Failure to patch flaw exposes data on 60,000 at Antioch
Unpatched Sun Solaris server breached at least three times
Computerworld - Windows systems may be the most frequently attacked by malicious hackers, but they certainly are not the only targets.
Serving as the latest reminder of that fact is Antioch University in Yellow Springs, Ohio, which recently disclosed that Social Security numbers and other personal data belonging to more than 60,000 students, former students and employees may have been compromised by multiple intrusions into its main ERP server.
The break-ins were discovered Feb. 13 and involved a Sun Solaris server that had not been patched against a previously disclosed FTP vulnerability, even though a fix was available for the flaw at the time of the breach, university CIO William Marshall said today.
The university was alerted to the breach while IT officials were investigating a separate virus that had also infected the system and was broadcasting obscene material from it, Marshall said. That particular virus was programmed to broadcast the material on the 13th of every month and was detected by the university's antivirus software, when it started doing so on Feb. 13, he said.
"When we went in and did a further investigation, we found that there was an IRC bot installed on the system," Marshall said.
According to Marshall, the university ERP system, based at Antioch's main campus in Yellow Springs, appears to have been breached on three separate occasions.
The first break-in occurred June 9, 2007, when intruders gained remote access to the ERP server via the unpatched Solaris FTP vulnerability. "The first one was an automated attack. It happened very, very quickly," Marshall said. The IRC bot discovered Feb. 13 appears to have been installed on the system one day after the initial intrusion, he said. Forensic analysis shows that the third time the server was illegally accessed was Oct. 11, 2007, Marshall said.
As far as the university can tell, the data on the server appears not to have been illegally downloaded or copied by the intruders, he said.
Following the discovery of the intrusions, the infected server was taken offline, the data on it was backed up and the operating system was reinstalled from scratch, Marshall said. "That's the only way we can be sure that we got everything on it that shouldn't be there," he said.
The compromised server contained information on current and former students and employees across all of Antioch's six campuses going back to 1996, Marshall said.
The system also contained information on individuals who had applied to Antioch but may have never attended the university and information on vendors who may have supplied their Social Security numbers in order to get paid. The compromised data included names, addresses, Social Security numbers, telephone numbers and academic records.
Notices informing the affected individuals about the breach and urging them to take measures to protect against ID theft were sent out last week, Marshall said. There are a couple of reasons for the delay, he added. First, the university needed at least two weeks to understand the full scope of the breach, and the university did not want to compromise investigations by law enforcement authorities by disclosing the breach prematurely, he said.
The main lesson from the intrusions is to make sure that patches get installed in a timely fashion whatever the environment, Marshall said. Just because Windows systems get patched and attacked the most often is no reason for getting complacent about security on other operating systems, he said.
Read more about Security in Computerworld's Security Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts