23 ms·
Security Breach at US Universities
- sneak 6y agoOne more reason to decline to provide SSN or non-disposable mailing address, email address, and phone numbers to institutions or vendors. Hopefully people stop finding it weird when customers don't want their PII in the vendor's database.
- walrus01 6y agoWhile I don't disagree with you on how bad things are now, good luck with the idea of not giving your SSN to your employer or university. At a certain point people will ask if your intention is to move to a wood shack in Montana and write a manifesto.
- nightowl_games 6y agoCome a few hundred clicks north to Saskatchewan where wood shacks and manifestos are something of a local past-time.
- NetOpWibby 6y agoIf they have high-speed fiber, it’s a date!
- renewiltord 6y agoSorry to disappoint.
- Sander_Marechal 6y agoThat's why StarLink is a thing!
- nightowl_games 6y agoI have high speed fiber to the home. SaskTel Infinet is great. It's a socialist organization too! Check it out! Saskatchewan has a lot of socialism in its history, mostly because of the intense agriculture history where farmers would pool all their grain together to negotiate better prices.
- swiley 6y agoIt's honestly pretty tempting but the border is closed.
- mulmen 6y agoGiving my SSN to my employer seems reasonable because that’s how I pay in to social security. SSNs are fine as IDs (with time bound assumptions), the problem is using them for authentication.
- d4mi3n 6y agoThey are in fact not great IDs and the Social Security Administration asked very nicely for the rest of the country to not use them as a form of identification: https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus A few reasons why SSNs are bad as IDs: 1. There are a number of situations where people will not have a SSN. 2. SSNs are "secrets" that need to be broadly shared to participate in many parts of business and government in the US. 3. SSNs lack many security and authentication mechanisms most forms of ID have (e.g. photo ID) There are folks in the US who rally against the idea of a national ID, but I've always thought it was a silly argument considering how pervasive and problematic SSNs are as a form of identification.
- hedora 6y ago4. SSN’s are not unique, nor were they designed to be, but people think they are.
- mulmen 6y agoIf a living person has a SSN they can be identified by it [1]. That does not imply any individual can be identified by a SSN or that any SSN identifies an individual. The suitability of an SSN is situational for ID purposes. The video conflates identification and authentication to its detriment. Social Security Numbers are very good identifiers, that’s literally their purpose. Social Security Cards are poor authentication tokens because they contain no validation to prove the card holder is the person associated with the number. Or said another way, you cannot prove your identity (authenticate) with a social security card. I don’t see what built in validation of the number has to do with the security of the identifier. So again, the problem is using a Social Security Number or card for authentication. It’s fine as an identifier. [1]: Social Security Numbers can be reissued but this should only happen when the number is no longer in use.
- sneak 6y agoSet up a corporation, employ yourself, and send invoices from the corporation to the people who wish you to perform services for them. I've been doing this for over a dozen years. My customers don't need to have a single piece of my PII. To be honest, the thought of sending even a single piece of my PII to a customer or vendor gives me the heebie-jeebies, given what we know about data breaches. I don't even let my personal services people handle my data in Google Apps until and unless I've shipped them a chromebook and walked them through setting up hardware 2FA and enabling Advanced Protection. I'm waiting for a national bank chain or AmEx to get popped; thanks to the legally mandated total lack of financial privacy in the United States there's no way to insulate oneself from those vendors.
- nfin 6y agoyes. Hopefully that day comes where people understanding that keeping your PII private is for good reasons, and not for hiding anything bad... It is a pitty, that many (most) governments make the life hard (through laws/regulations/...) for companies wanting to offer services like aliases for phone numbers. Wouldn't it be great if I could give an alias phone number, and if I want I can redirect that number into the void [1] [1] or instead of redirect into the void possibly other good or less good ideas like "pay $1 to call me"... which would help some cases where I would have liked to delete an alias, but not sure if I didn't give it to someone that I want to keep in contact with
- Daho0n 6y agoThis is putting a bandaid on a rotten leg. What is needed is a way to stop businesses from calling you if you haven't given them permission. It is a huge problem in the US but it isn't like this everywhere. The underlying problems should be fixed instead: Laws that actually prevent this (enforced laws) and the opportunity to block non-local calls from places not as functional (like calls from the US). I have had the same mobile phone number for decades and I get maybe one call a year from a business that I haven't specifically allowed or requested calling me and it is always international because local laws actually work.
- nfin 6y agoYes, it is a band aid, or one solution out of many needed ones, and yes, probably not highest priority in terms of needs. But it doesn't have to be a either...or... And I wouldn't derive from your lack of need from a lack of need for others!! Independently from the country. Stealing is allowed in no country, and it still happens in every country. Laws and enforcement is great, but it won't stop 100% cases, and if I like to have a door lock on my door (or two), then let me do... I don't care if some don't feel a need for it (and stealing is just an example... the same for so many illegal things).
- closeparen 6y agoThe only one of those things that has any claim to being a secret is SSN. And that ship has sailed - at this point it would be a public service to publish all SSNs so we’re all forced to stop treating it like knowing an SSN means something. The rest belong in public directories, where they have been for decades.
- cm2187 6y agoIf you are a prospective student, are you going to risk your future by using your college application to make a point about privacy?
- sneak 6y agoThere's a strong argument to be made that one risks their future in general by taking on the substantial debt usually involved in attending a US university. There are worse things one can do with regards to their future than keeping their private data private.
- system2 6y agoLet's see how much this will be covered in tomorrow's news.
- wyxuan 6y agoyup, I was affected as I got this email yesterday: > Good day! > If you received this letter, you are a customer, student, partner or employee of University of California. The company has been hacked, data has been stolen and will soon be released as the company refuses to protect its peoples' data. > We inform you that information about you will be published on the darknet ( [link redacted] ) if the university does not contact us. > Call or write to this store and ask to protect your privacy!!!! I'm leafing through the linked site and I can see SSNs, tax forms, enrollment forms - yikes!
- sdan 6y agoI got that email and immediately went to onion [dot] dog just to check out the site... was pretty clear it was some weird onion gateway so I decided not to go to the link.
- gambiting 6y agoI mean, you could probably go to the onion link directly with a Tor browser.....but that's probably a bad idea too. I'd open it in a VMed machine maybe.
- hiq 6y ago> I'm leafing through the linked site and I can see SSNs, tax forms, enrollment forms - yikes! Haven't you just admitted that you downloaded the files and browsed them? Isn't that illegal in the US?
- deleted 6y ago[deleted]
- caterama 6y agoEveryone, let's have this "secure" service where we put _ALL_ of our sensitive data!! Including export controlled materials? To be honest, it seems like PII including SSN leak regularly. Whatever... freeze your credit and get monitoring. On the other hand, export controlled ITAR/EAR... now that's bad!
- pmiller2 6y agoThat just sounds like a single point of failure to me. That is, if this is a serious proposal. Sarcasm does not come through on the internets very well. :P
- JellyBeanThief 6y agoIt is sarcasm. The tell is the quoted word "secure", and the hyper-emphasized word _ALL_.
- iso1631 6y agoWhy is SSN considered secure information? It's the equivalent of a username (or indeed just a name), or a phone number.
- Daho0n 6y agoIn a perfect world. In this world it is often username and password in one. Know the SSN and you are the SSN owner.
- iso1631 6y agoWhich is the fault of the person treating it as a password. If I said "can I have a loan, my name is John Smith from 123 Main Street" And the bank gave me money and stuck it on John Smith's account, people (John Smith) wouldn't stand for it. In an ideal world SSNs would be published in a global lookup list, getting rid of the entire idea in the average person's head that SSNs are secret information when they aren't.
- Fiveplus 6y agoPerson in the comment section, I'd take that tor link of the published data down.
- kiallmacinnes 6y agoHonestly, I don't think it matters - the data is out, there's no putting it back in the box.
- sodality2 6y agoIt was emailed to thousands of UC students and workers. not private anymore
- throwawaysea 6y agoHow many times has the UC system been breached now? There were three breaches in 2014-15: https://www.networkworld.com/article/3039116/uc-berkeley-makes-third-data-breach-disclosure-in-past-15-months.html https://www.networkworld.com/article/3039116/uc-berkeley-mak... There was a massive one back in 2009: https://www.networkworld.com/article/2254411/160-000-student--alumni-accounts-breached-at-uc-berkeley.html https://www.networkworld.com/article/2254411/160-000-student... There was a 2006 breach involving the DoE labs managed by UC: https://www.networkworld.com/article/2292688/university-hit-with-proposed--3m-fine-for-breach.html https://www.networkworld.com/article/2292688/university-hit-... And that’s just what I dug up on UC Berkeley in a few minutes. At what point do we start saying “no” to anyone requesting personal information? If a university known for its computer science programs can’t keep this info secure, how can we trust our doctors, insurance companies, landlords, and so on to get security right?
- babesh 6y agoIT departments at universities are generally not bastions of competence. This was exacerbated by private sector compensation greatly exceeding compensation at universities the last twenty years. You really do not want to know what passes for IT at universities even as renowned as Stanford or Berkeley.
- secabeen 6y agoThis wasn't a breach of UC, it was a vendor that UC used. Somewhat different.
- gnulinux 6y agoBecause EECS staff (grad students, professors) don't maintain the IT infrastructure of UC Berkeley?
- angry_octet 6y agoThis is the Accellion breach, not a problem with their internal systems. This box is used for 'secure' large data transfer. Like a Dropbox appliance basically. Except Accellion write rubbish software and the devices were ruthlessly shelled. Insert :Cheeto lock: meme. Arguably, the hundreds of Accellion clients should have separately encrypted their data and used some sort of PKI to exchange public keys. But try getting users to do that properly. Unfortunately, since Broadcom bought Symantec there hasn't been any good PGP solution for corporate file exchange.
- eric4smith 6y agoAbout 20 years ago my Sun Solaris servers got hacked. I learned a valuable lesson, no matter how “secure” you think your servers are, at some point all the data on them will be compromised. So... * Backup - often in many places * secure it as much as you can * Encrypt we much as you can * Airgap sensitive stuff And even with all of that you will still be compromised. Eventually. Protect your data so you can spin up on a new server if you need to. Sigh.
- fmajid 6y agoMost importantly, do NOT collect data you do not need to. I don’t see why universities need their students’ SSNs, apart from reporting salaries paid to grad students-as-employees.
- Arwill 6y agoThis is how the GDPR makes a lot of sense.
- vineyardmike 6y agoAs far as I was aware, many private US universities explicitly didn’t collect this data in an effort to maintain deniability when dealing with immigrants (especially “illegal immigrants”). Of course, many many students in undergraduate life are also employees of the school part time, so presumably they need to provide this information.
- 6y ago
- deleted 6y ago[deleted]
- hedora 6y agoThe breach was apparently in some secure file transfer complianceware. Maybe complianceware should be banned.
- KMag 6y agoFailing that, complianceware should be restricted to running its non-Turing-complete rules locally rather than routing everything sensitive through one sweet sweet target host.
- lvs 6y agoAuthoritarian IT is always insisting everyone use cloud services -- but exactly the same cloud service for everyone. This seems designed to fail.
- fps_doug 6y agoGreat. Just great. This is days after I learned about the new Germany-wide deal with Microsoft for licensing their software and services, so it perfectly fuels my fears. Before, it was mostly just a volume license for Windows and Office, but now it's the full arsenal, M365, Teams, and, announced very proudly by our University, we'll be moving our Active Directory to the hybrid cloud. Every Student and Staff will automatically have their personal data deployed to the Azure cloud. Isn't that great? Finally Germany is working on tech incompet^Windependence! What could go wrong? I mean, they assured they'd form a working group with other Universities about remaining concerns regarding privacy issues in Windows 10 and planning to confront Microsoft about them. I guess Microsoft is shivering with fears and busy removing all telemetry right now. Other great changes form this new deal are that Universities now have to pay a full Windows license for every employee, no matter how many hours they work; before you'd pay by how many full-time jobs all the employees would make up for. That means most Universities pay twice as much now. And did you know the new deal explicitly forbids remote access to any Windows machine under this license? You have to pay extra for that. What a strange coincidence regarding the current epidemic. Universities' legal departments are clueless whether this only applies to RDP, or alternative 3rd party tools as well (or rather whether this would hold up in court). This is the first time the deal is made nation-wide, you'd think this puts our Universities in a better position, but we got fucked in every way possible. I realize this is only marginally related with the original post, but 1) sorry, I just had to vent somewhere, this seemed just like the final straw, and 2) am I the weird one for seeing a problem in this trend? Universities were once driving innovation in technology, students were fiddling with emerging and expensive tech, but today we already have some Universities that don't even have their own datacenter anymore, everything is hosted elsewhere and maintained by contractors. Students access SaaS via a Browser. Walled gardens everywhere. This doesn't help.
- grezql 6y agoSince its apt: www.ransomwatch.org
- xyst 6y agoIs this a relatively new requirement for universities to require a SSN for prospective students? I don’t recall having to provide this information about 1 decade ago or even 5 years ago.
- swiley 6y agoYou probably have to prove that you're a citizen or have the appropriate immigration status, this usually involves your SSN. Why is it done this way? Politics I guess.
- curiousgal 6y agoFun fact that companies online don't seem to realize, non-citizens can have SSN numbers, even people on a short exchange visitor visa.
- alistairSH 6y agoLegally, it's not required to apply. But, it is required to access federal FA. And some schools collect it regardless of legal requirement because it makes their life easier (avoiding dupe person records, student workers, etc).
- rossdavidh 6y agoSo, I worked at a major American university that (years back) had to remove SSN from all of their databases; it was a major project. The exceptions were related to cases where they get something monetary (e.g. cash scholarship, student jobs, etc.) that requires reporting that income to the federal government, which wants the SSN. Generally, it is actually LESS common to require SSN now than 20 years ago; when I was an undergrad, exam grades would get posted by SSN on a public bulletin board (the idea being you could find your own, but you wouldn't know anyone else's SSN to look up their grade). So SSN was considered less sensitive than your grade on a single ordinary exam.
- tingletech 6y agothey told us it these were a phishing attempt
- williesleg 6y agoOh it's been going on for decades with all the communists and socialists. They've fully infected the education system as they've wanted to starting back in the 1950's. Bravo snowflakes!
- john37386 6y agoAt first, I thought accellion is a software for managing students programs, schedules, courses, etc. I decided to check their website and was stunned to learned that it's: an Enterprise Content Firewall that prevent breaches and compliance violations from risky 3rd party communications. I guess they will need to review some of their core business model because they failed to fulfill their promises to their clients and customers.
- cblconfederate 6y agoEvery hack is a win for people who preach decentralization of data
- angry_octet 6y ago> Unless the universities pay the ransom, the hackers will continue publishing student information. That is an incredibly irresponsible thing to say. The data is out now, you'll be able to buy it from a broker soon enough. Any money paid is money lost. I think paying would also contravene US law. What these victims do need is new SSNs, and the Gov't needs to find a way to identify people without the ID also being the password.
- zippy5 6y agoSSN were never really secret. For the most part the first 5 digits are a derivative of when and where you were born (public record) and you’ve given out the last 4 to every financial institution and employer. You last part is spot on. Basically people should setup a password at the DMV or something.
- EvanAnderson 6y agoThe United States Postal Service would be a great "trust provider" (managed PKI, signing personal certificates for individuals and busnesses, etc). They already do it inasmuch as many government agencies (the BMV in my state, for example) accept addressed official correspondence as proof of residency.
- Aloisius 6y ago> the first 5 digits are a derivative SSN assigned after 2011 are randomly assigned. The first digits no longer have any special meaning.
- sobriquet9 6y agoSSNs are not reused. About 450 million have already been issued. If people in a breach are issued new SSNs, we'll run out of numbers rather quickly.
- codezero 6y agoI can just imagine the panic of having to increase the field size by a single digit, it'd be a billion dollar, decade long problem that never gets fixed.
- watertom 6y agoEveryone keeps jumping on Microsoft, but Microsoft is not the problem. The problem are the Universities, specifically management and the Board of Directors. They see IT as a complete waste of time, they won't fund it properly, they refuse to pay market rates. Coupled with the fact that the staff behaves like children, pushing back on EVERYTHING that the security teams want to implement. The staff doesn't understand why people need passwords, I'm not kidding, they want just open access to everything from anywhere without any controls, and they throw temper tantrums when any controls are put in place. Frankly if it wasn't for the safety and security of the University these people would not be able to function in the real world, and I can't image what it must be like for students dealing with these egotistical, bombastic children.
- rufius 6y agoI worked in University IT. In fact, for one of the schools listed though it’s been 10+ years. Basically everything the above poster said. It was pulling teeth to update or upgrade anything.
- arbitrage 6y agoit's like pulling teeth because you try to get everyone to agree on every decision. sometimes you just have to tell your academic user base that this is the way it is. it doesn't have to be that way. IT people are pretty shit in general at soft skills. sometimes, you need to stand up for yourself in a conflict. your userbases digs in their heels because you let them.
- colejohnson66 6y ago> sometimes, you need to stand up for yourself in a conflict. Then you just get fired. They’ll just replace you with someone else who’ll listen. Some people just don’t learn no matter how hard you try.
- sidr 6y agoOr the users escalate to a high enough level, who inevitably has a university admin background and has no regard for IT or security - the decision inevitably ends up being on the side of the userbase. This is the problem with being considered a cost center, rather than a value producer within any organization.
- korginator 6y agoAccellion's FTA goes EOL this month. They've been pushing customers to upgrade to their new Kiteworks product, but it does not excuse them from having to deal with the disaster with their FTA product which is still technically and contractually supported by the company. Though the vuln was reported in mid-Dec 2020 and the company released a patch a week later, is a PR disaster for them.
- alexjplant 6y agoUniversity of Maryland had a data breach a few years back [1] so I suppose that it's unsurprising to see that it happened again. At least they had the common sense to stop asking me (somebody affected by said breach and a dropout, no less) for alumni donations. [1] https://www.cnet.com/news/data-breach-at-university-of-maryland-exposes-300k-records/ https://www.cnet.com/news/data-breach-at-university-of-maryl...
- doggodaddo78 6y agoI worked at one of these universities. They "lost" / had stolen a laptop containing everyone's SSN. They're idiots.
- leephillips 6y agoThe damage from incidents such as this would be at least somewhat limited if organizations did not collect SS numbers when they have no legal purpose for doing so, and if people did not automatically comply when asked to supply these numbers. Whenever I go to the doctor and am asked to fill out the usual form while waiting the usual 90 minutes past my scheduled appointment time, I leave the ubiquitous space for my SS number blank. They are not paying me a salary, so have no legitimate need for this number. I know why they want it, and that purpose does not benefit me. Not once has this led to a problem: they know that there is no legal basis for demanding the number, but ask for it anyway, as they have nothing to lose by doing so.
- splithalf 6y agoGive the wrong ssn on every form you possibly can. Many databases are filled with fake ssns, nobody cares or checks. A lot of Americans don’t even have one.
- dhosek 6y ago>A lot of Americans don’t even have one. Citation?
- colejohnson66 6y agoMostly immigrants who haven’t become citizens yet. But there are others.
- istjohn 6y agoConsider that the IRS provides an ITIN number for tax filing purposes to anyone who doesn't have a SSN. Millions of undocumented immigrants pay their taxes and operate in society without a SSN.
- bpodgursky 6y agoUndocumented immigrants definitionally are not Americans.
- flowerlad 6y agoSSN, DOB and other personal data of my child is part of this leak. But it was already leaked through a different hack at a health insurance provider in any case. It should be clear by now that as long as the data is stored somewhere it is at risk of being leaked. It doesn't matter how secure you think your tech stack is. Improving tech is not the solution. Here's the solution: 1. Don't collect information in the first place, unless absolutely needed. Some schools collect DOB, address and so on just to register for a webinar. 2. Don't permanently store information. If you collect SSN for employability verification then do the verification, store a flag, then delete the SSN. Similarly, after verifying DOB, store a flag then delete DOB. 3. Assume information is already public. This is the most important part. Despite all of the leaks happening, many financial and other sites will let you use your DOB, SSN etc. to prove that you are who you say you are. This is absurd. It appears American businesses prioritize convenience over security. Americans need to demand better.
- fluidcruft 6y agoI think the solution is to make SSN useless for anything. It's ridiculous what can be done with nothing more than what amounts to glorified directory information. Why are SSN targets? Because of what can be done with them. The world should expect SSN to be in the same class as a phone number. Private, but mostly useless. "Oh no... they hacked a database and got a list of phone numbers." Not something you hear very often nor does it really make people squirm. I think we need something like drivers licenses with public-key crypto. Lost your ID? Go to the police, prove your identity to them and get a new driver's license. If people are worried the masses are too dumb for PKI, then make it opt-in and leave it to advocacy groups to expand utilization.
- thephyber 6y agoYour first paragraph misses the diagnosis a little bit your prescription is correct. The problem isn’t specific to SSNs. Most authentication of users in the public sector in the USA is done by knowledge of facts, whereas it should require proof of government ID card (preferably with digital certificate, not just knowledge of the ID number)
- athenot 6y agoLots of great comments about not collecting/retaining sensitive data in the first place. Yes, we need to move away from SSN as a { unique-ID + secret } combo. But that's a non-trivial task. I'm starting to think we need something like PCI for SSN: want to use a SSN? Bam! You are now subject to intense audits that will evaluate all your data practices (and for which you will be billed). Orrrr… use a third-party vendor and never touch this data. That being said, it's still not a perfect option because Credit Card numbers can be rotated whereas SSN seems to be engraved in stone. Still following the Credit Card analogy, having multiple numbers would greatly help. Just the same as you don't go around (anymore) showing everybody your bank routing information and have multiple cards for various purposes, have multiple identity numbers: - tax ID number - driver's license number - passport number - medical record number (yes, MRNs are a thing, just prefix it with the org ID) - medicare number - actual social security number for only social security (and at this point, a new one + rebranding is in order) - credit-worthiness number - etc.
- lynndotpy 6y agoApparently Brown has also suffered a data breach + ransomware. I don't know if it's related or not, but I suspect this list is incomplete.