UT Austin Hit By Massive Security Breach

mrpuffypants writes "Reported in the Austin-American Statesman: The University of Texas' security was compromised over the weekend, leaking out nearly 60,000 records on students, staff, and faculty. Official word from the school can be found here. Most troubling of all is that, like most schools, UT still uses SSNs for student ID numbers, and that was part of the information taken from them in the attack."

Comments

Clarification?

[binaryDigit]

The UT link appears to be /.ed, but when I read it before it sounded like a simple brute force ssn lookup. The attacker simply generated random ssn and sent them against a page that returned information based on ssn. The attacker then simply harvested "positive" hits. The problem was that this interface was exposed to the public and that it had no means of throttling/preventing multiple requests/failed requests.

On another note, UT is phasing out SSN in many aspects of the students life. My wifes UT ID does not contain her ssn, it has a student # now. Though I assume that there are still many points of interface with the UT system that expects to see ssn.

Re:All they got...

[stoolpigeon]

They'll get the rest later using the SSN. That and a name are often all you need. Who cares about grades- when they know who you are and have your social you are screwed.

`Recapturing'?

[TKinias]

UT says:

UT, in conjunction with the U.S. Attorney's Office, the U.S. Secret Service, and other law enforcement agencies, has focused its efforts since Sunday evening on identifying the perpetrator(s) of the break-in and recapturing the stolen data.

Someone is more than a little bit confused about the nature of digital storage if they think they can `recapture the stolen data'.

`Ah, cool, we've managed to delete the copy they made of our data.'
(whispers)
`Another copy? How many copies did they steal?'

Re:What's the big panic about SSNs?

[joebp]

Should someone get a hold of your SSN they can get a credit card in your name, or whatever.

I think I see where the problem lies.

It's like security through the obscurity of these numbers.

Re:Slightly OT - choice of credentials

[Greyfox]

Because every company on the planet uses the number to identify you. When you apply for a loan, a driver's license, a credit card or insurance, the Social Security number is all they need. Given yours, I can request a car or home loan in your name, get a nice fat check and skip out of town or out of the country. And you might not ever know about it until the credit collectors catch up with you, you're denied credit or you don't get a job when they run a credit check on you. Assuming they even tell you your credit history is why they didn't hire to. Many employers ignore the laws stating that they have to tell you if that's why they don't hire you.

If someone is using a driver's license acquired in your name with your social security number, they could very well build up a criminal record in your name in some other state. A routine traffic stop could then lead to you getting arrested.

With that in mind, if someone asks you what yours is, the first thing that comes out of your mouth should not be that number. It should be "I don't think you need to know that information." Note that in the historical past (I don't know if this is still true) if you knew someone's name and birth date, you could use an Internet information service to find out their social security number and criminal history.

Re:What's the big panic about SSNs?

[wideBlueSkies]

1. Please mod the parent as insightful. (Or even funny). This is the best description of the problem I've ever heard.

2. It's an antiquated system. Back in the day, before massive amounts of information were available on computer, you'd occasionally hear about a guy who's number was stolen. It's a bad thing, but it was a rarity. The system worked because your number was secret, and there were few real ways to get it.

These days, SSN's are being compromised by thousands at a time. This is a broken system, and it should be fixed.

Perhaps thumbprints or retinal scans as a system of identification. But if you think about it, this leaves us with the same problem. The retinal or thumb image needs to be kept somewhere for the purposes of comparison. The files can be stolen just as easily as SSN's.

Maybe there is no solution.

crypto is a solution

[Anonymous Coward]

There's a solution if you use cryptography. Assign everybody a social security number. Also, give them a private key (or better, let them pick their own). Then, publish everyone's social security numbers and the public keys that match up with their private keys. (The government could even provide a service that allows people to look up public keys based on social security number.)

Then, everyone's number is out in the open. Whenever you want to do something with it, you create a message along the lines of this:

My name is John Doe, and my social security number is 987-65-4321. I hereby authorize CreditCards-R-Us to issue me a credit card linked with my social security number.

Then you sign that message with your private key. Once you've done that, anyone can use your public key to verify the signature. That means they can be assured that, unless someone has stolen your private key or broken the crypto, it could only have been you that wrote that message.

Thus, your social security number becomes public knowledge, but that doesn't help anybody because they'd need your private key to do anything with it. And, most importantly, there never is any situation where you have to give your private key to anyone. Your secret remains your own. No third-party ever gets a copy of it. This is important for two reasons:

1. Third-party institutions don't have much incentive to guard your secret well. Many of them will do their due diligence in guarding it, but the bottom line is that it's just not their ass on the line, so they won't try really hard. Even if they mean well, they're a busy corporation or university or whatever, and they have other things to get done.
2. If you are forced to give out your secret to get anything done (for example, register for classes), over time lots and lots of organizations will get (and store) a copy of it. This is bad, because the probability that information will get stolen is pretty close to proportional to the number of people who have a copy of it!

Part of the problem is ...

[Skapare]

Aside from the fact that the custodian of the information certainly has a lot to blame in this, there is another big part of the problem. That problem is what people can actually do with the information.

An SSN is identity. It is nothing more than that. The problem is people make the incorrect assumption that it is authenticity (I can recite the number, or read it off a little card in my wallet, so it must be me), and authority (this account has your SSN and is overdrawn, so you are liable for it).

If any law change is needed, it is a law change that says that it is illegal for an SSN to be accepted for any purpose other than identity. What that means is that if I walk into a bank and open an account citing some SSN, the bank needs to understand that all this does is identify someone, and not necessarily me. If the bank causes harm to the real owner of the SSN by having provided any derogatory credit information based on that SSN, then the bank shall be fully liable for having not taking reasonable measures to ensure accuracy of information. And by that, what I mean is that the bank can't simply say that the victim needs to track down the perpetrator to cover the costs. The banks need to be forced to properly authenticate the information they use, especially when and where it might be used in a negative way.

And I don't mean to pick on banks (I just happen to have an open case with Chase Manhattan bank which continues to allow someone to operate a credit card account with my SSN, reported on my credit reports, without my consent, and after I have advised them of the fraud). Such a law should apply to anyone and everyone who accepts and uses SSN data for anything. It's the negative things that can be done (like bad credit info) that needs to be stopped (in addition to other stupidities like running computers insecurely and connecting systems to the internet that have no business being there).

Salon gets it right

[CleverNickName]

In their newswire, Salon titled this story, "Computer crackers steal students social security numbers."

I thought the Slashdot community would appreciate Salon getting the terminology right on this one. It may seem like a silly point to some, but the distinction between "cracker" and "hacker" is huge in my mind, and it always makes me happy to see a journalistic outlet get it right, for a change.