Friday, May 25, 2007
Hackers exploit unpatched flaw, disabled firewall to access personal info of 45,000 University of Colorado students
Hackers exploit unpatched flaw, disabled firewall to access personal info of 45,000 University of Colorado students
Dan Kaplan May 23 2007 19:04
A disabled firewall and an unapplied patch allowed hackers to infiltrate a server at the University of Colorado, Boulder, exposing the personal information of nearly 45,000 students, the university said Tuesday.
Attackers exploited a Symantec Norton AntiVirus vulnerability to launch a worm into the server of the College of Arts and Sciences’ Academic Advising Center, the university said in a statement. The suspects made off with the names and Social Security numbers of 44,998 students enrolled at the college since 2002. The university discovered the attack on May 12.
"The server’s security settings were not properly configured and its sensitive data had not been fully protected," Bobby Schnabel, the school’s vice provost for technology, said in the statement. "Through a combination of human and technical errors, these personal data were exposed, although we have no evidence that they were extracted."
Schnabel told SCMagazine.com today that he blamed the event on the fact that the compromised server was overseen by a smaller IT staff "with more general sets of responsibilities" than the university's central IT department.
"Sometimes you don’t get the attention to security you get in a big, central organization," he said.
IT officials believe the attackers were not trying to purge sensitive information, but instead gain control of the machine for use as a botnet. Had the firewall been enabled, the worm would have been stopped, Schnabel told SC.
Chandler Hall, vice president of marketing and a co-founder of network security firm Arxceo, told SCMagazine.com today that the college should have had a network-layered defense to stop both signature-based and zero-day attacks.
"I think bottom line — there’s always going to be a human factor," he said. "I would never point a finger at a large LAN environment and say that it was poor practice."
As a result of the incident, the college is ordering the IT operations at the Arts and Sciences Advising Center to come under the control of the central IT department at the university, Schnabel said.
In addition, the college has instituted a plan to stop using Social Security numbers as identifiers, according to the statement.
Technology-wise, the university plans to implement new host-based intrusion detection (HIDS) software, which monitors systems for suspicious activity. Last fall, the school deployed a "restrictive network firewall" that has helped cut down on vulnerabilities.
The university also conducts a security awareness program, in addition to conducting regular risk assessments.
Symantec, in an email statement sent to SCMagazine Wednesday night, said it was reaching out to the university to get more information on the incident. The company recommends regularly applying vendor patches as a way to protect against system threats.
Dan Kaplan May 23 2007 19:04
A disabled firewall and an unapplied patch allowed hackers to infiltrate a server at the University of Colorado, Boulder, exposing the personal information of nearly 45,000 students, the university said Tuesday.
Attackers exploited a Symantec Norton AntiVirus vulnerability to launch a worm into the server of the College of Arts and Sciences’ Academic Advising Center, the university said in a statement. The suspects made off with the names and Social Security numbers of 44,998 students enrolled at the college since 2002. The university discovered the attack on May 12.
"The server’s security settings were not properly configured and its sensitive data had not been fully protected," Bobby Schnabel, the school’s vice provost for technology, said in the statement. "Through a combination of human and technical errors, these personal data were exposed, although we have no evidence that they were extracted."
Schnabel told SCMagazine.com today that he blamed the event on the fact that the compromised server was overseen by a smaller IT staff "with more general sets of responsibilities" than the university's central IT department.
"Sometimes you don’t get the attention to security you get in a big, central organization," he said.
IT officials believe the attackers were not trying to purge sensitive information, but instead gain control of the machine for use as a botnet. Had the firewall been enabled, the worm would have been stopped, Schnabel told SC.
Chandler Hall, vice president of marketing and a co-founder of network security firm Arxceo, told SCMagazine.com today that the college should have had a network-layered defense to stop both signature-based and zero-day attacks.
"I think bottom line — there’s always going to be a human factor," he said. "I would never point a finger at a large LAN environment and say that it was poor practice."
As a result of the incident, the college is ordering the IT operations at the Arts and Sciences Advising Center to come under the control of the central IT department at the university, Schnabel said.
In addition, the college has instituted a plan to stop using Social Security numbers as identifiers, according to the statement.
Technology-wise, the university plans to implement new host-based intrusion detection (HIDS) software, which monitors systems for suspicious activity. Last fall, the school deployed a "restrictive network firewall" that has helped cut down on vulnerabilities.
The university also conducts a security awareness program, in addition to conducting regular risk assessments.
Symantec, in an email statement sent to SCMagazine Wednesday night, said it was reaching out to the university to get more information on the incident. The company recommends regularly applying vendor patches as a way to protect against system threats.
Labels: Univ. of Colorado
Friday, January 19, 2007
CU-Boulder Reports Security Breach In College Of Arts And Sciences Advising Computer
CU-Boulder Reports Security Breach In College Of Arts And Sciences Advising Computer
Dec. 15, 2006
University of Colorado at Boulder officials today announced that a server in the campus's Academic Advising Center was the subject of a computer attack.
CU-Boulder officials said they had begun the process of notifying 17,500 individuals that their personal information - including names and Social Security numbers - might have been exposed in the attack. CU-Boulder officials are continuing to determine the extent of information exposed.
Employees with CU-Boulder's Information Technology Services office discovered the attack on Dec. 8 and, following CU guidelines, began an investigation to determine how the system compromise occurred.
"The hacker apparently entered the server through a Web page," said Todd Gleeson, dean of CU-Boulder's College of Arts and Sciences, which houses the Academic Advising Center. "The information exposed contained the names and Social Security numbers of students who attended CU-Boulder orientation sessions from 2002 to 2004. We do not presently have any evidence that the data were actually accessed or used, and we are notifying the students affected."
In 2005, CU-Boulder ceased using Social Security numbers as administrative identifiers for faculty, staff, students and administrators.
CU-Boulder Vice Provost for Campus Technology Robert Schnabel said the attack was quickly discovered and assessed by ITS personnel. "Following our protocols, they immediately notified our campus ITS security office and the investigation began," said Schnabel.
Schnabel said the attack comes at a time when a comprehensive effort is under way on the Boulder campus to locate and remove existing personal data from departmental servers and to protect other sensitive data. He said ITS is piloting a new "sweeping" software utility called "Spider" that identifies personal data such as Social Security numbers that may still exist on a computer, so that the data can be quickly purged.
"Using this sweeping software is part of our continued effort to build a comprehensive information risk management program," said Schnabel.
Students who wish to know more about how to deal with identity theft can visit a special CU Web site at www.colorado.edu/its/security/awareness/privacy/identitytheft.pdf.
Contact: Bronson Hilliard, (303) 735-6183 or
(303) 818-7496 (cell)
Bobby Schnabel, (303) 492-5094
Todd Gleeson, (303) 492-7294
Dec. 15, 2006
University of Colorado at Boulder officials today announced that a server in the campus's Academic Advising Center was the subject of a computer attack.
CU-Boulder officials said they had begun the process of notifying 17,500 individuals that their personal information - including names and Social Security numbers - might have been exposed in the attack. CU-Boulder officials are continuing to determine the extent of information exposed.
Employees with CU-Boulder's Information Technology Services office discovered the attack on Dec. 8 and, following CU guidelines, began an investigation to determine how the system compromise occurred.
"The hacker apparently entered the server through a Web page," said Todd Gleeson, dean of CU-Boulder's College of Arts and Sciences, which houses the Academic Advising Center. "The information exposed contained the names and Social Security numbers of students who attended CU-Boulder orientation sessions from 2002 to 2004. We do not presently have any evidence that the data were actually accessed or used, and we are notifying the students affected."
In 2005, CU-Boulder ceased using Social Security numbers as administrative identifiers for faculty, staff, students and administrators.
CU-Boulder Vice Provost for Campus Technology Robert Schnabel said the attack was quickly discovered and assessed by ITS personnel. "Following our protocols, they immediately notified our campus ITS security office and the investigation began," said Schnabel.
Schnabel said the attack comes at a time when a comprehensive effort is under way on the Boulder campus to locate and remove existing personal data from departmental servers and to protect other sensitive data. He said ITS is piloting a new "sweeping" software utility called "Spider" that identifies personal data such as Social Security numbers that may still exist on a computer, so that the data can be quickly purged.
"Using this sweeping software is part of our continued effort to build a comprehensive information risk management program," said Schnabel.
Students who wish to know more about how to deal with identity theft can visit a special CU Web site at www.colorado.edu/its/security/awareness/privacy/identitytheft.pdf.
Contact: Bronson Hilliard, (303) 735-6183 or
(303) 818-7496 (cell)
Bobby Schnabel, (303) 492-5094
Todd Gleeson, (303) 492-7294
Labels: Univ. of Colorado
