I received the following message from Google Webmaster a few days ago, telling me there are suspected hacking on the Embedded101.com site:

========================================================

Google has detected that your site may have pages added by a third party. These pages may contain spammy or malicious content which violate our Webmaster Guidelines.

Typically, the offending party gains access to an insecure directory that has open permissions. Many times, they will upload files or modify existing ones, which then show up as spam in our index.

Sample URLs:

• http://www.embedded101.com/4FaEH.asp?...
• http://www.embedded101.com/U3RgOT.asp...
• http://www.embedded101.com/U3RgOT.asp...

========================================================

When I check the site, I found some files were uploaded to the site's root folder by hacker.  The files are in set of 2, using the same file name with different extensions, such as the following:

  -  4FaEH.asp

  -  4FaEH.gif

Basically, it's a black hat SEO practices.  The .asp file contains script that direct site visitor to other URL.

I've recently updated the site to the latest version of DNN 7.4.1.  These hacking activities happen after the site is upgraded to 7.4.1.

It's this a known vulnerability for DNN?

Is there some settings or configuration I can change to prevent this from happening?

 

Thanks in advance for you help!

Sam

 

 

 

 

 

Also, it is important that you configure your lock down your IIS installation to not allow ASP or PHP pages to run.  Most hosting providers offer a control panel that allows you to disable these extensions.  Ultimately, in order to track this down you will need to get a copy of your IIS logs.  Your hosting provider should be able to provide you access to those logs.

---

Joe Brinkman
DNN Corp.

Sebastian, Joe, Cathal,

Thanks for your help!

The hosting platform I'm using requires FTP over TLS encryption to access the FTP server, along with the strong password I'm using, FTP is not likely the weak link.

I checked and make sure classic ASP is disabled.
Classic ASP may be the weak link.
I've been changing different Web-server setting and not certain whether classic ASP was enabled when the attack took place.

The website does have the "/providers/htmleditorproviders/fck" folder, which Sebastian mentioned.

When I access "Host/Installed Extensions" as Super-user, I see the following Html editor providers in the "Providers" section:
- DotNetNuke Fck Html Editor Provider
- Telerik Editor Provider"

From the "HTML Editor Manager", I see the following 3 options which can be set as "Current Provider":
- FckHtmlEditorProvider
- TelerikEditorProvider
- DotNetNuke.RadEditorProvider
When selecting any one of the above 3 options, the following warning message (yellow) is shown:
"The current HTML Editor Provider is not supported by this version of the HTML Editor Manager."
Note: The "Change" button is disabled (gray out).

Question about HTML Editor:
- Which HTML Editor provider should I use for DNN 7.4.1?

While going through the DNN system to review security related issue, I find the "Security Analyzer" to be very useful to help find all ASP and PHP files.
In addition to finding ASP and PHP files, the Security Analyzer also identified "Rich text field" is used by public profile: message:
- "CheckBiography: Check if public profile fields use richtext" --> "The field is richtext"

Question about Richtext field:
- How do I change the public profile field from "Richtext" to "Plaintext"?


Best Regards,
Sam