RE: Help! Blogs.ntu.edu.sg was hacked.

Before starting on potential actions, I would suggest defining what goal are you setting for your effort?  It's likely one of three possibilities:

1) You simply want to repair the solution and get back up and running as quickly as possible, ignoring how or why the hack occurred.
2) You want to get back up and running but also uncover how the hack occurred and fix it so that it does not happen again
3) You want to fix the solution, block future hacks of similar nature and also investigate who broke in so that you can potentially take legal action (if possible)

Each successive level takes more time, money and resources to achieve - which one are you focusing on?

Tariq Rahman
Supervisor/IT Risk Team
Cytec Industries Inc.

________________________________________
From: [email protected] [[email protected]] On Behalf Of Teo En Ming (Zhang Enming) [[email protected]]
Sent: Monday, December 17, 2012 11:04 AM
To: [email protected]; Teo En Ming (Zhang Enming)
Subject: Help! Blogs.ntu.edu.sg was hacked.

Dear list,

Blogs.ntu.edu.sg was hacked recently. Please search the Yahoo! search
engine for blogs @ ntu. You will observe that the Yahoo! search engine
returns results displaying nike shoe advertisements. If the user agent
is a browser or Google Bot, and the referrer is Google, traffic to
blogs.ntu.edu.sg will be redirected to http://www.newfreeshoes.com/

We have searched the wordpress directories and the mysql database but
found nothing. How can we trace what the hackers have done to
blogs.ntu.edu.sg?

Thank you very much.

--
Yours sincerely,

Mr. Teo En Ming (Zhang Enming)
Singapore




This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now!
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------


Legal Notice: This electronic communication, including any attachments, contains information from Cytec Industries Inc. or its subsidiaries that may be legally privileged, confidential, and exempt from disclosure under applicable law.  If you are not the intended recipient, any use or dissemination of this communication or its attachment(s) is strictly prohibited and may be illegal.  If you have received this communication in error, please notify the sender immediately, destroy any printed copies and delete it from all computers on which it may be stored.



This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------