Slashdot Mirror
CSU Chico Identities Compromised
MisterFuRR writes "California State University Chico is the latest victim of Identity theft. Aparently one of their "Food Service" machines was cracked and used to distribute "games, files, and other media". An official response is available." From the article: "The names of 15,500 current students, 1,000 faculty, 1,500 staff and former students going back about five years were in a database that was potentially compromised. The files also included information on prospective students."
sounds to me like someone got the munchies...
It's still a good place for education as long as there are enough of chicks with no pants
Rock that crushes, Paper & Scissors that don't matter.
Anonymous 2:00 AM phone call: "Hello. This is Captain Nightbyte of the `0Hack L33T Legion`. It has come to my attention that you actually ordered a spam sandwich with Cheez Whiz, not once, but 18 times back in 2002."
Don't blame Durga. I voted for Centauri.
Why oh why do people give out their SSNs even when registering for college courses? I work at a college and I went to college. You aren't required to give your SSN and when I register for courses now I certainly don't.
Colleges shouldn't even ask applicants for their SSN. Yeah, it's a real pain in the ass 12 years from now when you try and get your transcripts and you can't remember your student ID. I graduated in 2001 and I remember mine... Maybe I won't in 10 more years but I will know that I can be searched for by name and graduation date.
DO NOT GIVE OUT YOUR SSN TO ANYONE. If they ask then politely decline and ask if they will allow another ID number. Every college I know of has a student ID field.
Here we are pushing students to use their student ID instead of their SSNs (a good majority of students give us the wrong SSN anyway).
Nope, they uses Microsoft SQL server. That's how they got cracked ;-)
i'd be surprised if any of the student data actually made it off the computer. through a not-really-worth-explaining series of events, a former co-worker of mine had a machine exploited in such a fashion. it became a hub for trading shows of cedric the entertainer. the hard disk quickly filled up and we unplugged the machine after its network activity started looking odd. it turns out that the parties responsible didn't even take the time to notice there was a second drive on the machine they'd be able to use.
i don't have any experience beyond that, but i've heard similar stories from other friends. it seems like the sort of exploit that took place isn't one that's likely to be targetted at retrieving potentially sensitive data from the exploited machine.
of course, one should never assume a particular attacker was ignorant and single-minded based on others' experience.
Have any of these people ever heard of data segregation?
Why on earth would a 'food service' computer either have on it, or have access to a list of prospective students? So they can preemptively issue dining cards in case of alien attack?
What the hell are these databases doing on machines connected to the internet?
You betcha. Would you like me to send you the database that has all 1,087 JPG files of everyone who purchased a Mountain Dew from 2002 to 2004? It was pretty easy for them to gather the information. They had a tiny camera that took a picture every time someone dropped money into the machine. The camera was hidden on the front of the "Diet Blue Dr Pepper" can, which ensured that it would never be disturbed by a purchase.
Don't blame Durga. I voted for Centauri.
CSUC said it has implemented new security measures. One of them is to issue randomly assigned nine-digit identification numbers to students and staff, in place of Social Security numbers.
500GB of disk, 5TB of transfer, $5.95/mo
The summary above is not quite correct. The linked article actually states, "...someone had broken into a computer server at the university's housing and food service center last July", not a vending machine.
$#!^ happens, but why does it always have to happen to me???
If this keeps up, pretty soon we're all going to have the same identity!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
They stole my social security number? That's totally lame. Pass the bong.
(gurgling sounds)
What's a social security number?
Students at CSU Harpo and CSU Groucho breathed a sigh of relief on finding their campuses were not affected. No word at this time on CSU The Man.
Little Johnny suspected something might have been up when the lunch menu started to refer to today's special as 0-d4y meatloaf
In this day and age it's entirely possible to have the web server on one box, the application on another, and the database on a third. The systems and OSs on all of them can all be different from each other.
# cat
Damn, my RAM is full of llamas.
My fiance was a student at Chico State within the last 5 years and she just found out last night that she had been hit for $39.99 from a Pluto Data Inc scam. http://www.broadbandreports.com/shownews/60769 I wonder if they are somehow connected? She has only used her credit card online a few times.
You're a bit too sheltered. Here's a remedial homework assignment to make up for your lack of education:
Go to the store and buy
-A 12 pack of pabst blue ribbon or equivalent
-A funnel
-four feet of plastic hose
Your assigment is to find the fastest way to get the most beer into your stomach. Bonus points for finishing the 12 pack before you puke (with partial credit for fininshing the 12 pack even after you puke)
That's it! I don't care how many bells and whistles the thing has. I'm never going to give my social security number or bank account number to the soft drink machine again!
"Prepare for the worst - hope for the best."
Is this an accessory for smoking or a new way to consume potent potables
Dude, you must be using WAY too much of the other kind of bong if you couldn't even do a simple google (and for a few seconds more, the image search).
And just to make sure this isn't Offtopic, here's some Chico info
Press 1 + A + COIN RETURN for more options, including misc keygens and ketchup.
The other half of the problem is illegal immigrants. My SSN has been used to buy a bunch of property in california, all under mexican surnames. However the privacy laws protect the fraudsters, i cant even find out who it is or where this property is. Only reason I found out was because I went to open an account at the bank and all these property transactions came up under my ssn -- the lady messed up and told me one of the names.
Religion is a gateway psychosis. -- Dave Foley
This kind of thing happens _all_ the time. When I knew people who did this, they'd get 10 or 15 unis whenever a new exploit came out. And that was just one 'fxp' team, of which there are hundreds. I'd be suprised if most of the unis in the US, and indeed around the world, don't have at least one compromised machine. And the guys don't care about sensitive data, they just want your hdd space and fast uni connection to serve the latest movies/games/apps/mp3s/whatever. This is the most un-news slashdot has posted in a _long_ time
The DEA is going to be busy for a while, given, you know, that its CSU Chico.
Dude it's a tool that "The Man" uses to keep dibbs on you...
(gurgling sounds)
*COUGH* *COUGH*
P.S. I was a CSUC CSCI student. And If I remember right that conversation actually did happen.
"It takes many nails to build a crib, but one screw to fill it."
I've spent the past 11 years of my professional life after my CSU, Chico Computer Engineering degree explaining to everybody that there really is a pretty good computer/engineering school there. Most of the engineering people spend too much time in the labs to really get out and party as much as some of the other people do.
:)
I try to claim that they know computers -- but then they do this!
(It really is a very nice school, with an attractive campus and social life included).
--Lance, CSUC Computer Engineering '93
Ah, yes. Of course it JUST HAD TO BE a Microsoft product. You present no evidence, just hear-say and you get moderated up for bashing MS.
That little winkie thing on the end of his comment indicates that it was likely a joke. It's still working hours on the west coast. Shouldn't you be trying to get tabbed browsing working in IE instead of surfing Slashdot? :)