Hackers access personal info of 45,000 University of Colorado students
Attackers exploited a Symantec Norton AntiVirus vulnerability to launch a worm into the server of the College of Arts and Sciences’ Academic Advising Center, the university said in a statement. The suspects made off with the names and Social Security numbers of 44,998 students enrolled at the college since 2002. The university discovered the attack on 12 May.
"The server’s security settings were not properly configured and its sensitive data had not been fully protected," Bobby Schnabel, the school’s vice provost for technology, said in the statement.
"Through a combination of human and technical errors, these personal data were exposed, although we have no evidence that they were extracted."
Schnabel told SCMagazine.com that he blamed the event on the fact that the compromised server was overseen by a smaller IT staff "with more general sets of responsibilities" than the university's central IT department.
"Sometimes you don’t get the attention to security you get in a big, central organisation," he said.
IT officials believe the attackers were not trying to purge sensitive information, but instead gain control of the machine for use as a botnet. Had the firewall been enabled, the worm would have been stopped, Schnabel told SC.
Chandler Hall, vice president of marketing and a co-founder of network security firm Arxceo, told SCMagazine.com that the college should have had a network-layered defense to stop both signature-based and zero-day attacks.
"I think bottom line — there’s always going to be a human factor," he said. "I would never point a finger at a large LAN environment and say that it was poor practice."
As a result of the incident, the college is ordering the IT operations at the Arts and Sciences Advising Center to come under the control of the central IT department at the university, Schnabel said.
In addition, the college has instituted a plan to stop using Social Security numbers as identifiers, according to the statement.
Technology-wise, the university plans to implement new host-based intrusion detection HIDS software, which monitors systems for suspicious activity. Last fall, the school deployed a "restrictive network firewall" that has helped cut down on vulnerabilities.
The university also conducts a security awareness program, in addition to conducting regular risk assessments.