Products

Solutions

Resources

Partners

Community

About

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...Report from the Australian Cyber Security Centre regarding an exploit concerning DNNReport from the Australian Cyber Security Centre regarding an exploit concerning DNN
Previous
 
Next
New Post
2/4/2019 3:57 AM
 
Check out this report from the Australian Cyber Security Centre regarding an exploit concerning DNN and FCK editor.

Some interesting reading on how an exploit was performed, what they did and how to avoid it.

https://cyber.gov.au/government/publications/manic-menagerie-targeting-web-hosting-providers/Report_Manic_Menagerie.pdf
 
New Post
2/4/2019 7:00 AM
 
Rod,

there is no word about which version of DNN is (or hopefully was) in use. But FCK Editor has not been supported on DNN since - I don't know, but my guess is DNN 5. (Telerik) RadEditor was in use then, and since DNN 7 it is CK Editor. I therefore suspect that the issue is that the investigated site has not been updated for years.

This is a risk, we all should know. But: Just updating is not enough. Many extensions (modules, skins,...) may (or will) break, esp. when you upgrade - even in steps - from DNN 4 to 9, even from 7 to 9. Therefore it is better to invest in a hosting company that will check everything and make the necessary updates of the modules and other extensions as well. Even if this could be a bit more expensive.

And: There is more to security than the security advisor, upgrades and activating https. Have you ever checked your site with https://securityheaders.io, https://www.ssllabs.com/ssltest/ or similar tools? Have you implemented a content security policy (CSP)? Have you secured the database access, or is the user running the site in the databases's db_owner or SQL Server's Sysadmins role? etc. etc.

Happy DNNing!
Michael

Michael Tobisch
DNN★MVP

dnn-Connect.org - The most vibrant community around the DNN-platform
 
Previous
 
Next
HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...Report from the Australian Cyber Security Centre regarding an exploit concerning DNNReport from the Australian Cyber Security Centre regarding an exploit concerning DNN


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out