UCLA Hacked, 800,000 Identities Exposed

An anonymous reader writes "The Washington Post reports that a central campus database at UCLA containing the personal information (including SSNs) of about 800,000 UCLA affiliates has been compromised for possibly over a year. The data may have been available to hackers since October 2005 until November 21, 2006, when the breach was finally detected and blocked. Several other UC campuses have also been involved in significant data security incidents over the past few years." From the article: "'To my knowledge, it's absolutely one of the largest,' Rodney Petersen, security task force coordinator for Educause, a nonprofit higher education association, told the Los Angeles Times. Petersen said that in a Educause survey release in October, about a quarter of 400 colleges said that over the previous 12 months, they had experienced a security incident in which confidential information was compromised, the newspaper reported."

Comments

E-mail sent to UCLA students, faculty, and staff

[George Maschke]

December 12, 2006

Dear Friend,

UCLA computer administrators have discovered that a restricted campus database containing certain personal information has been illegally accessed by a sophisticated computer hacker. This database contains certain personal information about UCLA's current and some former students, faculty and staff, some student applicants and some parents of students or applicants who applied for financial aid. The database also includes current and some former faculty and staff at the University of California, Merced, and current and some former employees of the University of California Office of the President, for which UCLA does administrative processing.

I regret having to inform you that your name is in the database. While we are uncertain whether your personal information was actually obtained, we know that the hacker sought and retrieved some Social Security numbers. Therefore, I want to bring this situation to your attention and urge you to take actions to minimize your potential risk of identity theft. I emphasize that we have no evidence that personal information has been misused.

The information stored on the affected database includes names and Social Security numbers, dates of birth, home addresses and contact information. It does not include driver's license numbers or credit card or banking information.

Only designated users whose jobs require working with the restricted data are given passwords to access this database. However, an unauthorized person exploited a previously undetected software flaw and fraudulently accessed the database between October 2005 and November 2006. When UCLA discovered this activity on Nov. 21, 2006, computer security staff immediately blocked all access to Social Security numbers and began an emergency investigation. While UCLA currently utilizes sophisticated information security measures to protect this database, several measures that were already under way have been accelerated.

In addition, UCLA has notified the FBI, which is conducting its own investigation. We began notifying those individuals in the affected database as soon as possible after determining that personal data was accessed and after we retrieved individual contact information.

As a precaution, I recommend that you place a fraud alert on your consumer credit file. By doing so, you let creditors know to watch for unusual or suspicious activity, such as someone attempting to open a new credit card account in your name. You may also wish to consider placing a security freeze on your accounts by writing to the credit bureaus. A security freeze means that your credit history cannot be seen by potential creditors, insurance companies or employers doing background checks unless you give consent. For details on how to take these steps, please visit http://www.identityalert.ucla.edu/what_you_can_do. htm.

Extensive information on steps to protect against personal identity theft and fraud are on the Web site of the California Office of Privacy Protection, a division of the state Department of Consumer Affairs, http://www.privacy.ca.gov.

Information also is available on a Web site we have established, http://www.identityalert.ucla.edu. The site includes additional information on this situation, further suggestions for monitoring your credit and links to state and federal resources. If you have questions about this incident and its implications, you may call our toll-free number, (877) 533-8082.

Please be aware that dishonest people falsely identifying themselves as UCLA representatives might contact you and offer assistance. I want to assure you that UCLA will not contact you by phone, e-mail or any other method to ask you for personal information. I strongly urge you not to rel

One way to help protect...

[s31523]

When I was in a U.S. college, albeit a long time ago i.e. before Patriot Act and 9/11, I had the choide to use a random number as my student ID rather than my social security number. I remember hearing that the soc. security number is(was? pre 9/11) only required for social security and tax purposes. I think more places should start using other numbers. Although this wouldn't solve hacked identity theft, it is one less piece of information that the hackers get...

Re:One way to help protect...

[denebian devil]

When I was in a U.S. college, albeit a long time ago i.e. before Patriot Act and 9/11, I had the choide to use a random number as my student ID rather than my social security number. I remember hearing that the soc. security number is(was? pre 9/11) only required for social security and tax purposes. I think more places should start using other numbers. Although this wouldn't solve hacked identity theft, it is one less piece of information that the hackers get... Except that would just mean that when the hackers get their spreadsheet full of information on 800,000 people, they just have to remember to look to the "SSN" column instead of the "Student ID" column to get the information they want. The school will still collect your SSN whether they use it as your ID or not. The question merely becomes whether it is your SSN or some randomly generated number that they put on your ID card.

Re:One way to help protect...

[s31523]

I actually refused to give my social security number to the school (again this was pre 9/11 and Patriot Act) because when I asked why they needed it they said for administrative purposes only. After my unwillingness to give it up they said, "well sir, we can assign you a generic ID number, but that will be really hard to remember and most students choose their soc. number because they can remember it. Are you sure you want to do this?". So, in my case the soc. sec. column had a generic number (which was 11 digits, instead of 9).

Re:wow!

[atrizzah]

My name was on the list. Hooray!

I was just about to submit this story myself. Here's UCLA's official website devoted to the whole incident: Link

I wonder, will there be a point in time when we hold accountable either the credit agencies for their broken system or organizations we are forced to trust with our data for not keeping it safe?

Santa Claus says "security? ho ho ho!"

[Toby The Economist]

Security is hard to get right because you have to get *everything* right.

Make one mistake and you've got no security.

As such, it is problematic to have vast databases of highly valuable information protected by "security".

The result will be a constant flow of database violations.

Unfortunately, by and large, the a database provides a large and ongoing bureaucratic benefit to an organisation, whereas the pain of data loss is primarily born by the people described by the database.

The only response we have as individuals is to keep our details as secret as possible.

Good Target

[GreggBz]

I imagine a University is the type of organization that kind of flies under the radar. Banks, hospitals, credit card companies, these are obvious repositories of personal information. UCLA, not so much. Factor that in with a large, old, complex computer network with volumes of historical data (Those of you that graduated 20 years ago can probably still get your transcript) and you are bound to have quite a bit of low hanging fruit.

It's time to make the SSN database public

[MightyYar]

If the SSN database were public, the SSN would cease to become such a valuable target for identity thieves - systems would have to be changed to account for the public nature of the information. The SSN is fine as a unique identifier, but it should never have become a security tool.

Re:It's time to make the SSN database public

[Chanc_Gorkon]

The SSN was never to be used as a identifier. PERIOD. It was only to be used for the Social Security System. It was banks and credit bureaus who made the SSN a identifier. The issue that the banks and credit bureaus confronted so many years ago was that they needed a unique way of identifying you for purposes of granting credit. The SSN was the only option as it was desgined from the get go to give you a unique number. Even now though, older SSN's are being reissued as people die off. The problem now is that the number is shown being used by a dead person.

Unfortunately, there's no easy answer. SSN's already in use as an id and until something else better comes along, we have to use it. So what should we in IT do? First, reduce easy access to the number. When designing systems, issue a id that is unique and ONLY works with your system. If you need a way of identifying people in the real world, file the SSN and then reduce access to it. Only let the people who need that number have access to it. In the case of colleges, only financial aid and possibly select people records and registration need to see it. Everyone else MUST use the institution specific id.

The big issue for some higher ed systems is that they used some unsecure methods for far too long. One system in particular up until about 2-3 years ago was using telnet in their client! It was not even SSL'd!

Re:It's time to make the SSN database public

[Politburo]

Even now though, older SSN's are being reissued as people die off.

Myth. SSA site (link may not work due to silly session cookies)

We do not reassign a Social Security number (SSN) after the number holder's death. Even though we have issued over 420 million SSNs so far, and we assign about 5 and one-half million new numbers a year, the current numbering system will provide us with enough new numbers for several generations into the future with no changes in the numbering system.

Re:It's time to make the SSN database public

[swillden]

Personally, I wouldn't mind seeing fingerprints, DNA or Retina Scan based systems.

If you think getting your compromised social security number changed is hard, you should see what it takes to change your retinas. Or DNA...

Biometrics are useful security tools, but you have to keep in mind that they are only passwords. They're convenient passwords, in that you can't forget them (though you *can* lose them!), and they're fairly high-entropy passwords as well, making them hard to guess. However, they're unchangeable passwords, and you leave copies of your fingerprints and DNA pretty well everywhere you go.

Because of all of these problems, biometrics should only be used in two scenarios:

• Low-security situations where convenience is at a premium. While biometric scanners can be fooled, it's not trivial to fool them, so if the value of whatever is protected by the security isn't very high, then biometrics are adequate from a security perspective, and have great convenience characteristics. They're especially useful in circumstances where the most likely alternative is no security at all. Note that there are some gradations within this category, based on whether the biometric is being used for identification, authentication, or both. If both, then either the population had better be very small, or the security requirement very, very weak, because the birthday problem is going to be a major issue.
• Very high security situations where the scanning station is attended by a trained, watchful guard tasked with assuring that scans are done properly and/or multiple authentication factors are used, such as a password, smart card or other physical token *and* a biometric scan (or two!).

The sort of high-volume, medium-security authentication required for most financial transactions is not a good application for biometrics. Granted that biometrics would increase the security if added to the current set of varied and generally weak mechanisms used, but if biometric authentication were actually deployed, it would almost certainly be used to *replace* the current mechanisms, not augment them. That wouldn't help and would probably hurt. Further, the application of biometrics would delay the application of better security, raise lots of privacy concerns, etc. It's not a good idea, sorry.

Re:It's time to make the SSN database public

[Vreejack]

The military has used SSN's as a service number almost from the outset, and we actually used to use ours in our mailing addresses. It made delivering mail to highly mobile service members a lot easier. This practice was discouraged in the late 1980's, but as late as the late 1990's the list of US military officers and their SSN's was annually published by congress.

Although the original legislation for SSN's states that it is not meant to be a sort of national identification number, this seems mainly aimed at evangelical Christians who identified such a thing with some passages from the Revelation of John. It wasn't until the communist and fascist regimes of Stalin and Hitler demonstrated the possibility of total control that secular fears of Big Brother began to surface.

The reality of the SSN is that--being as it is a guaranteed unique name--it is extremely useful as an ID. But using it as a password is absolutely asinine. The sad truth is that criminals are more likely to know a victim's social security number than the victim is.

Students?

[Lord_Dweomer]

What sort of options do the students have at this point? Is the school in any way liable? Or is this just going to be one of those instances where they say "oops, we were hacked, so sorry but nothing we can do" and leave the students screwed (once again)?

All I know is that the school better not be heavily promoting its computer security courses.

Re:Students?

[LouisJBouchard]

No one has the right to sue unless an actual crime against the student took place. My SSN was possible stolen from a new employee state database recently (used to determine if someone owes child support they are skipping out on) and the attitude was that since the information was not used yet, we were on our own to protect ourselves. The police even refused to take a report because as far as they were concerned, the only victim was the state agency (never mind the cost and effort I had to go through to protect my current accounts and verify that someone has/is not using my information to commit a crime).

I think that once places that hold information are held responsible (even if it is to pay for credit monitoring for 2 years for anyone whose information could have been stolen), then we will see a real concern about security. Right now, all anyone has to pay for is postage to notify a person and time to investigate. In this case for example, if UCLA had to pay for credit monitoring for 800,000 people for 2 years (at about $100/year/person), I am sure $160,000,000 would force them to make sure this does not happen again. Otherwise, we will hear more stories of this type.

The scary thing..

[bigattichouse]

Isn't what people get out of such a breach, but what can be PUT IN.
ohh.. look at Johnny's sparkly new Ph.d. or M.D.

at first glance

[clamantis]

At first glance, I thought the headline read ACLU. Now that would have stirred up a hornets' nest!

Re:E-mail sent to UCLA students, faculty, and staf

[lawpoop]

"I regret having to inform you that your name is in the database."

He regrets having to inform us, not that they were hacked.

As an alumnus...

[Otter]

...I'm willing to cut them a lot of slack since the USC game. So let's call this one a wash. Go Bruins!

Re:wow!

[voice_of_all_reason]

I wonder, will there be a point in time when we hold accountable either the credit agencies for their broken system or organizations we are forced to trust with our data for not keeping it safe? Sure. But it's up to you. Here's a handy guide for redressing your grievances: http://en.wikipedia.org/wiki/Storming_of_the_Basti lle

Re:Santa Claus says "security? ho ho ho!"

[canuck57]

Security is hard to get right because you have to get *everything* right.

You are assuming rational due diligence was in fact even attempted. These are institutions run by politicians.

Make one mistake and you've got no security.

Not if you have really done your homework. You NEVER rely on one system. When the second system catches a violation, you promptly deal with it.

One has to ask, why did it take so long to notice? Think about all the others that are not even watching?

Computer security is all about priorities, it isn't even technical. It is social/political.

Assume your SSN is public knowledge. The root cause of this issue is those that use SSN numbers f''k peoples lives up after they didn't verify it was being used correctly in the first place. The fundamental problem he is financial institutions are not making sure they deal with the correct person before handing over money.

Want to solve identity theft? Simple, put 100% of the onus on those that use it to make sure they are dealing with the right person when they use it. Make it a criminal offense with hefty fines and penalties for non-compliance. Make it cost ineffective for big credit to mess up. Because in reality, identity theft is a credit company issue. After a few dozen $10 million dollar settlements for incorrectly assigned $1000 collections the credit agencies will get the message.

since, from

[minus_273]

"The data may have been available to hackers since October 2005 until November 21, 2006,"

Am I the only one who cringes when he reads this sentence.

Re:wow!

[ObsessiveMathsFreak]

800,000 people are going to be pissed as shit

Correction.

11 people are going to be pissed as shit.
34 people are going to panic.
72 people are going to wonder if the story is relevant to them.
284 people aren't going to realise the story is relevant to them.

799599 people affected aren't even going to hear about this, let alone care.

There is a silent majority. It's silent because its too apathetic to speak.

Maybe actual fraud will end up fixing this?

[King_TJ]

Despite all of these large, high-profile security breaches of late, you don't hear a whole lot about people who actually became victims of fraud right afterwards. I'm sure it's happening, but it seems to be in the "best interest" of practically everyone EXCEPT the consumers owning the info to sweep it under the rug. (EG. "No problem sir! Just mail back the form we send you, detailing all the charges you didn't actually make on your VISA, and we'll take care of it. A new card is on its way out to you right away.")

You'd think that at some point, just about everyone in the U.S. will need to put "fraud alerts" on their credit profiles!

As bad as it sounds, I think it's going to take real financial losses of an almost unmanageable sort for the lenders and credit agencies to say "Enough!" and find new ways to protect consumer info.

Re:E-mail sent to UCLA students, faculty, and staf

[thePowerOfGrayskull]

"I regret having to inform you that your name is in the database."

He regrets having to inform us, not that they were hacked. For that matter, he doesn't even regret that your name was in the database -- only that he has to tell you about it.

Re:wow!

[pilgrim23]

There is only one possible way to protect yourselves these days: Lie. If someone needs your info, or SAYS they need your info ("I am sorry sir but our regulations clearly state you must fill out this form") then lie, fib, tell an untruth! For years I have always typoed a number or two on my SSN on forms, mis-spelled my name, screwed up the address, etc. I never commit outright fraud, but I DO use tecnhiques that will screw up their database. If more of us just smiled shrugged and said "oh well" to these data leeches in this simple manner, the problem would go away due to the general unreliability of the database,

Re:E-mail sent to UCLA students, faculty, and staf

[Beryllium Sphere(tm)]

Yes, should be the default, but you can't even get a security freeze unless you live in a state that forces the credit bureaus to do it. California is one.

It should be illegal to treat the SSN as proof of identity anyway. What kind of password has the following properties?
o Less than a billion possible values
o Part of it based on your place of birth
o You're required to disclose it to dozens or hundreds of places
o Any credit-granting company can order a report and look at it
o It never changes

pwned (tagging beta)

[Dan Slotman]

pwned (tagging beta)

This represents everything wrong with slashdot. On the other hand, I'm still here...

Re:This says it all - The rest of the story (tm)

[DenDude]

Yeah, the server that you mention may be 2003, but all of the other servers on netcraft show linux/apache. http://toolbar.netcraft.com/site_report?url=http:/ /www.ucla.edu

Incompetent Academics

[toddhisattva]

Incompetent Academics
Always Blaming Hackers
To Cover Their Asses!

Their hotline database is offline

[rbanzai]

I went to UCLA in the 80s/90s and have called twice this morning and both times their hotline database was offline. Of course they say "uh, I think... yeah, the database is being updated, please call back in 10-15 minutes..." but when I worked at a call center "database is being updated" = "BROKEN!"