Slashdot Mirror
In Survey of American Universities, MIT Scores Worst In Cybersecurity
An anonymous reader writes: In a cybersecurity survey of 485 large colleges and universities, the Massachusetts Institute of Technology came in at the bottom of the list. In a report released today, SecurityScorecard analyzed the educational institutions based on web application security, network security, endpoint security, IP reputation, patching, and other security indicators. That might not seem intuitive, but according to the linked article, it's not purely mistaken. Some of that low ranking can be chalked up to things like intentional security holes created in the course of researching vulnerabilities, but some of it comes from "exposed passwords, old legacy systems, and a bunch of administrative subdomains that seem to have been forgotten about," as well as pockets of malware.
I bet a place like MIT just has many times the IT systems of most other places, and they didn't take that into account. Not reading the actual TFA because it requires me to register or something dumb like that.
Their whole network's just a honeypot, as Aaron Swartz found out.
Does MIT have more honeypots?
This reminds me of what Wikipedia's page about Richard Stallman says:
Can anyone shed any light on if that actually happened as described at Wikipedia?
It was common knowledge that rms's password on mit-mc was rms. I think a lot of people learned macsyma by using rms's account.
maybe that disappeared a long time ago.
but there used to be a pervasive attitude that computers were tools that everyone should have access to.
and maybe having to justify every open port to some career paranoid who feels personally responsible
for judging the moral character of every bit on the network is contrary to the spirit of free investigation that a place like
MIT is trying to foster
just a thought
The difference is that when their shit breaks, they can fix it.
That's because MIT is trying to prepare students for the corporate environment. It's job training, really.
You are welcome on my lawn.
..they are so brilliant that they can just simply work around the impact of any kind of attack. Duh.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
As an MIT alum, I'm gratified that the postings here didn't turn into a giant attack on MIT. Heaven knows the place is far from perfect, but I did get an outstanding education that stood me well in the course of a long career.
Although this is purely anecdotal, some people I talked to tell me this. There's a lot of freedom at MIT (and there always has been), and the emphasis is on breakthrough creativity. So for the most part security issues, strict rules, locking things down, etc., all take a back seat.
But there are a few systems--- just a few--- that are highly protected and known in the culture to be strictly off-limits. Have we heard of major data breaches and MIT student data being stolen on a large scale? I haven't. I suspect it's because the emphasis is on security in those few places where it really matters.
Can someone who is currently at MIT comment on this? As I said, this is anecdotal and could be dated and/or inaccurate.
It's more of a sales pitch than a report. They make you give them an email address and then only give you meaningless highlights and the results in vaguely explained categories for the top 10 schools.
MIT is a massive honeypot. ;)
It gives attackers and security researchers a false sense of accomplishment.
Just like alpha centauri and the university of the planet. -2 to probe team actions due to academic networks.
I'm not surprised. I attended MIT last decade, and the computing experience was dismal. I was there before MIT's own horribly written Scheme implementation was finally abandoned.
Basically, some nerds there created Project Athena, which morphed into MIT's own half-baked Debian derivative that nobody cared to keep up-to-date. The computer labs were dark, dingy, and ancient; I felt like I had to take a long hot shower after using them.
However, the printer paper and printers were basically free, and it was damn fun to set up your buddy's account to spam the rest of the lab users with Zephyr messages whenever he logged in...
Look, you are going to attract the people who will bring back doors with them. They try out all sorts of stuff that then gets defunded, or the guy leaves and doesn't clean up. The thing is, when they find a new problem, they have they guys there to figure it out too. I would bet the actual systems (financial and acemdemic) are tighter than fort nox. But, it is an engineers playground, So everything is covered in beer and Mtn Dew.
I currently go to MIT. Pretty much every computer connected by ethernet is given its own public facing IP address with no firewalling whatsoever. As a consequence, at least in my department, nearly every single office computer is set up with SSH access. Not everyone here is an IT expert, so a large majority of these computers aren't well defended.
The cluster I do work on has at one point been used as a spam relay. No one noticed until IT started sending us complaints. I've heard that around 2-3 student systems get hacked a year in my department, and we're one of the smaller ones.
If you know what the hell you're doing, and you have the time to do it, it's a nice system. Probably only 1 in 50 qualify for that though.
or was it gnu.ai.mit.edu?
you know, the box rms liked to let anyone login to to run crack...
"could have happened on it's own."
it's means it is.
" murder 3000 of its citizens "
There, that wasn't so hard, was it?
They have a history of encouraging hacking, leaving weak systems at home is just a way to do so. Too bad they are not protecting their hackers anymore.
I am guessing the nature of MIT lends itself to having lots of odd and end networks around. I would hope whomever runs the segment that contains administration is at least securing their network (student data, financial data, financial transactions, grading, etc.).
When applying for grad school their official application system did not and would not allow one to use encryption. They ask for your personal information including social security number. The only point where any encryption took place in the browser is when they handed you off to another service to pay the application fee with your credit card.