 |
|
Cautionary Tales
Has your district endured a security crisis?
Below: lessons from the present and not-so-distant past. We'll add new stories from time to time, to illustrate challenges created by new technology, old policy, young envelope-pushers, mutating malware. |
Dec 2004 Virus shuts down school, impacts entire state K-12 system
Dec 2004 Phishing for identity theft a growing problem
Sep 2004 College apologizes for identity theft threat
Jul 2004 Students steal credit card info
May 2004 Hack into school system to change grades
Mar 2004 13 year old deletes files; none of his actions was unauthorized
Jan 2004 KeyKatcher snares teacher's password and test answers
Sep 2003 Teenager creates Blaster B
Jun 2003 Wireless access point exposes school's vulnerability to journalist
Jun 2003 7th Grader forces report card delay
Jun 2004 Student steals Social Security numbers, District informs parents
Jun 2004 Student steals Social Security numbers
Aug 2001 Website defaced
Sep 1998 Student breaks into Navy computers
|
|
|
| Virus Shuts Down School, Impacts Entire State K-12 System |
|
December 2004 [ Louisville, KY] – The w32gabot worm infected tens of thousands of school computers across Kentucky. At duPont Manual High School it infected systems dealing with nearly everything from attendance records to checking out library books. Lessons were disrupted, Principal Dr. Beverly Keepers said. “Many of our teachers will post assignments on the Web and students will download that and complete it at home.” Students said that there weren’t always enough books available to replace the lost electronic material. Last year, Jefferson County public schools were hit by the doom virus and it cost nearly $100,000 to recover.
|
| Phishing For Identity Theft A Growing Problem |
Source: December 6 2004. www.messagelabs.com/intelligence/2004report
The number of “phishing” incidents – the process of tricking users to send information that allows criminals to gain access to their financial assets – has exploded in 2004, according to MessageLabs' Intelligence End of Year Report. In the year from September 2003 to September 2004, the number of phishing emails intercepted by MessageLabs grew from a mere 279 to more than two million. During the course of 2004, MessageLabs intercepted more than 18 million phishing emails.
Ominously, recent phishing emails have been designed to capture online banking details automatically when a user opens an email message, rather than when the user clicks on URL links within messages. Phishers have also attempted to dupe unsuspecting users into becoming middlemen for money laundering operations. MessageLabs also witnessed tailored malicious activity ranging from blackmailing online gaming sites with Denial of Service (DoS) attacks to threatening to send out child pornography in the name of a particular organization. Recent evidence also suggests that Trojans and other malicious code have been developed during 2004 specifically to compromise particular organizations.
Similarly, the percentage of email identified as spam rose from 40% in 2003 to over 70% in 2004. And the ratio of virus-infected messages to all emails rose from 1 in 33 for 2003 to 1 in 16.
For more details: www.messagelabs.com/intelligence/2004report
|
| College issues public apology, urges staff and students to check credit reports |
Baselinemag.com http://www.baselinemag.com/print_article2/0,2533,a=134517,00.asp
September 1, 2004
September 2004 [Hanover, NH] – Just as the fall semester began, the Dartmouth College CIO sent a letter to the entire college community announcing that someone had gained unauthorized access to servers containing sensitive personal information as well as HR data on employees, research and student health information. Recipients were urged to monitor their credit reports since the full extent of the potential identify theft was not known.
|
| Stolen Credit Cards |
July 2004 [ Madison, WI] – Two teenagers were arrested using stolen credit cards as part of an international scheme to order merchandise for themselves and others.
|
| Hacking Into School Computers to Change Grades |
May 2004 [ Newport Beach, CA] – A second student was suspended for breaking into school computers to change the grades of classmates who paid hundreds of dollars for the service. Juvenile Court officials and prosecutors will wait until police finish their investigation before deciding if charges will be filed.
|
| 13 year old deletes files; none of his actions were unauthorized |
March 2004 [ Noth Ridgefield, OH] – A 13 year old deleted numerous files from a district’s electronic reading program. He was suspended and the case was referred to the police. Although he was accused of hacking, several people pointed out that the program was poorly designed and allowed the deletions to take place without any unauthorized intrusions. They also pointed out that the district was negligent for not having backup copies of the files on a separate server.
|
| Stolen Password Used To Change Grades |
April 2004 [Broward County, FL] – Two students were suspended after admitting to using a password stolen from a teacher’s computer to break into the school server and run a small business charging $5 to change students’ grades.
|
| KeyKatcher Used On School Machines |
January 2004 [Saratoga, CA] – A group of high school students installed “keykatcher” devices on several school computers and captured teacher passwords which they used to access school systems to steal tests and answers. The device costs less than $100 and is about the size of a AA battery. It is installed between the keyboard and the computer. It went unnoticed in teachers' classrooms. “We've only found one KeyKatcher on campus,'' Principal Kevin Skelly said. “But we know there's more out there.” The keykatcher exploit was accidentally discovered in the process of investigating two other incidents: a math student who broke into a school computer and tried to change a grade, and two students who stole a printed test and saved electronic copies.
|
| Teenager Created Blaster-B Virus |
September 2003 [ Minnesota] – The capture of the teenage creator of the Blaster-B virus was mostly the result of his own stupidity. The code included his own name and contact information. Most virus creators, however, are not this dumb and are almost impossible to track down.
|
| Wireless Access Point Exposes School ’s Vulnerability To Journalist |
June 2003 [Palo Alto, CA] – A reporter from the Palo Alto Weekly succeeded last week in entering the school district's network using an insecure wireless access point, obtaining some students' grades, home phone numbers, addresses, medical information, psychological evaluations and even full-color photos of the children from an unsecured portion of the district's computer servers.
|
Seventh grader forces report card delay
|
June 2003 [Newark, CA] – A seventh grader learned a teacher’s password and used it to delete grade files for eight to ten teachers electronic folders, forcing at least some of the teachers to reconstruct the data from their notes and delaying the issuance of progress reports for two days. This incident followed another in the Fremont School District in which six students used a software program to break into the computer network and change their grades.
|
| High school junior gets SSI numbers, district warns families |
May 2003 [ Chico, CA] – High School Junior hacks into district network to change grades and access students’ Social Security and other confidential information. Using a school machine, he copied the data to a disk and took it with him. District leaders sent letters to all families suggesting they contact the nation’s major credit bureaus and place a fraud alert on their child’s file.
|
| Student Steals Credit Card Numbers |
August 2001 [Oregon] – A 20 year old pleaded guilty to federal charges of hacking into computers at Oregon State University and using stolen credit card numbers in an attempt to wire transfer money through the Western Union Corporation. The hacker also faced charges of breaking into an Internet service provider and stealing copies of company databases containing account information and passwords.
|
| School Web Defaced |
August 2001 [Westchester, NY] – An unknown attacker gained full rights to the Lower Hudson Regional Information Center’s web server and deposited graffiti on various pages, then deleted the log files to avoid detection. Further checking on the firewall revealed that the person had dialed in from a home telephone line to an ISP. To secure the person’s name from the ISP a subpoena was required, which necessitated calling in the police and making the situation public
|
| Student Uses Class Computer to Hack Navy Servers |
September 1998 [Georgia] – The U.S. Navy demanded that Georgia Southern University find out who used one of its lab computers to access electronic files from a government agency. A class was in session at the time the attack occurred.
|
| Back to top |
