I had a quick search through the forums for discussions about this and general hacking of DNN - but there doen't seem to be alot - which I guess is a good thing.

This post is more to alert people that this is happening and hopefully somone can figure out how and stop it.

It looks like there may be some kind of vulnerability or exploit that hackers are using against DNN sites.  The web site www.zone-h.org is used to report sites that have been hacked or tampered with.  If you go to the archive and select the [Enable Filters] at the top of the page and then enter "Fribo" in the attacker field and then select Apply you'll see alist of sites this person has compromised.  Most of the sites reported are DNN and I'm basing this on the fact that the url consists of the following... http://www.domainname/portals/0/....

Here's a quick link to Fribo's list ... http://www.zone-h.org/archive/defacer=Fribo

It looks like the only damage been done is the upload of a txt file, and not a deface of the sites.  Whether this is because thats all they can do or they're just firing a warning shot I have no idea.  Regardless of what they are doing this is unauthorised access so it should be treated seriously.

Fribo is not the only one doing this.  Search for "Persian Boys Hacking Team" (this link will take you to a list of their sites http://www.zone-h.org/archive/defacer=Persian%20Boys%20Hacking%20Team )

Thanks for reading and responding (for those that do)

These hackers are exploiting a known bug that was patched over a year ago in DNN 4.8.3.  You can read more about the issue on Cathal's latest blog.

These exploits highlight the need for people to make sure they are monitoring the security bulletins and to keep their systems up to date. 

 Hi Cathal,

I sent an email to Security@ this morning but I haven't received any response.  Can you confirm that the message was received?