Support

Admin Tools

#11917 php file scan threat files from akeeba backup etc.

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Monday, 09 April 2012 11:22 CDT

Monday, 09 April 2012 10:50 CDT

user13776
Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yes
Have I searched the tickets before posting? Yes
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: 1.5.26, 2.2.4
PHP version: 5.3.6
MySQL version: (unknown)
Host: (optional, but it helps us help you)
Admin Tools version: 2.2.5

Description of my issue:

Hi,
I notice that many of the files reported as having the highest threat level by the PHP file scanner come from either Admin tools or Akeeba backup. I am running the latest versions of both extensions and a quick review of the top files indicates that they have not been modified. I'm not sure if this is the intended behaviour, but if so could I suggest that a useful enhancement would be for Admin tools to have (or download) a list of the checksums of all the files from both applications so it doesn't flag them as potential threats if they are unchanged?

Example report:
admintools_scanalert_id newfile suspicious filestatus path threat_score
1789 1 0 1-new libraries/fof/controller.php 390
1032 1 0 1-new administrator/components/com_admintools/akeeba/platform/jfscan/engines/archiver/jfscan.php 160
740 1 0 1-new administrator/components/com_akeeba/models/confwiz.php 129
1755 1 0 1-new libraries/simplepie/simplepie.php 112
688 1 0 1-new administrator/components/com_akeeba/akeeba/utils/securesettings.php 98
1058 1 0 1-new administrator/components/com_admintools/akeeba/utils/securesettings.php 98
493 1 0 1-new administrator/components/com_akeeba/restore.php 97
668 1 0 1-new administrator/components/com_akeeba/akeeba/plugins/utils/azure.php 97
752 1 0 1-new administrator/components/com_joomlaupdate/restore.php 97
957 1 0 1-new administrator/components/com_admintools/restore.php 97
1835 1 0 1-new libraries/joomla/utilities/simplexml.php 96
etc.

Cheers

Mike

Monday, 09 April 2012 11:22 CDT

nicholas
It is the intended behaviour. As for what you have to do, please consult the documentation of the PHP file change scanner feature (hint: you have to mark them as safe).

Why not download something like a definitions list? If you had to download the definitions list every time you run a scan, you'd have the following problems:
1. If for any reason you could not download that file (e.g. host restrictions, networking issues, etc) that feature would not work.
2. This is considered a "phone home" feature by the Joomla! Extensions Directory and they would delist all of our components forever and immediately (updates are the only kind of allowed communication with the developer's site).
3. If thousands of you requested that file from our site all the time, our site would be down. Therefore, I'd have to download it and cache it for quite a while.

The third problem has two corollaries:
a. If I were a hacker, I'd hack the files of those components and replace the cached definitions file with my own, which makes the hacked files look as legitimate.
b. Whenever you updated you'd have to wait at least 24 hours before running a new scan, otherwise the new version's files would be reported as suspicious.

And, finally, if I did that for my own components, soon enough users would ask me to do the same for all 9000+ extensions on the JED, with all versions of each one.

I have already given you and documented a very easy workaround which only requires some time the first time you scan a site after an update. I believe it's the best approach.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!