[OPEUreppms] VIRUS Update: SEIU Local 503 Website

[SIKEL Anna * HRSD LRU]

SEIU has informed us that the issue with the email virus I notified you
about two weeks ago.  Below is notification from their IT staff
regarding the issue and confirmation that their website is virus-free.
Please let your staff know as appropriate.

 

Thank you for your patience. 

 

Anna Sikel

Office Manager

DAS, HRSD, Labor Relations Unit

503-378-2616 desk

Data Classification:  Level 1 Published 

From: Jeff Seekatz [mailto:seekatzj at seiu503.org] 
Sent: Wednesday, January 04, 2012 3:15 PM
To: anna.sikel at state.or.us
Cc: Mollie May
Subject: SEIU Local 503 Website

 

Anna,

Mollie asked me to send you an update on our website.  Below is my
notice to the DAS data Center folks about a half an hour ago and their
reply back to me.  The International (where our site is hosted) had a
number of their web servers compromised.  Our site now appears to be
clean and that has also been confirmed by folks at the DAS Data Center.
The IS Department here and the DAS Data Center folks will be monitoring
our site closely.

Jeff

John Ritchie to mike.bushman, me, GATHERUM 

show details 2:51 PM (15 minutes ago) 

	

Jeff,

Thank you for the update.  We confirmed that the bad javascript areas we
knew of have been cleaned up and it's good to hear that the web admins
have taken further hardening efforts to prevent this from happening in
the future.  It doesn't sound like they found the root cause, but the
measures they took may keep future attacks from being effective.

Mike, can you remove the block on the SEIU site?  Let's keep an eye out
for more redirects to the bad site originating from SEIU, but it sounds
like they've cleaned up the problem.

Regards,

John Ritchie


On 1/4/12 2:40 PM, "Jeff Seekatz" <seekatzj at seiu503.org
<http://seekatzj@seiu503.org/> > wrote:

Hi All.

We received this message about an hour ago from the Tech folks at the
International. We wanted to do our own checking this time so there has
been some delay in getting back to you.  We have confirmed that we see
no redirect traffic emanating from the site.   Please read their
comments.   It is almost exactly what we first reported with your help
almost two weeks ago.   I think it is appropriate to remove the block.

Please notify me ASAP if any suspicious activity reoccurs.

Jeff


-- 
***************************************************
Jeff Seekatz
Information Systems Supervisor
SEIU Local 503, OPEU
1730 Commercial St SE
Salem Oregon 97302

Office - 503-581-1505 Ext 162 <tel:503-581-1505%20Ext%20162> 
Cell - 541-760-3125
Fax - 503-581-1505

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://omls.oregon.gov/pipermail/opeureppms/attachments/20120104/2f23ad63/attachment.html>