Dear all:

You can block the DNN security scanner from PowerDNN in order to prevent anybody from using it to reveal information about your DNN implementation.

It is very easy, the only catch is that you must be able to make changes to IIS on the server.  The solution is to block the address for the PowerDNN site, it is 216.58.236.42 (this is public, easily obtained information).  I just did this and attempted a scan, the scanner immediately shows "Could not verify website as a DotNetNuke Website." 

Hope this helps those with concerns about this tool until the dust settles about the true vulnerabilities (if any) and possible patches.

Carlos

Yeap, most hosts have also blocked the tool as well. Its original intent was sound but as with all good things, some bad eggs ruin it for the bunch. Most hosts will allow you to block this if you just contact them.

A case could be made for removing the .txt files - and the old .SqlDataprovider files once they have ben run in the Install/Upgrade as they have no further use.  If a user needs to "rebuild" their site from scratch then they could "upload" the files from a fresh package.