6 ms·
Hackers steal Western Michigan University professor's paycheck
- chrisBob 13y agoThe same thing happened recently at BU, but our school is covering all losses even though I think the users are at fault in our case: At BU it was people that responded to a fishing email that had their account info changed. http://www.bu.edu/today/2014/fighting-phishing-bu-moratorium-on-changes-to-direct-deposits/ http://www.bu.edu/today/2014/fighting-phishing-bu-moratorium...
- jacalata 13y agoThat was my first guess for this story too - six people is a very small number if someone found a system exploit. Although it is still possible that's the case, and only specific passwords/accounts/etc were vulnerable.
- thenerdfiles 13y agoYay. That's the kind of world I've always wanted to live in. Gooooo, Justice! — Really, get the fuck out!
- keithpeter 13y agoUK resident: My wages are paid into my bank account using an electronic payments system that does not use the Internet at all. The accounts/HR people have computers that are on a separate VPN from the rest of us. The attack mode in this case revolved around the use of a client system to tell HR/Payroll where to pay the money. We don't do that, any change in bank account details is a visit to an office with paperwork.
- 1qaz2wsx3edc 13y agoIf you read the article, it specifically says in the fourth paragraph: "However, he said he believes the university should reimburse him for his loss, since it was its system that was hacked.". It wasn't his banking account being phished, you should read the linked articles before commenting on things.
- keithpeter 13y agoEdit: yes, I made it to the last paragraph and realised that you actually allow people to change account details from a client computer. I shall read every word in future.
- csmithuk 13y agoI've lost a payment in a similar fashion before. The accounts team took the written paperwork and misinterpreted a 6 for a 0 (I didn't write the form) and it just happened to be a valid destination account number. It took me 2 weeks to get the payment back. Doesn't always come down to technology. In fact, when it comes to technology it's usually pretty good. Humans on the other hand always err on the side of incompetence as there's usually someone else to blame... If you do not believe this about humans, work in or for the public sector in the UK for a bit!
- keithpeter 13y agoI do work in UK public sector. I have been fortunate in the payroll/HR departments, obviously. Chunk of cash suddenly appearing in my bank account would have me asking questions by the way. I imagine bank security in the case of the unwitting recipient of your wages were reassured by the payment coming from a BACS or similar system. When I paid my redundancy cheque into my bank account over the counter, a bank manager appeared in seconds and wanted to know why this very large amount was being paid in...
- arethuza 13y agoWhen I worked for a university in the UK as salaried Research Associate they "forgot" to pay me one month - didn't even apologize. They gave me a cheque that I cashed in the universities own branch and cycled to my own branch to deposit the money before my mortgage payment came out.
- z02d 13y agoOff topic: A professor just earns $1,581 per month?
- bennyg 13y agoDepends on professor status. Adjunct professors, maybe. If it's not really full-time and they aren't researching anything, then why should they get paid a ton?
- deleted 13y ago[deleted]
- maxerickson 13y agoHe's an assistant professor. The article also says he is 66, so there is a fair chance it is a part time job.
- mhb 13y agoGym teacher: http://homepages.wmich.edu/~cool/ http://homepages.wmich.edu/~cool/
- nmridul 13y ago>> A hacker had gotten into Cool's WMU account and changed the routing number for his payments, he said, sending $1,518.62 to a bank in Utah..... There was $11.08 left in the Utah account, which is all Cool has gotten back of his paycheck. Just curious. A professor is paid only $1,529.70 ? Hope it is weekly.
- mhb 13y agoGym teacher? http://homepages.wmich.edu/~cool/ http://homepages.wmich.edu/~cool/
- maxerickson 13y agoHe's a gym teacher teacher.
- up_and_up 13y agoGym teacher with a Ed.D. in Pedagogy and Motor Learning. So no not just a gym teacher.
- HarryHirsch 13y agoActually, this fellow is paid $70K/year (he's at a public university where salaries are public). He got into the system before the big shift to lecturers and adjuncts, and since he has been in the system for a long time there is a long history of salary increases, back when times were good, and never a decrease - the phenomenon of sticky wages in action. Whether his compensation is fair is a different question. His homepage lists what courses he is teaching but not the number of actual sections. A lecturer can teach three sections of a full-time four-credit course. With preparation, grading and contact hours this constitutes a 40-hour workweek.
- hatbert 13y agoI realize that central Michigan has a fairly low cost of living, but that seems surprisingly low for a tenured professor.
- moocowduckquack 13y agoHas he argued with any Comp Sci students? (edited to avoid implying fault on his part)
- HarryHirsch 13y agoThis is not funny. Unpaid wages are never funny. Actually, the Catholic Church classes it as a "sin that cries to heaven", and groups it with murder, inhospitality and exploitation of those with no clout. What they all have in common is a disregard for the humanity of your fellow man, and you can't punish that enough.
- moocowduckquack 13y agoI'm not trying to be funny. People already known to the victim is the sane place to start any investigation. edit - my edit earlier was going from 'pissed off' to 'argued with' as I realised that 'pissed off' can often imply intent to piss off.
- Blahah 13y agoUniversity has a crappy insecure system for paying staff, they get hacked, so the staff stuffer? Just pay the man!
- thezach 13y agoMy father and mother work at this University. The same login gets you into email, that gets you into payroll and all other employee areas of the employee website. So if the attacker was able to get the login and password through whatever means it would make any sort of email confirmation useless. As far as the WMU police investigating this I think its a bit of a conflict of interest as their system was hacked and they will likely blame the 2 employees who lost their paychecks as its in the universities intrest no to send out more money.
- yetanotherphd 13y agoI don't think there is any conflict of interest. The police are only concerned with the criminals who stole the password. Whether the university owes the employees their pay because of the lax security they implemented, is almost certainly a civil matter.
- HarryHirsch 13y agoAt my university the Health and Safety people do nothing worse than hand out warnings, even if they come across serious safety issues in laboratories. It's almost as if they were at risk of losing their jobs if they imposed fines or shut down a lab altogether. Let the fun and games continue until someone burns! If you believe that the police and the internal IT investigation aren't under pressure to find for the university I've got an Eiffel Tower to sell to you.
- smtddr 13y ago>>"Unfortunately, it's pervasive," Porter said of such theft by computer. If the criminals are willing to dedicate "time, brains and fortitude, it's hard to stop it all." This article reads like it'll be difficult to catch the person who stole the money. I remember all the arguments about bitcoin being more (pseudo)anonymous than a Bank, but if authorities can't even get the person who got this Bank ACH Deposit then I must have a horrible understanding of the Banking process. What's the problem? I thought bank-fraud was the easiest crime to catch assuming the culprit isn't someone with connections in high-places.
- Blahah 13y agoOr a fake ID... opening an untraceable bank account is one of the major use cases for identity theft. It's very likely that the money was moved into a bank account opening with a stolen or false identity, and the person will not be caught.
- smtddr 13y agomindblown.gif ...I had no idea a regular person could open & collect funds from a bank account that was fraudulently opened and actually get away with it.
- dclowd9901 13y agoSince the banks enable this kind of crime, I kind of think they should be held liable.
- fnordfnordfnord 13y agoEmployee handbook probably has a clause in "IT Policy" that says 'Employee is responsible for maintaining the security of his/her password' or some similar such nonsense that the Uni will try to hide behind. Typically the only way for employees to opt out of this (when this option is available at all) is to elect to receive a paper check. My employer's system (which comes from a big name edu-prise sw vendor) takes a 6 digit password and my system username is public information (it is not advertised, as a username, but it is visible on public facing documents). Access to this system would allow a person to change my payroll & benefits info, mailing address, and other contact info, change student grades (for the current semester), access confidential student information, and in some cases, add/drop currently enrolled students from courses. The system default password and reset default are also public information. This is a disaster waiting to happen.
- ams6110 13y agoMany universities no longer offer paper checks as an option, sometimes with exceptions for the first paycheck, and the final one. You must set up direct deposit with a bank or credit union.
- fnordfnordfnord 13y agoI know, and a paper check might not protect you in any case if the attacker is able to change that option through the online system.
- jlgaddis 13y ago> My employer's system (which comes from a big name edu-prise sw vendor) takes a 6 digit password and my system username is public information ... Ahhh, Sungard.
- fnordfnordfnord 13y agoYup.
- patcheudor 13y agoThis is an interesting case. If an employee is liable for the loss as a consequence of a data breach in a university system then does that mean it's acceptable for an employee to do their own penetration testing of university systems handling their money? This would help them better understand the weaknesses to protect themselves and push the university to fix their systems. Yes, this professor could have been phished and given up their credentials to a bad guy, but that shouldn't entirely offload the liability onto the employee as the university should have had strong measures in place for validating changes to routing numbers.
- thezach 13y agoThe password system also has no login attempt counter... so basically you could bruteforce all you want according to my brother whos a student there.
- frodopwns 13y agoThis same thing happened at CU Boulder. The phishing attempts take the form of an email from IT stating that the user has exceeded their max email capacity. The letter then tells the user to forward their credentials to the mailer. It is sad that people can't learn to keep their passwords to themselves.
- judk 13y agoObligatory Mitchell and Webb: identity theft: http://m.youtube.com/watch?v=CS9ptA3Ya9E http://m.youtube.com/watch?v=CS9ptA3Ya9E