Group says it hacked systems at 100 major universities
Harvard, Stanford, Penn among those hit; breached data mostly innocuous, analyst says.
Computerworld - A hacking group that calls itself Team GhostShell this week claimed credit for breaking into servers at 100 major universities from around the world, including Harvard, Stanford, the University of Pennsylvania and the University of Michigan.
In a message posted on Pastebin, the group said it accessed and publicly posted about 120,000 records from the breached servers.
The group, which recently claimed credit for several major hacking incidents, said it attacked the university systems to focus attention on what it called failing educational standards around the world.
A Computerworld review of a small portion of the publicly posted data showed what appeared to be names, phone numbers, email addresses, login credentials and other data from some of the breached servers.
In some cases, the hackers appear to have breached multiple servers at the same university.
At least some of the publicly posted data appeared to be innocuous.
In its Pastebin message, Team GhostShell claimed that it deliberately leaked little information from the hacked servers.
"We tried to keep the leaked information to a minimum, so just around 120,000+ accounts and records are here, leaving in their servers hundreds of thousands more," the message said.
"When we got there, we found out that a lot of them have malware injected. No surprise there since some have credit card information stored," it added.
A spokeswoman from Stanford University today confirmed that two of its departmental websites had been improperly accessed.
However, information security officers at the university consider the breach to be minor, she said. "No restricted or prohibited data was compromised, nor was any sensitive or other personal information that could lead to identity theft."
"The breach was discovered (Tuesday) night and the sites and their servers have been secured," the spokeswoman added in an emailed comment.
A University of Michigan spokesman confirmed that Team GhostShell had gained access to three servers.
"However there was no sensitive data or passwords accessed," he said in emailed comments. "What they gained access to was data that is generally available to the public on our website."
Officials at Harvard and Penn did not respond to requests for comment on the reported intrusions.
In a blog post, Identity Finder, a New York-based provider of data leak prevention software, said that its analysis of the leaked data suggests that the hackers spent about four months aggregating the information.
The leaked data includes more than 36,000 unique email addresses, and thousands of usernames and passwords -- some of them stored in hashed form and some in plain text format.
The compromised data also included thousands of names, addresses, and phone numbers, "several" dates of birth, and also information on citizenship, ethnicity and marital status of staff, students and alumni.
- New docs show DHS was more worried about critical infrastructure flaw in '07 than it let on
- Needed: Breach detection correction
- Evan Schuman: Resurrection of Full Disclosure mailing list is great news, if you're not a cyberthief
- Cyberattacks could paralyze U.S., former defense chief warns
- Syrian Electronic Army shanghais Microsoft's Twitter account, blog
- Is French outrage against U.S. spying misplaced?
- Lawmakers seek answers on Obamacare Data Hub security
- China-based hacking group behind hundreds of attacks on U.S. companies
- How to Prepare for a Potential Syrian Counterattack on the U.S. Power Grid
- New York Times site outage caused by attack on domain registrar, company says
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- The business impact of BYOA: Five major challenges and how your enterprise can solve them This E-Book reviews five major challenges of BYOA with key subject matter experts and outlines how businesses can solve them.
- BYOA: Embracing the Opportunity, Controlling the Risk This whitepaper explores the shift from BYOD to BYOA (bring-your-own-application) and how IT departments today can address this new change in the IT...
- Learn More About Peer 1 Hosting's Mission Critical Cloud Mission Critical Cloud from Peer 1 Hosting is enterprise-ready, creating a perfect point of adoption whether you need an off-premise solution for development
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade.
- Peer 1's Mission Critical Cloud: Your Cloud, Your Way Peer 1 Hosting's Mission Critical Cloud offers the ultimate in flexible customization of infrastructure, resources and support. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!