Slashdot Mirror
Identity Theft from University Computers
Different River writes "Someone broke into the administrative computers at George Mason University and accessed personal information, including social security numbers, of 30,000 students, faculty, and staff. "Before the hacking, the university was in the process of replacing students' Social Security numbers with other internal numbers to protect against identity theft." Looks like they just missed it."
Any corporation / school / government entity that uses SSN to identify a individual either on paper or digitalized is out for a harsh reality: Personal identity theft is real and here to stay. Now if I could just figure out how to talk these old timers to drop the SSN number they want labeled on their checks..
I always hated that about college. Where I went, EVERYTHING was connected to the SSN of a student. They knew it was, at the very least, imprudent. When a student first enrolled, there was an option somewhere that the student could check off signifying that he/she would like to be assigned a non-SSN ID. It was in an obscure place, though. I only found out about it when I started working for the University. It was almost as if they hid it, knowing that this is the last thing on most folks mind who are just enrolling at the university.
My other computer is a Jacquard loom.
It seems like bit of a convenient coincidence that this happened just before they replaced their ID numbers with something other than Social Security numbers. Someone has obviously been paying attention in their Computer Science classes.
The most remarkable thing to consider regarding these types of stories is the fact that, more often than not, the hackers are incidentally detected (e.g. they send an email saying "give me money or I go public!").
How many of these incidents happen with no one the wiser. Just guessing, but I'd wager at least 10 major silent exploits for every 1 publicized event. How many employees of Big Corporation are doing a ZIP of the company database onto a USB key "just in case", and how many servers are silently owned month after month.
There are probably a lot of cases just like this where either the hacked party isn't even aware they got hacked, or the hacked party knows they got hacked and isn't talking about it. Which makes you wonder how long our credit system can stand up to rampant large-scale ID theft.
Stock up on canned goods, folks.
One of the National Privacy Principles introduced by the Privacy Act 2000, prohibits a private organisation from using such information to uniquely identify a person. Maybe other countries should follow suit and enforce such a law...
What OS was their server running????
The one thing that would make me suspicious would be the fact that the intrusion happened just as they were transforming the data to use some other sort of unique id - IMHO an insider alert if ever there was one.
Other than the BMV (and I can't figure out why they need your SSN), most of the places that have it are because they need to report tax information about you. You don't have to give it to anyone else. Some places will get annoyed with your request to have a special identification number, but they will accomodate you. My undergrad used to use SSNs for identification, but you could always request a different ID number at any time.
What?
Universities are notorious for not having good network and server security (hard to hire the required large staff to oversee so much data). I now work in the computer security field, and when I look back at my university experience I see lots of very frightening things -- besides just the extent of the records the university keeps, they also tend to print things like your birth date on records. Having your date of birth intercepted is bad news, and it is really disturbing to see it printed in so many places, especially along side your SSN / SIN.
On top of that, network security in general is weak and so there are all these students using unencrypted shell logins, and exchanging sensitive data over email. Or doing online banking on public machines, where key loggers could easily be installed. Lots of students live at the university, so they have to use computers for sensitive tasks like banking (unless they happen to have a laptop).
The whole experience made me resolve to keep tight control of aspects of my privacy. If someone tries to hijack your identity, the tell tale signs are: money disappearing, and new accounts being opened. So you must keep accurate records of where your money is, and watch those balances. Also order yearly credit checks, which are free to do. If someone is opening accounts under your name, you can at least catch it.
I think the problem is that there is a general belief that SSN is a secure identifer. Back when I was in college (god, almost 10 years ago), in my first "IT job" (ok, so I was lab consultant), one of our bosses showed us how easily it was to access public information. From a name and city, he was able to retrieve the student's full address, SSN, and even retrieve the student's parent's property tax information. The demonstration did not involve hacking or unauthorized intrustion to another system. This was 10 years ago, when there was a lot less more "online" information about you.
.rhosts file on your root user account.
Assuming SSN is secure is like using a
I was one of the potential people whose information was obtained. I am not planning on taking action against the univesity nor would I do so even if finacially harmed, unless it can be proved that there was gross negligence. GMU has made a good faith effort to switch IDs from SSNs to the new 'G' numbers. If my information was used to fradulently open acounts under my name, I would estimate primary people responsible are in my estimation:
1) The thief
2) The creditors for their lack proper verification allowing people to open new accounts and charge thousands of dollars with a few tidbits of information
Then, depending on the circumstances:
- The makers of whatever software was compromised, be in Windoes, Oracle, IIS, etc.
- The administrators of said systems for not securing their systems properly or keeping up with the latest updates
I bet they have been "in the process or replacing the system" since last century. They just didn't do any serious work on that until they got busted. Same as US Airways over christmas and countless companies with Y2K bug until 1999. Everyone with decision making power should take a serious pay cut and students should get tuition discounts to offset the cost of dealing with identity theft.
If they really took the problem seriously, an upgrade wouldn't take long at all. Just mechanically replace SSNs in the database with unique, randomly generated 9 digit numbers and set up a web page that maps SHA(SSN) to the new ID.
Not sure why you guys are so opposed to the idea of sueing the school. They're not even being apologetic. The bare minimum I would expect would be a formal apology.
Where would the money come from? From the school of course. This would just raise tuition you say? Well sure, but why would you want to goto a schoo like this after an incident of this magnitude. I wouldn't trust them. And there are other options. Its not like we're talking about Waterloo or MIT here.
I worked for AT&T Wireless when they were breaking off from AT&T proper. One of things that needed to be done was to replace all of the AT&T employee ID numbers with new AWS employee ID numbers.
It. Took. For. Ever.
All sorts of disconnected systems keyed to that AT&T ID # that needed to be updated and changed and the change need to happen in one fell swoop and nothing could fail.
I'm betting a university setup is even worse.
Actually, it's a problem with both. When the SSN was first conceived is was specifically NOT supposed to be any sort of ID system. Obviously that changed.
Some states have solved the problem. In Texas, for example, people can "lock" their credit information. With it locked no one can get credit reports which makes it impossible to get credit, even if the person has the SSN, drivers license, birth certificate, etc.
Of course the credit companies are fighting these laws because they like the idea of fast and easy credit.
If someone says he and his monkey have nothing to hide, they almost certainly do.