This weekend our Dnn 4.3x installation got hacked. I thought DNN was one of the most secure portals out there?

Our site is at http://www.pokersnaps.com and we are running on a webhost4life semi dedicated server.

We will be working on a huge DNN commercial project soon and we do not want things like this happening on this commercial project.

We chose DNN as the platform because it was advertised as being safe and secure but after being hacked. I am not sure if this is true.

We would appreciate it very much for any tips on how to harden a DNN installation and a server running it.

In our experience, most DNN sites that get hacked, are not running on a secured OS. We take great steps to make DNN as secure as possible, but in the end, security relies on admins properly configuring and maintaining the server and to make sure that they are running a patched version of DNN.

Please send and email to security@dotnetnuke.com and our security expert may be able to help track down the root attack vector that was used to hack your site. If it is a DNN problem, we want to know about it so we can correct it.

---

Joe Brinkman
DNN Corp.

I message the tech support and this is what he said..

"For your folder permission, it seem you had given the write access for the user ehbIUSR_www2 to access your folder. So it will lead the security hole for another hacker to write the file to your dnn site. For this issue, i had removed that user for you. If you had any enquiry, please let us know. Thanks!"

So what user should i allow full write access?