Hello..  A website we work on has been hacked somehow..  The main DNN default.aspx page has had what appears to be an cross-site scripting attack done to it.  The file modification date is 2/18/2011 @ 1:57am.  The DNN CE install is hosted off-site as well, so I'm not sure how much info we can get from the hosting company.

I was able to get a copy of the DNN database as well as the original files.  Whatever occurred, it took the site down two days ago.

Who can I contact to possibly get an investigation started on this?

Thanks.. -Jeff

Sounds like a file permission issue on the IIS server, or unsecure FTP. Either way, I would install the version you were using and update all modules, and database tables, if they are out of the box modules, reinstall from the original source. Make sure sever has all Windows and program updates. After getting it running make sure to update to DNN 5.6.1 to make sure all known DNN security updates are applied. (make sure any vendor modules are compatable with 5.6.1 before upgrade) Lastly, CHANGE ALL PASSWORDS

---

Thank you,
James Campbell
MCP,MCSA,MCSE,Sec +
http://jamesecampbell.blogspot.com

Hi Guys,

This happened to me, too. I'm running 4.9.5. On 3/30, I noticed html files in my root DNN directory that didn't belong. I deleted them and informed my host. The sites didn't appear effected (but I was just looking at the site itself - i don't know much about the sever side of things). I changed all passwords for FTP accounts, Hosting accounts and user accounts on effected sites. Then today, another html file that didn't belong was in the same effected installations. I googled this file name and it's the same "hacker army" that took down an NHS healthcare site in Dorset last week. Great. This time, it changed my Default.aspx file to display their own message. Again, I have removed the html files and replaced the Default.aspx files with ones from my local directory.

I contacted my host and got the following response:

"Ok, I have reset the permissions for Guest User for all your websites.
It seems some bug related to Dotnetnuke, which allowed the hacking
attempt and replacing default file.

Recently we received some information from other client
---
The malware was there because of a vulnerability in a rich-text editor,
"FCKEditor", so that anyone could upload malware without knowing the
login password."


Of course, it also effected a non-DNN site without FCK, so I don't think that is a problem.

Anyone else getting hacked all of a sudden? Any thoughts on what I can do? Am complete newbie when it comes to server side stuff so detailed directions are appreciated.

Thanks everyone!