Hi,
I just noticed a new file shirin.aspx in the root of my DNN installation. The file contents say something about hacking, and when I google "shirin" links to shirin under my sites (and other peoples sites) come up.
Luckily it seems that they havent broken anything (yet!), but I have no idea how this is possible for them to do this.
 I've contacted my ISP (WebHostUK) but wonder if there is any known security holes in DNN 5.2.3 ?
It's on the cards to upgrade as I presume that will be the response ... I guess I need to do this, but any help anyone can suggest to help secure the sites in the meantime would be really gratefully received ...
Many thanks
Rob

I forgot to add the link I found - that had *something* about it - but really nothing about the hack itself. It just seems to show the sites affected (*big* list) - and that it's a homepage and mass page defacement thing. (Did I say defamation by mistake in my last post! - chit I think I did - I meant defacement! :) Cheers, Duncan.

In the light of this, I discovered that write privs were enabled for the whole hosting area. So I've now had this locked down to read only except the \Portals folder (where users will need to upload docs and images etc). Just wondering then, if this is what everyone else does? What folders need write privs? How does this affect things like DNN upgrade, when DNN presumably writes things all over the place? And adding extensions, when DNN could be writing DLLs to \bin folder and stuff all over the place. Any advice on a secure configuration that people use appreciated. Also, any ideas on how the hacker person was able to write the file in the first place....should I blame DNN or the Hoster, who says they apply all windows patches every weekend ..... And, will they have been able to read the web.config file? and therefore be able to see user data in the database, etc? Should I be worried?! Many thanks all Rob