These type of boxes usually have 1 or 2 screws going through the bottom into a steel bar that spans between ceiling joists.
I think you are correct that this box is not properly supported.
If you have access from above, you can put a support (2x lumber) across to each joist and then screw through the box into the support.
Options from below only would involve removing the existing box and using one of several replacement boxes. Removing the existing box will involve turning off the power and prying the electrical cable loose from its strain relief. From the looks of the box, it should pull down. Fixture weight will determine which one to use.
The heaviest duty box is one rated for ceiling fans. It uses expandable threaded supports that wedge against the joists side to side. This box would be rated up to 50lbs.
An old work round plastic box has three retractable wings that clamp the box against the drywall. This box is suitable for lighter fixtures, perhaps up to 10lbs. It is very dependant on intact and unbroken drywall for best performance.
There's a few options.
No grounding conductor
If there's no grounding conductor at all, there's a few things you can do.
Install a grounding conductor
Obviously, you could install a grounding conductor for the circuit.
Share a grounding conductor
Code allows you to share a grounding conductor from another circuit, as long as the grounding conductor is properly sized.
GFCI protected
If you're replacing a fixture, you don't need a ground if the outlet is GFCI protected.
National Electrical Code 2014
Chapter 4 Equipment for General Use
Article 410 Luminaires, Lampholders, and Lamps
410.44 Methods of Grounding. Luminaires and equipment shall be mechanically connected to an equipment grounding conductor as specified in 250.118 and sized in accordance with 250.122.
Exception No. 3: Where no equipment grounding conductor exists at the outlet, replacement luminaires that are GFCI protected shall not be required to be connected to an equipment grounding conductor.
Grounding via conduit or cable covering or ground in box
At times, metallic boxes are grounded using metallic conduit, or the outer covering and/or internal bonding strip of armored cable. If this is the case, then the box may actually be grounded.
There's also a chance that there's a grounding conductor stuffed in the back of the box.
Extend the grounding conductor
If the box is grounded, you can simply connect a grounding conductor to the box. If there's a grounding conductor stuffed in the box, you can simply connect to it.
Best Answer
There are instance where this is possible and legal, such as bathroom vanity bar type lights with an integral and complete back plate. Other than that a box is absolutely mandatory.
Here is a good example. Imagine these fixtures flush against the wall.