Information Security News
mailing list archives
Hackers break into computers at IU again
From: InfoSec News <isn () c4i org>
Date: Wed, 13 Jun 2001 00:45:51 -0500 (CDT)
By George Stuteville
June 12, 2001
BLOOMINGTON, Ind. -- Fears that computer hackers may have peeked at
sensitive student information sent Indiana University officials to the
post office to mail about 1,900 letters of apology Monday.
Along with its regrets, the university also said it would pay the
costs of up to three credit reports for anyone whose files may have
been accessed by the hackers.
The electronic break-in occurred late last month in School of Music
computers that serve as host to an Internet Web site displaying
information for prospective students.
That Web site also collects information -- including Social Security
numbers -- from those students for recruitment purposes.
All but about 200 of the 1,900 who responded to the Web site supplied
Social Security numbers, addresses, names and other data.
Data thieves could use that information to get into bank or credit
accounts or to create false identities, said Mark S. Bruhn, IU vice
president for information technology.
Bruhn said it appears their aim was to use the computer as a secret
"safe haven" for an instant e-mail communication system.
The hackers probably broke through the computer's "firewall" around
May 23-25, causing some disruptions in the process.
While troubleshooting those problems, IU technicians on June 4 found
the weak spot in the computer software that had allowed the hackers
access. The computer was immediately disconnected.
The next day, Bruhn said, IU technicians discovered certain files and
programs left by the hackers.
The hackers had deleted evidence that would have allowed them to be
traced, he added.
It was also impossible to know whether any personal information
actually had been taken.
Gwyn Richards, dean of the School of Music, said prospective students
no longer would be asked for their Social Security numbers. It always
has been optional, he said.
The use of Social Security numbers will be ended throughout the
university by 2003.
Earlier this year, a Swedish hacker downloaded the names and Social
Security numbers of about 3,100 Indiana University students.
ISN is hosted by SecurityFocus.com
To unsubscribe email isn-unsubscribe () SecurityFocus com
- Hackers break into computers at IU again InfoSec News (Jun 13)