Slashdot Mirror
Another School Exposes Private Information
DutchSter writes "In the wake of other schools announcing the theft of hardware containing sensitive student information, Miami University, of Oxford, Ohio, has announced that a file containing the name, Social Security number, the grade point average for the Fall 2002 semester, cumulative grade point average, and other related academic information, such as credit hours attempted that semester, for all 21,000 students who attended the Fall 2002 term has been available on a web server for the last three years. The discovery was made this week and the university is taking steps to deal with the fall-out sure to come."
Who are these ppl hiring as web admins??? Why are these files even on servers connected the net?? and hopefully first post
they figured this out after it showed up on Google? What ever happened to auditing what you have on the web.
-nick
I know this is a major breach of privacy/security, but I'm curious about what kinds of malicious things one could do with this information.
It seems to me that the only useful thing is the names/SSN combination.
Unless you could blackmail some poorly-achieving students by threatening to tell their parents their real marks?
"A week in the lab saves an hour in the library"
Miami University... must be in Florida.
Oh, it's in Oxford... must be in England.
Bzzzzzt. BUT NO! It's in Ohio!
It must have taken a long time to come up with that combination of naming and placement.
My photolog
Three cheers for Business School's retarded cousin.
Miami University...in Oxford...Ohio.
Met a girl from Miami that went to Oxford, and didn't like the song "Ohio." Seems a little less obscure, too. Yet, this school has 21,000 students? I mean...that's more than the real Oxford...the one that's not in Ohio, but has students from Miami...
the university will refund their tuition for the year.
that's what i would expect at a minimum. on top of other punishment for letting it happen in the first place.
this only reinforces the notion i have that there is absolutely no privacy. once your data is in someone elses hands (and all your data does in fact belong to them) you can kiss your privacy goodbye.
there is no recourse whatsoever. you cannot even sue them or ask for damages.
your personal data is obviously worth something to sell to third party "warehouses" but when they expose your data to the whole world, at that point it ceases to be worth anything...
Science : Proprietary , Knowledge : Open Source
Binghamton University in NY, just announced this week that 404 student names and ss numbers, as long as other sensative data was unsecured for months, it was only after a relative of a student pointed it out was the problem fixed...just in case you guys didn't know
This got me thinking. Email spammers and other naughty types run web bots to scour web sites for email addresses and similar personal information. How hard could it be to write software to search one's own web server for lists of SSNs or whatever, and alert a webmaster so it can be quickly taken down? Doesn't sound like it would be particularly difficult at all. A quick search untility to parse publicly-accessable pages could save a lot of bad publicity later, as happened in this case.
Andrew Lenahan http://www.starblind.com/
No school needs an SSN. For that matter just say no to giving it to anybody but the IRS and your financial institutions. Your doctor doesn't need it. The gas company doesn't need it. Cingular and Earthlink don't need it.
The city in Florida sprung up at the end of the 1800s, and adopted the name because they thought it meant something vaguely pleasant regarding water.
So if anybody's ignorant, it's actually the clowns in Florida.
Anything computer-related done by either government or schools tends to be incompetently executed and annoying, probably because when you need to deal with them, you need to deal with them - you're not a customer and if you don't like the way they do things, you can go fuck yourself. There's no reason for them to care about you, and it would be irrational for them to spend much money on giving you a better experience (well, up until the point that they get in trouble for leaking your private info on the web, that is). At least that's my theory to explain my experiences.
Don't drop the soap, Tommy!
It's the Future of Rock & Roll!
Sue the hell out of the person who discovered the security hole. That will show em.
Hacker Media
Last year, UConn, my college, had a privacy breach where lots of SSN's were leaked. This year, they've made a committee to figure out ways in which they can remove SSN's from as many internal processes as possible.
Last year, a student's ID was their SSN. Now, it's an ID assigned by our peoplesoft system. If i forget my ID at, oh say, the campus book store *shudder*, they can't look it up w/ my social. Like I said, good things can sometimes come out of these events.
Over the Summer, my school's district replaced their old SIS (Student Information System) with "SchoolMAX", designed by Maximus. After talking to a guidance counselor regarding schedule modifications, I noticed her log in to the new system - I noticed it required 4 credentials, one which the counselor left blank, and I made a mental note to Google the name of the system for more info on it for curiosity sake. The counselor printed me my new schedule, right from the web page. Sweet, thanks for doing the work for me - the URL was on the bottom of the sheet. I got home, hopped on the web, and keyed in the URL. The credentials required were school district, operator ID, password, and screen ID. Screen ID was what the counselor had left blank, so I was down to 3. I figured school district would be available online - a quick Google search confirmed this, and I was down to 2 fields remaining. There doesn't seem to be any real security on the site, and I predict a simple brute force or something more practical such as social engineering would enable anyone to an entire district worth of information.
Before you start blaming every CS student maybe you should read the full explanation on their site, which among other things says:
"On Monday, September 12, 2005, Miami University became aware that a grade report from the Fall 2002 semester had been unwittingly placed by a now-retired faculty member into a file that was accessible via the Internet.
Note the 'retired faculty member'. Not a student or a hacker.
This seems like a common problem, how does one protect again appending sensitive information from a protected document into an ordinary text or non-sensitive file? Is there a technology out there that can mark the data so it can not be copied into another file even though it is accessible to some. Apparently the 'now retired faculty member' had access to the file. Probably used cut and paste to imbed it into a file he/she could access from home/laptop etc. We had lots of problems like this at government locations I worked at
I understand your anger but this does not seem to be a malicious act, it appears to be an honest screw up and is not like the stupidity of Citibank sending their files via un-encrypted tapes by UPS.
The school seems to be handling this OK.
I understand that it is the easy thing to do but with all the compromises of data recently it seems that the inconveinience of unique numbers for different institutions would be a valid approach. Data theft is like gambling. In Vegas you can't lose what you don't bet. On the web you can't have data compromised if you don't put it on the network.
In constrast to most /. types, I have pretty much given up on "privacy" in this sense. We live in a world that is becoming more and more connected and wired every day. Within that context, it becomes more and more possible for people to obtain information about one another. Perhaps we should be thinking more about how to embrace this reality rather than fruitlessly attempting to resist it. Just a thought...
It's named after the Miami tribe of Native Americans who used to live in the area. I go there, and yeah it's a joke. I'm just there because it's somewhere close while I decide where I want to really go. Wasn't always like that though, and to all the Miami Flordia people, Miami U was a school before Flordia was a state.
Peace
P.S.
yay, my first post!!
I don't care what youre doing so much as the idiotic way you're doing it.
How many schools have info like this (or worse) posted on some forgotten webpage?
Maybe the IT departments of schools should look into hiring quality people for their systems instead of leaving it up to educators with no real-life experience or student staff that rotate every semester.
A lot of universities have not-well-advertised public ftp servers that are used for transferring large files, generally with scripts that scrub things that have been around for more than a day to avoid turning into warez servers. I know of one multi-campus institution where an employee at one campus and their counterpart at another campus agreed to use this method to transfer a list of all currently enrolled students at one of the campuses. This included phone numbers, addresses, and student ID numbers, which were mostly SSNs, because that was the default and most students didn't know to ask for a different ID number. Once the transfer was complete and they discovered they could not delete files from this server, they called support, and it was gone in under 5 minutes. They'd already had it drilled into their heads how bad it would be if such a list got out, but no procedure for securely transferring very large files had been established, and they did not have the technical expertise to establish one themselves.
I imagine this happens a lot, especially at research institutions whose scientists need to be able to receive large amounts of data from collaborators without having to set up accounts for them.
There's no failure quite as dissatisfying as a complete and total solution to the wrong problem.
For free identity theft monitoring, please send your name, social security number, birth date, credit card numbers with expiration dates, and address to protectmyidentity@gmail.com. We will take care of your credit record for you and guarantee that you will never have to worry about your good credit record ever again.
You must give your SSN to Federal, State, and Local governments only when there is a law that requires it. The act also says the government agency MUST inform you at the time of collection whether giving your SSN is required or optional, cite the law that requires it, and explain what happens if you don't give it.
If you do not see a privacy act notice on government paperwork, then don't give your SSN. It's hard to say no, and many govt workers are completely ignorant of the law, but you've got to take a stand.
Non-government entities can ask you for your SSN for any reason or no reason, but you don't have to give it to them. If a company says they have to have it, be prepared to take your business elsewhere.
So, is Miami of Ohio a government entity? Many universities are because they are state funded or created by an act of state law or consitution. If so, demand that privacy act notice. If not, take your money somewhere else.
I doubt any school would deny you admission because you refuse to give your ssn. What do they do for the foreign students?
You'll never know what you can do without giving out (your SSN) until you stop giving in.
Things I've done without giving out my SSN: got real phone service, got satelite TV, been to the doctor/hospital, got medical insurance, got internet service, got married. Yeah sure, I wasn't able to get that extra 10% off at Pier One by signing up for a credit card. So what!
To SW ohio's defense:
Carmen elektra and Sarah jessica parker are from there i think.
and Miami girls are just an example of what happens when 3 or 4 generations of rich people marry the most beutiful women they can afford. Standard upper class breeding.
They Are Night Zombies!! They Are Neighbors!! They Have Come Back from the Dead!! Ahhhh!
I say, sirruh, we Americans may on average be large assholes, but that is a bit much, don't you think?
Edward@Tomato - /home/Edward/ man woman
man: no entry for woman in the manual.
"Qua!?"
Anyone got the torrent?
Telltale Games: Bone, Sam and Max
Back then we carried around sheets of paper with our information. Some used a redundancy method known as "carbon copy" - in which the user would write once and the data would be recorded in many places.
Though I had to physically walk miles to track down professors without watches, the data was always securely stored in the back pocket of my jeans or stuffed into my backpack.
Best of all, we relied upon social engineering security and things like locked wooden file cabinets. The security team was staffed by should-have-already-retired women who hated all people and wore too-tight pastel colored polyester blouses and shirts. But nothing got past them.
The Luddites were ahead of their time.
The information released also included demographics. I've obtained the information and masked off the personally identifying information so I could show the sort of demographic information made available:
... Gender Dress ...
... Male, Khaki shorts, white T-shirt, ball cap
... Female, Khaki shorts, white T-shirt, ball cap with pony tail pulled through
... Male, Khaki shorts, white T-shirt, ball cap
... Female, Khaki shorts, white T-shirt, ball cap with pony tail pulled through
... Male, Khaki shorts, white T-shirt, ball cap
... Male, Khaki shorts, white T-shirt, ball cap
... Female, Khaki shorts, white T-shirt, ball cap with pony tail pulled through
... Female, Khaki shorts, white T-shirt, ball cap with pony tail pulled through
... Male, Khaki shorts, white T-shirt, ball cap
... Female, Khaki shorts, white T-shirt, ball cap with pony tail pulled through
(if you've been there, you'll understand)
. . . unfortunate incidents are blown out of proportion or even engineered by the IT establishment at these colleges as a ploy for more authority and better funding. Whether or not that's the case, it'll certainly be the result.
I too have felt the cold finger of injustice.
There is no evidence that anybody ever used this information for unauthorized purposes. Some professor left the grade report in an exposed directory on a web server. Instead of taking the server down and forgeting about the incident (like 9 out of 10 IT departments would have) the University sent letters to all of the potentially affected parties. I don't even believe that OH has a CA style law requiring such disclosure. I commend them for their honesty.
The suggestion that the University should have refunded $20K to all of its 2002 students because its theoretically possible that somebody might have gotten their information is positively bizzare.