{"id":5636,"date":"2012-09-06T12:04:50","date_gmt":"2012-09-06T19:04:50","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=5636"},"modified":"2015-03-26T13:52:29","modified_gmt":"2015-03-26T20:52:29","slug":"universities-extremely-vulnerable-to-hacking-and-network-security-breaches","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/universities-extremely-vulnerable-to-hacking-and-network-security-breaches\/","title":{"rendered":"Universities Extremely Vulnerable to Hacking and Network Security Breaches"},"content":{"rendered":"

\"\"<\/a><\/p>\n

You wanna see something kinda creepy? Try a little Google search with me. No, it\u2019s okay \u2013 I promise this isn\u2019t going to turn up images that require brain bleach. Look up the terms “university breached.” This search shows you an incredible number of stories about universities from the smallest to the largest in the country being hacked, and a disturbing number of those headlines contain the word \u201cagain.\u201d<\/p>\n

This is particularly upsetting, given that in a lot of these cases it\u2019s not just names or email addresses, but social security numbers, credit card or bank details, date of birth, phone numbers, plus names and email addresses. More than enough to thoroughly screw with someone\u2019s digital life and credit rating. Sure, you don\u2019t get the publicity and notoriety hacking a school that you do for dumping login credentials for a government agency or major vendor that has millions of customers. But the information you do gather is a lot more financially valuable, and it\u2019s apparently a very easy task. This makes universities a very tasty target for cybercriminals.<\/p>\n

Early in 2012 a group calling itself N0B0DY and N0LIFE tried to bring this situation to light with a\u00a0hacktivism campaign they called #OpEdu<\/a>, short for Operation Education. They hacked into six different schools over the course of about a month before (temporarily?) suspending the campaign. Another hacker called Joinse7en posted a list of URLs pointing to vulnerable universities, which comprised 16 different major universities. And these were hardly isolated incidents.<\/p>\n

Security researcher Kurt Aubuchon did a\u00a0search of publicly reported breaches<\/a>\u00a0that happened between 2009 and 2011, and even when excluding inside jobs (namely staff or students hacking the network), universities are hacked 357 times more than would be expected, if breaches were distributed evenly among US firms. That\u2019s more than hospitals, hotels and resorts, bars and restaurants by quite a bit. Keep in mind that 2011 had\u00a0fewer attacks on higher education<\/a>\u00a0than any year since 2005, both in terms of the number of institutions and records affected. However, by all accounts, 2012 already appears to be one of the worst years yet for attacks on schools.<\/p>\n

There are a lot of possible reasons why universities have been so heavily targeted, aside from all that juicy PII<\/a>\u00a0(which hospitals also have in abundance). It\u2019s widely known within InfoSec circles that universities are particularly difficult to defend. Part of this is the culture of openness, as well as increasing budget troubles for most schools. Automated hacking tools are certainly helping people locate poorly defended targets much more quickly and easily too.<\/p>\n

To quote Aubuchon:<\/p>\n

\u201cIt may be the case that, perceiving a conflict between security and academic freedom, these institutions leave themselves poorly defended against external attacks, or that they for other reasons fail to address information security effectively.\u201d<\/p><\/blockquote>\n

But not all schools view network security as a failure of academic idealism. In a future article we\u2019ll see how some schools use network security as a chance for valuable education to prepare students for a rapidly growing career field.<\/p>\n

photo credit: Chris Devers<\/a> via photo pin<\/a> cc<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

You wanna see something kinda creepy? Try a little Google search with me. No, it\u2019s okay \u2013 I promise this isn\u2019t going to turn up images that require brain bleach. Look up the terms “university breached.” This search shows you an incredible number of stories about universities from the smallest to the largest in the […]<\/p>\n","protected":false},"author":6,"featured_media":14055,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[13],"tags":[1921,1918],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n