CP passwords, means they most likley had weak passwords on the main account and they were able to get in via that, you would be surprised at the number of people that use password as their password, and other such easy “non-sense”
One thing I noticed on mine.. is my site was wide open. I don’t know how or when it happened but there was no challenge for user name and password at all. I reset the FrontPage extensions and at least closed that window.
Being open like that I am thankful there wasn’t more damage done..and really thankful that there wasn’t any sensitive information (like credit card numbers) there.
Another clients site hacked. This really sucks X(
Joe, please create a ticket to get the authentication back in place.
Joe,
Did you ever open the FP security settings window from within frontpage? I sometimes notice that it sets Anonymous to AUTHOR permissions instead of BROWSER, it sounds like this may have happened to you.
Stephen…that very well may have been what I did. I hope you guys don’t think I was implying something from your end..i take full responsibility for my screw-ups (I am good at that since I make so many of them:)
Tanmaya..if you really need or want me to open a ticket I will (however I am not sure if there is a permissions problem still) I don’t mean to make the issue more confusing…any chance you folks could just do a double check?
Joe, you can actually check it yourself, we have to request your password to check it anyway 
Here is how you can check:
http:// yourdomains.com
Modify this URL, then login with your FP user/pass, and check the permissions, it will have an assigned permission for Anonymous User, it should be BROWSER only.
Thanks Stephen..Done..it showed Anoymous as being Author..I changed it to Browser.
So is this recent hack spree mostly because of Frontpage extensions? Do I need to worry if I am not using it?
My clients site was on a coldfusion server, no frontpage extensions used or installed.
All of my hacked clients site had FP turned off and didn’t use any cms or forum
It has come to my attention that there is a security hole within some versions of FCKEditor.
This was installed within a program on my customers Coldfusion site. Keep in mind FCKEditor can be used with many scripting languages and the vulnerablity is the same.
It allows a hacker to upload scripts, and possibly gain access to a site in which it is installed. The vulnerability is in some sample scripts included with the tag. This tag is incoporated into many custom, free and pay web applications.
The fix seems to be to delete any default.asp, default.php, default.aspx, default.html, default.cfm, index.html, index.php, index.asp files that are not your own. Make sure to check any and all directories, starting at the web root, especially the following within the tag itself:
\fckeditorV2\editor\filemanager\browser\default\connectors
\fckeditorV2\editor\filemanager\upload
Some information can be found here. If you look around I’m sure you can find more.
surely that’s not a real commercial program…
fckeditor ??? ?(
yes, it is in MANY apps(both free and commercial), I have also seen it used as an attack vector.