’re happy to say that our customer was convinced and has decided to migrate all her websites to the latest version of Joomla, which means a cleaner Internet for us all!

If your .htaccess file on your Joomla website is being changed every 30 minutes (or every hour), then try to fix it by following the above guide (once you clean your website then it’s recommended that you enhance its security by following our Joomla security tips). If you can’t, then fear not, all you need to do is to contact us and we’ll fix it for you in no time and at a very reasonable rate. We are also the nicest people that anyone can work with!