There are different scenarios for hacks, one of them are vulnerabilities in Telerik components (that are still there but everyone in the team is trying to get rid of them - which is a lot of work, but it's getting better with every version). For that case I would strongly recommend to upgrade to the latest version.

Another source could be an unsecured FTP access to the server, incl. weak passwords for that. In this case you should consider turning the FTP service off, or to use SFTP with a client certificate. This is still not supported in IIS afaik...

But what if the hacker(s) have an administrative account for DNN? I would change the usernames and passwords of all members of the Administrators role, and suer users (hosts), if possible.

Finally (to have it said): If you find a security issue in a current DNN version, please do not post it here in the forums, but send an email to [email protected] or [email protected].

See also: https://dnncommunity.org/...l-known/security.txt

Happy DNNing!
Michael

Thank you for your answer.

We have already done most of the things that you listed
(password changes, Telerik  removal, check for unsecure FTP conections).

We'll see how it goes with the new version.
I'll report to  [email protected] if we find out any specific security issue.

 

Did you also check the editors providers?
You should remove all but the DNN Connect CK Editor IMO.

And you could also have a skin or module with a security issue. (older version of DNN Go skins for instance)

It might also be that they hacked your site in a previous version and installed some backdoors.
You could "hide" this in any aspx / ascx file in principle.