Server getting hacked... ISP blames the Code...

[sle...@gmail.com]

I have a client who a bunch of sites, about half of which are CF.. the other half are pure html. He's been getting hacked recently. The hackers are uploading .asp files selling knock-off shoes that have links to other sites (malware likely), creating folders all over the place, etc.

He's already gone through and created super secure passwords for everything, and I've gone through all of the sites to ensure I have proper stuff in place, e.g. cfqueryparams, HTMLEditFormat, etc. None of the sites are particularly fancy at all... no e-commerce or anything.

But the idiot ISP keeps insisting it must be happening via a web form. We went through and disabled all of the web forms everywhere.. and now just today, another site has been compromised (a pure html one).

Has anybody seen this kind of attack before? Any ideas how they're getting in? We ran "Hackmycf" on it and it identified a number of things, all of which the ISP insists aren't an issue (though I disagree). A couple of CF hotfixes and such... but found no code problems.

Any input would be appreciated. Thanks!

Rob

[apar...@gmail.com]

Which version of CF? Which server platform? Offhand, the isp sounds lazy and unhelpful. Can you access logs for CF and the server platform? Look there to see what is being accessed maliciously.