Slashdot Mirror
UT Austin Hit By Massive Security Breach
mrpuffypants writes "Reported in the Austin-American Statesman: The University of Texas' security was compromised over the weekend, leaking out nearly 60,000 records on students, staff, and faculty. Official word from the school can be found here. Most troubling of all is that, like most schools, UT still uses SSNs for student ID numbers, and that was part of the information taken from them in the attack."
"Those SSNs that matched selected individuals in a UT database were captured, together with e-mail address, title, department name, department address, department phone number, and names/dates of employee training programs attended. It is important to note that no student grade or academic records, or personal health or insurance information was disclosed."
Phew, I feel so much better now!
I wish I had known about it, I would have asked them to change my transcripts to give me a better GPA. :P
::.. check out some Cell Phone Reviews
What legal action may the students and faculty take? In Washington it is illegal to use a students SSN to identify students. There was groaning at every campus in Washington for weeks. I bet there as glad as me that Washington was so on top of this.
OK, so I can see how a university might come to use SSNs as an identifier. They're unique and everyone already has one. Easy.
But why are SSNs so sensitive? It's like a credit card number -- it's printed some places, gets bandied about in others. Not exactly confidential, and no intuitive or documented boundaries on who should be trusted to with it. So it's a scary number that can be used for bad things, but you'll have to give it out in many circumstances where you aren't fully aware of how it'll be used. Makes it tricky to know who has it, or to make an informed decision about where you use it.
Again, it's easy to see how the practice of using it as a credential has continued (and got worse), but when did it start?
I've seen a whole bunch of 'stolen credit card #' type stories on Slashdot lately... the thing is, we never hear about any repercussions of these thefts. Do the thieves ever use the stolen records in large quantities? Follow-up is good :). Any info people have, post it here (I'm thinking of, in response to the Amazon CC# thefts from a few weeks ago, etc.)
Karma: pi (Mostly due to circular reasoning in posts).
A smart cracker would already have lined up the buyer(s) for the information (probably spam companies) before doing the crack. At least one copy of the data would have been made at the time of the crack to insure that it doesn't get captured and lost.
But nothing says that these cracker(s) are smart. Possibly just lucky.
robi
My school still uses SSN's as student id's. I've found that as a student employee I run into thousands of id's a day. I know it's the same way for a lot of student employees on campus. When will schools learn the benefits of a autogenerated key?
Do I contradict myself? Very well, then I contradict myself, I am large, I contain multitudes. -- Walt Whitman
in schools, its very easy to retrieve information, I went round no less than 10 junior schools in my area to get information on the new students that are about to enter the new year in the secondary school I work as the information manager.. NOT ONE of the schools asked me for ID, they showed me to a machine and logged me in and let me walk out of the door with the information on floppy...
Its a very scary.. but what can you do..
moo
Not to adapt a blame-the-victim mindset, but I mean really, why is this stuff on an internet-connected machine to begin with? I work in health care, and with HIPAA coming into effect, we've been moving a substantial part of our network off the internet -- if there's no physical connection, we can't get hacked.
This stuff needs to be taken seriously, and not just in punishing the offenders. Look at it this way: If your bank got robbed tomorrow and all the items in your safe deposit box were made off with, would you blame the bank if you found out that the vault was left open and the deposit boxes were made of cardboard? I sure would.
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
The UT link appears to be /.ed, but when I read it before it sounded like a simple brute force ssn lookup. The attacker simply generated random ssn and sent them against a page that returned information based on ssn. The attacker then simply harvested "positive" hits. The problem was that this interface was exposed to the public and that it had no means of throttling/preventing multiple requests/failed requests.
On another note, UT is phasing out SSN in many aspects of the students life. My wifes UT ID does not contain her ssn, it has a student # now. Though I assume that there are still many points of interface with the UT system that expects to see ssn.
Reading the article (as I am sure everyone already has), would tell you that the informatio nwas not tied in to any student grades. Two different systems / databases.
This does mean a spam has a few thousand live accounts of young (read: target audence) college students (read: active email users).
That is bad in more ways that one.
robi
It's amazing how much information you can get kicked back by simply trolling SSN's. This reminds me of the scandal last year with Yale's admissions information, which a Princeton administrator obtained by simply entering SSN's and birthdates on their web site. A brute-force attack like this one, simply adding birthdate to the mix, could have successful results in other places, I'm sure.
Stop by my site where I write about ERP systems & more
This is NOT the first time, and I do not believe that it will be the last. I work and attend a medium sized college and I happen to know from other employees that our systems have been compromised on several occasions, and in fact they are still being compromised. I do not believe that any critical information has been stolen, but the security of the critical systems at our nations colleges and universities needs to improve. Our college refuses to publicly admit that they have had a serous breach or deny any knowledge of current security problems. It's quit frustrating to be a computer security enthusiast and attend a college that refuses to admit they have a serious problem.
"There are six to 12 ways we could have reduced the risk to the database," Updegrove said. "The sad thing is, we didn't do any of them."
/. has an opinion as to how this happened?
It is good to see the University being so frank and honest about this matter. I am sure some heads are gonna roll, but at least the people affected will be provided with information and know how it happened.
Speaking of how it happened... the article does not go into technical details, but I am curious how this database was accessible to the world and was spitting out data to qualifying queries of SSNs without any security context... I am sure someone here on
This johnny-come-lately "UT" is ripping off the initials and the colors of the original UT (est. 1794 thank you very much)!!
;-)
We demand that our child State of Texas cease and decist in the molestation of our look and feel.
Sincerely,
Volunteer Graduate of 1994
PS, The UTK English Department is the Home of the Vowels
Eve Fairbanks says I drive a hybrid!LOL
SSN's are valuable because you can use them for identity theft. You can use them for identity theft because they're a national ID card. Something "they" (the mythical them) say they are not.
Apart from that all of the credit reporting, etc. goes through shadow companies that you can do nothing to if they screw you over (IE issue a credit card to a you that's not you).
We need to make using an SSN for identification purposes entirely illegal, credit card companies and banks be damned. Or say it is a National ID and come up with a better way of securing identities.
The key to the enjoyment of pop music is to replace any instance of "love" with "C.H.U.D."
Northwestern recently sent this out to all students:
d /inde x.html
d /vend ing.html#refundloc
Dear Students:
The following three bulleted topics are of student interest:
* Social Security Number is removed from WildCARD ID
With complaints about identity theft nearly doubled last year as the fast-growing crime topped the government's list of consumer frauds for the third consecutive year, WildCARD offices on the Evanston and Chicago campuses have started issuing new WildCARD identifications without social security numbers.
The re-designed WildCARDS are being issued at no charge to faculty, staff and students who wish to exchange their existing card for one minus a social security number printed on the front. Those without a card to exchange because it was lost or stolen will be
charged a $15 replacement fee.
"The new purple WildCARD looks the same as the old one, but as opposed to printing the person's social security number that used to be their Northwestern "id" number, we have implemented a shortened "emplid" number which the University is issuing that has no association whatsoever with one's social security number," said Arthur Monge, manager of WildCARD and Vending.
"We are not mandating that WildCARD holders be issued a new card, but the option is available for anyone who feels concerned about having the social security number visible on their existing card. It is a matter of personal choice to replace their existing card for one with an "emplid" number, at no charge, unless they have lost their card or it has been stolen." Since switching to a new WildCARD is optional, it can be done at one's leisure. Existing WildCARDS will continue to work, so if someone doesn't feel the need to have one without a social security number immediately, they can continue using their existing card until it expires.
Northwestern University's multi-purpose, one-card program, WildCARD, was developed nine years ago to provide better identification for members of the University community and to simplify use of existing services, control access, reduce handling of cash, and enhance security. Students, faculty, staff, spouses and domestic partners of active, full-time faculty or staff, authorized contractors working within the University community, Research Park tenants, and individuals affiliated with a University department are all eligible for a WildCARD. For more information, call Art Monge (847) 467-3135 or check the WildCARD Web site at:
http://www.univsvcs.northwestern.edu/WildCar
* New vending machine refund bank locations
If you didn't already know it, there are vending machine refund banks located throughout both campuses. A complete list can be found on the WildCARD & Vending web site at:
http://www.univsvcs.northwestern.edu/WildCar
New locations include the Family Institute at 618 Library Pl (front desk), Lake Shore Center at 850 N. Lake Shore Drive (front desk) and at Wieboldt Hall, 339 E. Chicago (Administrative office, 2nd fl). One is also planned for Galter Library in the near future.
Each vending machine should have a sticker on it that indicates the nearest refund bank. If one is missing, please inform the Evanston Wildcard Office at 7-6843.
* Other tidbits of information:
--The Abbott Hall ATM now sells stamps
--A Pepsi vending machine promotion is taking place now. Pepsi is giving away 80 Willie the Wildcat bobble head dolls. Look for a sticker on your next Pepsi purchase.
Creationists are a lot like zombies. Slow, but powerful and numerous. And they all want to eat our brains.
While my university doesn't use the SSN for our student ID number, it still asks students to put it on countless forms and enter it into countless databases. It's always made me uneasy, and I hadn't even thought of the potential for a computer break-in. Rather, I was unsettled that any student worker who checked out a book for me at the library could see my SSN on his screen after scanning my ID card.
But nothing wakes up a university -- especially a state school -- like the threat of litigation. If the cracker followed up and committed full-scale identity theft, the students would have grounds for a lawsuit against the school. Consider the recent New Hampshire lawsuit that dealt with SSNs and other personal information. With the potential for bloodthirsty lawyers, universities might finally get serious about protecting their students' information.
Doesn't one of Bush's daughters go to UT?
Could this possibly be related?
Seriously. In the UK the closest equivalent is a National Insurance number, which you give out to quite a few people. Banks often want this (because it's unique to you, which makes record-keeping easier). Your employer will want it, so their accountants can calculate your tax. Your doctor will probably want it, again, because it's a unique identifier.
Why are Americans so paranoid about who knows their SSN?
I used to admin at a University. One of the most frustrating things I encountered was the incessant desire for there to be no restrictions on any of the computing systems that the students used. This includes the servers. The firewall was just an expensive router. We were not allowed to run blocks from the internet to inside IPs, as that defeated the spirit of free access. I tried to explain why it was a 'Bad Thing(tm)' repeatedly, but alway met with resistance from the shared governance committee. One cannot blame the administrators in this thing. I assure you they feel just as powerless as I did. This kind of thing will become more and more rampant as clueless faculty (or upper-management in the business world) are allowed to influence major IT decision-making.
What steps can one take to protect one's identity?
You can't (not to say that you shouldn't make it more difficult, but just don't fool yourself into thinking that it's possible to do absoultely). It's like your house or car, you can take steps to make it more difficult to break in/steal, but there is absolutely nothing you can do to stop someone is wants to target YOU. So the best thing to do is to introduce a bit of paranoia in your life and assume therefore that it COULD happen and adjust accordingly. So for you're indentity, you do regular checks of your credit report, you keeps tabs on your bank accounts, you review your credit card statements, etc. The absolute worse thing that can happen is for someone to grab your identity and use it for a length of time without your knowledge. Getting your cc company to forgive unauthorized purchases is easy, as long as you do it within 30 days of your statement. Having someone apply for a cc with your info can bite you in the butt if you're trying to buy that car or get that mortgage, so you make sure you check well in advance and make sure that window of exposure is a small as possible.
Big deal. If anyone wants to know my ssn, it's "336721433".
SSN's are public information.
You need to restart your computer. Hold down the Power button for several seconds or press the Restart button.
They immediately disconnected the compromised database from the Internet, later hooking up a database of useless information.
They probably just copied over the DB containing the University's security procedures.
UT says:
Someone is more than a little bit confused about the nature of digital storage if they think they can `recapture the stolen data'.
`Ah, cool, we've managed to delete the copy they made of our data.'
(whispers)
`Another copy? How many copies did they steal?'
In principio creauit Linus Linucem.
- Experian
- Equifax
- Trans Union
Review who is looking at your credit report, and report suspicious activity to them. Having seen a few personal credit reports of people who were using their personal credit to establish a business line of credit, I've seen statements on them like: "Don't issue any credit to this person before contacting me at 111-222-3333".A few years ago I got a new bank account and they told me that due to a federal social security law they could not use my SSN as an identification source and that anyone who used it as such was breaking the law.
I know that many institutions and businesses use it (SSN) that way, but isn't it against the law? Or did I misinterpret the statement from the bank?
Hold on, why were UT's internal data reporting systems hooked up to the internet? I thought sensitive information like this was only exchanged over secure intranet and stored in systems with no access to public networks?
They just should not be used by any third party, one thing I was amazed on after moving from the UK to the US was just how many companies/people here ask for that information when really its not necessary.
StarTux
@ UB we have a "people number" it might sound stupid... but atleast if there hacked they dont get my ssn
http://www.DaveNet.biz/
You've got WAY more to worry about than hackers.
ANYONE who works in the offices (especially student workers) can get this information. Admissions? Financial aid? All of these people could find enough info out about you to get a credit card in your name or go down to Circuit City and buy a big screen.
Just like the people who worry about their credit card being stolen from shopping online - You've got a better chance of the guy working at the mall going through reciepts, or the waitress at Hooters when she takes your card up to pay the bill.
Some helpful person probably setup a "phone search" databse where you could search via ID. Probably they just didn't know the IDs were SSNs, or didn't care, or didn't put 2&2 together to realise that in adition to finding people's phone numbers, you could find people's SSNs.
Then someone just wrote a script to brute force the SSN range it seems from the 2nd link
I currently am a student at the University of Texas at Austin. The spineless fuckers in administration still have yet to inform us about our possible exposure. They may have only release info to the public about this yesterday, but as a current student, and employee I feel that I should have been informed first, not by my mom calling me at 8 am this morning, asking what the hell is going on at UT. Besides, you can't trust a University that claims a budget shortfall, but pays $400,000 for personal consulting for the UT President so he "looks like a more kind, and understanding person." One last thing, test forms that you hand out here have a field for you to bubble in your SSN as a unique identifier. Last I checked, isn't that a violation of the Social Security act?
"There are six to 12 ways we could have reduced the risk to the database," Updegrove said. "The sad thing is, we didn't do any of them."
Unfortunately the literal translation of this is:
I am so fired!
"I'm just here to regulate funkyness." - James Gandolfini, as Winston in The Mexican
Ever dream you could fly? Get up from the Flight Sim. I Fly
Currently the State of Texas is in the middle of some staggering budget shortfalls (as are most of the other states in the US). One state-funded entity that is looking at a shrinking budget is the UT system.
:P
Here's what I'm wondering: How do the powers-that-be, whether elected officials or University administrators, or the public for that matter, expect that security breaches like this are to be avoided when there is little to no budget to prevent them?
The agency that I work for, and many others, is faces increasing scrutiny by the state legislature and must undergo budget cuts, hiring freezes, and potentially the loss of staff to meet the State leadership's plans. As a result, we've already lost funding not only for basic needs already planned for, but also for what are known as "exceptional items" or those items that we see a need for outside our normal budget.
I understand the argument that "Hey, we need Police and health protection before you get new computer software!" but let's get real. Those are the same folks who will be panic stricken when their SSNs, or other personal info are stolen by crackers when agencies are broken into. And woe to the poor SysAdmin who couldn't work magic with a non-existant budget to prevent it...
I'm a taxpayer too, mind you, but how can we expect State and Federal agencies to protect their resources without security being made a priority and funded as such...
"Of course I'm wrong... That's how I get to 'right'." - Gil Grissom
Have you every worked for a non-profit? It's pretty hard to get fired. People that work for non-profits tend to fall into the "touchy-feel" category. Imagine taking a corporation's HR department and staffing every single position throughout the non-profit with that type of personality. In other words, if you see ".gov", ".org", or ".edu", don't expect normal organizational behavior.
Even so, if there ever was an event that deserved a massive firing, this is it. Here's hoping my company doesn't pick up the newly unemployed.
kind of scary that just anybody can find all this info by getting some scrap paper from the recycle bins or wherever around campus. I do that a lot but most of it's junk. But if you work in on campus I'm sure you can find lots of confidential info in the recycle bins and such that should NEVER be released.
Stop the Slashdot Effect! Don't read the articles!
A common misconception. Federal agencies are now somewhat restricted in how they use it (5 U.S.C. Sec. 552A) and some states have laws about it in certain circumstances, but one the whole there's nothing illegal about it.
Some Googling:
http://www.cpsr.org/cpsr/privacy/ssn/ssn.faq.html# IsItIllegalToAsk
p loyalert0205.asp
http://www.lawcommerce.com/newsletters/art_OHS_em
http://www.usdoj.gov/foia/privstat.htm
I'm sure intrepid Googlers out there could find more.
All numbers are public, by definition, but some numbers are more public than others. A SSN has value if you know that it belongs to a live human being of a certain age group, with a good credit rating and without a passport, if you have a bad credit rating, no passport and the same age. In contrast, a non-existent SSN, or one that belongs to a dead person has zero value. See for example an old guy who got arrested in South Africa recently, due to an FBI most wanted listing. A criminal stole his SSN and is probably a serial murderer, so this old guy spent a very hard time in a very tough jail for a few weeks. Not a nice holiday, but one he'll never forget.
I worked at UT Austin for a semester in '01, not sure if my SSN was compromised or not. I know there have been and are a lot of non-US students and faculty at UT Austin... What are the chances that one of our SSNs is going to get misused as a result of this and land us in trouble at some point with Homeland Security, INS, or the like?
I have both attended at work at UT in IT, so I can give you my observations.
For many years, UT had a non-centralized IT infrastructure. That is, the Colleges did one thing, the Administrative Computing Group did another thing, the Academic Computing Group did yet another thing, and the Libraries something else entirely. This was recently changed with the introduction of a new Office of Information Technology head by a new Vice Provost (Dan Updegrove, originally at Yale). One of the very first things I heard him address was the Social Security number problem in which every student, faculty, and staff member used their SSN as their ID. That practice had to change in order to meet both legal and privacy standards (see FERPA) , and UT has been trying for the past couple of years to make that happen. The trouble is, it was so integrated into all of the different services and departments that it is a slow process to remove it. They started to phase it out, but now UT is seeing the effects of this particular practice. I'm likely one of the ones who will be affected, so I'm waiting for them to announce where people can find that out. (It may be at the UT site, http://www.utexas.edu/datatheft/.
The Daily Texan (student newspaper) has an article about the theft, as does the Houston Chronicle.)
By the way, your Social Security Number isn't public information. It is required for use by some agencies of the government, but you are not required to provide your SSN to private groups unless they need to interact with certain government agencies (this includes your employers, who deal with the IRS). That being said, SSNs are so commonly used a search may pull up that information- but that doesn't mean it is legally public info.
Just to let everybody know, this was the last semester that UT was using SSN's as id's. We are in the process of switching over to what they call the EID. The EID is just a text string (similar to a user login). This is what we have to use to access online services for several years. Within months it was going to be our official identifier in all of the university's systems.
What we need is a honey pot full of fake SSNs ... when people try to use them (obviously stolen), the Feds go round and arrest the bastards.
This is really sickening. A lot of schools still use SSN as student IDs. In State University of New York, until very recently, your SSN was used on your grad reports, your dorm phone bills, your administrative notices, and teachers even insisted that this SSN/Student ID should be written at the top of every homework. Old phone bills with your name, date of birth, address and SSN were often found in classrooms or on the floor.
When I approached a SUNY teacher about this potential ID theft problem (back in 1999), his answer was: "I've been doing this for 20 years and I've never heard of this problem". Shocking, astonishing conclusion: The American academia is clueless! Oh no! How can that be! (But hey, it explains so much.)
It took a few ruined students and an order from the Attorney General (IIRC) for stopping NY schools from using SSNs as student IDs.
I am not really surprised that some administrative cretins are still camping on their position after all the theft ID problems of the last few years. After all, Schools Are Clueless.
I would like to entertain the hope that a few of these moronic school administrations would be sued 'till they bleed by ruined students, but how could ruined students afford this kind of legal costs?
--
Mad science! Robots! Underwear! Cute girls! Full comic online! http://www.girlgeniusonline.com/
In US territories a ssn is often assigned to a family rather than to an individual. Then the children of the family come onto the mainland for college. A bit of a mess when a large puerto rican family has 8 kids that all go through the same college.
contact the credit bureaus - there's 3 major ones - Equifax, Trans Union and Experian. tell them what happened, they can flag your acct so you have to contacted at your home phone before any acct is opened in your name. Here's more info...
That information wasn't leaked, it was FREED!
"Ask not what your country can do for you." --John F. Kennedy
(Extra credit props points to anyone who can name the system that I am talking about... Hint, this was late 70s to early 80s)
It was probably some over-eager credit card company who will now use the information to send 60,000 "pre-approved" credit card applications to the students. I mean, come on. Everyone knows we have to keep these students drowning in a pool of debt. Otherwise, how would the economey function?
This space for rent.
I highly recommend to everyone to read this page carefully
http://www.fightidentitytheft.com/flag.html
and if the drawbacks don't sound too bad (think carefully!) make the calls. It takes about a half hour. Much less than the time you'll spend untangling the mess of an identity theft. You may also consider calling your bank and creditors to ask them to put similar holds on your contact info so that some clever scammer doesn't have your statements forwarded to Timbuktu, thus gaining them extra time to run amok and causing you even more grief. This isn't paranoia talking, it's experience.
Here are the numbers.
Credit Bureau Fraud Departments
TransUnion
Fraud Victim Assistance Department
Phone: 800-680-7289
Equifax
Consumer Fraud Division
Phone: 800-525-6285 or: 404-885-8000
Experian
Experian's National Consumer Assistance
Phone: 888-397-3742
Davo -- Free speech, free software, AND free beer.
There's a solution if you use cryptography. Assign everybody a social security number. Also, give them a private key (or better, let them pick their own). Then, publish everyone's social security numbers and the public keys that match up with their private keys. (The government could even provide a service that allows people to look up public keys based on social security number.)
Then, everyone's number is out in the open. Whenever you want to do something with it, you create a message along the lines of this:
Then you sign that message with your private key. Once you've done that, anyone can use your public key to verify the signature. That means they can be assured that, unless someone has stolen your private key or broken the crypto, it could only have been you that wrote that message.
Thus, your social security number becomes public knowledge, but that doesn't help anybody because they'd need your private key to do anything with it. And, most importantly, there never is any situation where you have to give your private key to anyone. Your secret remains your own. No third-party ever gets a copy of it. This is important for two reasons:
I work in the admissions department of a Community College which uses SSNs for SIDs. One of the reasons that it is almost necessary to use the ss# as the identifier is because of the transcripts that we require for admissions into certain degree programs. We have about 20,000 unidentifiable documents that have only the name as the identifier on them, and 99% of these documents use maiden names, so without some uid (even as little as a current name and a birth date) , they are utterly worthless, and thus end up in a dead letter office. I personally recieve the same documents over and over again, but without the sending party taking the step to identify people, the documents aren't processed and people are denied admission because they miss deadlines.
Stealing files with fingerprint information isn't as helpful as it sounds. Fingerpint scanners don't compare against graphic files, they look for similarities between distinct features of your fingerprint (where ridges are, how far apart loops, etc...) Not enough information is stored in these files to make a working duplicate of someone's fingerprint (you might could hit a few of the features, but not enough). On the other hand, you could always lift someone's print off a glass and use the ole gelatin trick...
;).
Not sure about retinal scans, maybe that's an answer
I agree though, the use of SSN is outdated, it is security through obscurity using a less than obscure number. If I want to steal your identity, all trying to hide your SSN from me does is make it take me a little longer and piss me off that much more, you'll be owned soon enough
Not to be ignorant or anything, but as a Texas A&M Aggie it's my duty to say -- Whoop!
-dewhite
I was bitching about their lack of security as early as 1997... by default, they shunt(ed) all contact information into a publicly accessable x500 server. It wasn't a commonly known thing, and you had to take proactive steps to remove yourself from it (go down to an office, fill out a form, etc)
:)
:p)...
:)
:)
:))
From ksparger@vaevictis.stf.org Fri Aug 1 10:42:46 1997
Date: Fri, 1 Aug 1997 10:42:45 -0500 (CDT)
From: Vaevictis
To: info@x500.utexas.edu
Subject: Questions regarding the x500 service.
Message-ID:
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Status: RO
X-Status:
Hi
Sorry to pester you (I know how much of a pain it can be to administrate an internet service
I'm a freshman taking English 301 (Composition class), and we've just recently been assigned a proposal argument.
My proposal is that the university change the policy on the x500 so that instead of having the student's information accessable by default, the
student would need to sign a release form. (in other words, the exact opposite of the way it's done now... as a new student, I was horrified to find that my personal information (home address and telephone number, specifically) was being given to all comers..)
I would like to know the following information, if it's not too troublesome for you to give to me
What would need to be done to change the student's default from "distribute information" to "withhold information" in the x500
directory?
Would it require a change at the actual x500 site (ie, configuration files?), or would it require that some other group (the registrar, perhaps?) change policy?
What kind of security measures are installed to log accesses of information? For instance, I know for a fact that you don't attempt identd lookups, do you log access attempts by hostname, IP address, or do you log at all?
What are the scenarios if it is found that someone used information acquired from this database for illegal/unethical purposes? ie, could you even prove where a certain access came from if you had to in court?
Anyhow, thanks for your time, it's much appreciated
If you don't know the information for any of the above questions, I would
appreciate it if you could tell me who could (if you know, anyway
Thanks a lot,
Kyle Sparger
Date: Fri, 01 Aug 1997 11:13:04 -0500
To: Vaevictis
From: "William C. Green"
Subject: Re: Questions regarding the x500 service.
In-Reply-To:
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Status: RO
You should read our FAQ and all associated links: http://x500.utexas.edu/x500info/faq.html
Specifically, Appendix C Subchapter 9 with special attention to section 9-201 of the General Information Catalog.
I would suggest you begin your inquiry with the Registrars office, although many other offices would be involved. My understanding is that any change would need to be approved by the Regents.
This question is more complicated than it would appear.
As part of your argument, you should consider the implications of not having a directory service, or, a service that is restricted to UT Austin
access only.
Host access information is kept in rolling logs.
Aside from the fact that the custodian of the information certainly has a lot to blame in this, there is another big part of the problem. That problem is what people can actually do with the information.
An SSN is identity. It is nothing more than that. The problem is people make the incorrect assumption that it is authenticity (I can recite the number, or read it off a little card in my wallet, so it must be me), and authority (this account has your SSN and is overdrawn, so you are liable for it).
If any law change is needed, it is a law change that says that it is illegal for an SSN to be accepted for any purpose other than identity. What that means is that if I walk into a bank and open an account citing some SSN, the bank needs to understand that all this does is identify someone, and not necessarily me. If the bank causes harm to the real owner of the SSN by having provided any derogatory credit information based on that SSN, then the bank shall be fully liable for having not taking reasonable measures to ensure accuracy of information. And by that, what I mean is that the bank can't simply say that the victim needs to track down the perpetrator to cover the costs. The banks need to be forced to properly authenticate the information they use, especially when and where it might be used in a negative way.
And I don't mean to pick on banks (I just happen to have an open case with Chase Manhattan bank which continues to allow someone to operate a credit card account with my SSN, reported on my credit reports, without my consent, and after I have advised them of the fraud). Such a law should apply to anyone and everyone who accepts and uses SSN data for anything. It's the negative things that can be done (like bad credit info) that needs to be stopped (in addition to other stupidities like running computers insecurely and connecting systems to the internet that have no business being there).
now we need to go OSS in diesel cars
When I was in college I was broke, in debt and had no credit. Go ahead steal my identity you can have
it!
Microsoft aggravates my tourettes syndrome.
If SSNs were only supposed to be used by the IRS, and the current system is so ripe for abuse, why hasn't there been a law against using SSNs for non-tax purposes? Easy - lobbyists and money. Credit card companies and credit bureaus see SSNs as a godsend. For them, it's cheaper and easier to have a central registry in order to troll for new credit accounts, regardless of the security problems inherent in using SSNs for everything.
Every effort to reduce the power of credit bureaus and protect individual privacy has been defeated or weakened by the credit bureaus and credit issuing companies. Their claim is that a central database tied to everyone's SSN is critical to doing business. Of course, they neglect to mention that they do plenty of business outside of the US without having such a system in place, AND the fact that SSNs are not guaranteed to be unique.
At this point, reasonable souls would start to question whether this is a government for the people, by the people, or a government for big business, buy the politicians! Face it, it won't be until the system is completely broken, with millions of people affected, and with the costs of keeping the current way of doing business too high to continue, that they'll change. By then, it'll be too damn late...
Is your SSN in the following ranges?
* 449-31-98xx - 450-91-24xx
* 451-12-32xx - 451-20-35xx
* 451-20-64xx - 452-20-40xx
If so, within these ranges, 55,200 people of the following types, including but not limited to:
* Current students, faculty and staff
* Former students, faculty and staff
* Job applicants
* Retirees
may be affected.
I attend community college at night and in one class we have to telnet into a Solaris box from W2K. Our login name is the frist 3 letters of our last name, followed by the last four digits of our social security number. Guess what the password is? Yeah, our full social security number. One day I came to class early with a copy of Knoppix on a CD and booted off it and ran ettercap, poisioning the switch so all traffic goes through my machine first... One by one, as students came in, I was able to sniff the their login name and password (which was their social security number). I sent an email to the school using that as an example of why students passwords, or their ID number should be a SSN number. I have not yet gotten a response
Funny how this security breach at Princeton never got the media attention it deserved:
t
http://www.ispep.cx/files/tucson.princeton.edu.tx
Mod this up as Informative...
Ever need an online dictionary?
The Indiana University School of Medicine was hit recently. Not just social security numbers, but medical records, too--everything you need to know to become someone else. All these poor folks were patients of their sleep clinic. I guess they have something else to keep them awake all night now...
-Scott Hutton
This isnt an isolated incident, rather its a trend. Big state universities are a target for hack attacks unfortunately.
Kansas University was hit hard in late January. SEVIS was pilfered, Student Exchange Visitor Information System; part of the Patriot Act)
Info here.
A click on the travel.fp3 file listed a couple hundred SSNs. It was completely wide open.
UT made it sound like a deliberate attack, but it looks to me more like administrative incompetence (and cya).
Then there was the amusing experiment where a bunch of Germans managed to fool retina scanners using printed images of eyes that could be taken at a reasonable distance with a camera.
Xix.
"Everything is adjustable, provided you have the right tools"
I'm a student at UT-Arlington, the next largest school in the UT System. Last October our Student Congress passed a resolution I wrote asking them to basically make it easier for students to be able to request to no longer use their Social Security Numbers as their ID # - UTA currently has a system in place where you can request to use a randomly generated ID# instead of your SSN, but no one knows about it and they don't advertise it or make it easy.
The administration's response was "Come Summer 2005, when we have our new Student Information System, we won't use anyone's SSN" but that in the meantime, we're screwed because they weren't going to change anything.
A month ago I discovered the 'secure' portion of the Housing department's website had been indexed by Google, including the ID # (Social Security Number) of all 1200+ residents living in the on-campus dorms. This highlighted the need for the immediate cessation of collecting and storing SSN's, so I've introduced a follow-up resolution our Student Congress is looking to pass soon basically demanding each department document every way they use SSN's and the security measures in place to protect them, after which we want a committee of students and faculty to go through the documentation and approve or deny their use and storage of the SSN's.
Our school paper, The Shorthorn (www.theshorthorn.com) is supposed to do a story in tomorrow's (Friday's) issue concerning the leak at UT-Austin and the fact that administrators so far at UT-Arlington are ignoring the need to provide secyrity for SSN's NOW, and not just in 2005.
It should be interesting to see if the administration has finally 'seen the light' and will listen to us, this time.
In their newswire, Salon titled this story, "Computer crackers steal students social security numbers."
I thought the Slashdot community would appreciate Salon getting the terminology right on this one. It may seem like a silly point to some, but the distinction between "cracker" and "hacker" is huge in my mind, and it always makes me happy to see a journalistic outlet get it right, for a change.
I agree wholeheartedly that the abuse of SSN is a problem. However, realize that most US educational institutions will assign you another unique student ID which is not your SSN; it is not impossible to dodge their use, and if you truly care about your security you will never use this number except when forced to. You have the right to protest its use otherwise, but consider that this distinguishing characteristic may not be so good socially--the people around you might not be quite as apt to understand your rabid protection of this number, even if many of the more privacy-oriented do.
Moreover, as much as it is claimed (and perhaps rightly) that "the system" wants you to use this one unique identifier, there is a definite advantage to having an easy-to-remember number associated with almost everything, instead of separate account and unique personal identification numbers. However, some privacy experts agree, as do I, that the SSN should only be used for, well, Social Security when possible.Looking at that aformentioned letter, I find a passage which states that "from a technical viewpoint, the SSN is not a good identifier. It is not unique, [and] there are multiple users of a single SSN". While I can find no proof of this assertion elsewhere, I have heard anecdotally heard of people who used Richard Nixon's SSN throughout college (567-68-0515)--the results are obviously mixed. Overreliance on this number poses an undue threat to college students who, frustrated by this kind of wholesale theft which could lead to troubling financial consequences should the perpetrator preserve a copy of the data, might turn to forging SSN's--an OK idea until you get caught at it.
We recently had heard in the office over one of the Yellow Machine that's made by Anthology Solutions.