Some IPFW students exposed through malware
Technorati Tag: Security Breach
Date Reported:
11/16/07
Organization:
Indiana University-Purdue University Fort Wayne (IPFW)
Contractor/Consultant/Branch:
None
Victims:
Certain current and former "mostly international" students
Number Affected:
32
Types of Data:
Names and Social Security numbers (and Individual Taxpayer Identification numbers)
Breach Description:
IPFW announced that personal information pertaining to certain current and former students may have been accessed through an unauthorized installation of unspecified malicious software. This breach primarily affects international students of the school.
Reference URL:
Purdue University Official Announcement
News Channel 15, WANE.com Story
The Journal Gazette News Story
Report Credit:
News Channel 15, WANE.com
Response:
From the sources cited above:
A security breach affecting a computer at Indiana University-Purdue University Fort Wayne was a small one, but school officials called it one too many
The university announced Friday that personal information of 32 people, mostly current or past international students, might have been accessed after “an unknown intruder” installed software on a university computer.
An internal audit of a former staff member's on-campus computer revealed the presence of malware, including an e-mail-stealing "Trojan horse" that was installed through an e-mail attachment.
[Comfyllama] Most "Trojan horse" programs are easily detected by most current anti-virus programs. Many Trojan horse programs have pretty easily identifiable characteristics. I question whether this system had current protection installed. Kudos to school officials for conducting internal audits and responding to this incident well.
The security breach is the first known one in more than nine years that Kostrubanic has been with IPFW, but one is too many, he said.
[Comfyllama] The first "known" one sure, but most probably not the first one. I agree with Mr. Kostrubanic that one is too many. Mr. Kostrubanic is the current Director of Information Technology Services and CIO for Indiana - Purdue University Fort Wayne (IPFW)
Social Security numbers and Individual Taxpayer Identification numbers might have been among the vulnerable information, said Kostrubanic, who could not specify what university department housed the affected workstation.
"The individual kind of went against our practices and stored some information in a spread sheet on their local hard drive," said Michael Kanning, IPFW Information Technology Division.
[Comfyllama] Are these "practices" put into writing via a policy or procedure, and how often are they communicated and enforced?
IPFW has sent letters to the individuals whose information might have been accessed.
If students don’t receive a notice but would like to be sure their information was not involved, they can call 1-, a statement from Purdue University said.
The computer workstation was removed from the system and the software disabled, according to the university, which said there is no evidence the accessed information has been used for illegal purposes.
Social Security numbers were used routinely for identification in the years before identity theft became a concern, and Purdue and other universities have discontinued the use of the numbers except when required by law, the statement said.
[Comfyllama] An excellent best practice. Hopefully there are additional protections in place around the use that is required by law.
More information about the incident also is available online at www.purdue.edu/news/ipfw0711.html.
If you find suspicious activity on your credit reports or have reason to believe your information is being misused, file a complaint with the FTC at www.consumer.gov/idtheft or at 1-877-ID-THEFT (438-4338).
Student Reactions:
"It's a little bit scary that there stuff has been stolen," said student Chelsea Dougal.
"I'll be sure to be more cautious in what I'm doing, and make sure it's something that's actual, and not some sort of scam," said Dougal.
"It's through IPFW's network, so I think they can limit what people can do, I think... I hope," said IPFW student Casey Bowman.
"I trust that most of the systems pick-up things, and I would probably continue to do what I'm doing," said IPFW student Jermaine Porter.
Commentary:
Think for second about the information you store on your computer. Most, if not all of us have things that we store that we wouldn't want shared with the rest of the world, let alone those who are determined to defraud. How much of this information do we really need to store on our computer, or is there a better way?
It is not possible to complete guarantee that data is safe, but there are best practices for protecting important information against malware. Seven tips that will help you:
1. Install and maintain sound anti-virus software
2. Install and maintain sound anti-spyware software
3. Use a personal firewall and learn how it works
4. Pay attention to things that seem abnormal, and investigate.
5. Don't let others use your computer
6. Use a business computer for business and a "fun" computer for personal stuff like games, chat, etc.
7. Seek experienced help if you aren't sure of something.
There are plenty more, but this well get you started.
Past Breaches:
Unknown
Date Reported:11/16/07
Organization:
Indiana University-Purdue University Fort Wayne (IPFW)
Contractor/Consultant/Branch:
None
Victims:
Certain current and former "mostly international" students
Number Affected:
32
Types of Data:
Names and Social Security numbers (and Individual Taxpayer Identification numbers)
Breach Description:
IPFW announced that personal information pertaining to certain current and former students may have been accessed through an unauthorized installation of unspecified malicious software. This breach primarily affects international students of the school.
Reference URL:
Purdue University Official Announcement
News Channel 15, WANE.com Story
The Journal Gazette News Story
Report Credit:
News Channel 15, WANE.com
Response:
From the sources cited above:
A security breach affecting a computer at Indiana University-Purdue University Fort Wayne was a small one, but school officials called it one too many
The university announced Friday that personal information of 32 people, mostly current or past international students, might have been accessed after “an unknown intruder” installed software on a university computer.
An internal audit of a former staff member's on-campus computer revealed the presence of malware, including an e-mail-stealing "Trojan horse" that was installed through an e-mail attachment.
[Comfyllama] Most "Trojan horse" programs are easily detected by most current anti-virus programs. Many Trojan horse programs have pretty easily identifiable characteristics. I question whether this system had current protection installed. Kudos to school officials for conducting internal audits and responding to this incident well.
The security breach is the first known one in more than nine years that Kostrubanic has been with IPFW, but one is too many, he said.
[Comfyllama] The first "known" one sure, but most probably not the first one. I agree with Mr. Kostrubanic that one is too many. Mr. Kostrubanic is the current Director of Information Technology Services and CIO for Indiana - Purdue University Fort Wayne (IPFW)
Social Security numbers and Individual Taxpayer Identification numbers might have been among the vulnerable information, said Kostrubanic, who could not specify what university department housed the affected workstation.
"The individual kind of went against our practices and stored some information in a spread sheet on their local hard drive," said Michael Kanning, IPFW Information Technology Division.
[Comfyllama] Are these "practices" put into writing via a policy or procedure, and how often are they communicated and enforced?
IPFW has sent letters to the individuals whose information might have been accessed.
If students don’t receive a notice but would like to be sure their information was not involved, they can call 1-, a statement from Purdue University said.
The computer workstation was removed from the system and the software disabled, according to the university, which said there is no evidence the accessed information has been used for illegal purposes.
Social Security numbers were used routinely for identification in the years before identity theft became a concern, and Purdue and other universities have discontinued the use of the numbers except when required by law, the statement said.
[Comfyllama] An excellent best practice. Hopefully there are additional protections in place around the use that is required by law.
More information about the incident also is available online at www.purdue.edu/news/ipfw0711.html.
If you find suspicious activity on your credit reports or have reason to believe your information is being misused, file a complaint with the FTC at www.consumer.gov/idtheft or at 1-877-ID-THEFT (438-4338).
Student Reactions:
"It's a little bit scary that there stuff has been stolen," said student Chelsea Dougal.
"I'll be sure to be more cautious in what I'm doing, and make sure it's something that's actual, and not some sort of scam," said Dougal.
"It's through IPFW's network, so I think they can limit what people can do, I think... I hope," said IPFW student Casey Bowman.
"I trust that most of the systems pick-up things, and I would probably continue to do what I'm doing," said IPFW student Jermaine Porter.
Commentary:
Think for second about the information you store on your computer. Most, if not all of us have things that we store that we wouldn't want shared with the rest of the world, let alone those who are determined to defraud. How much of this information do we really need to store on our computer, or is there a better way?
It is not possible to complete guarantee that data is safe, but there are best practices for protecting important information against malware. Seven tips that will help you:
1. Install and maintain sound anti-virus software
2. Install and maintain sound anti-spyware software
3. Use a personal firewall and learn how it works
4. Pay attention to things that seem abnormal, and investigate.
5. Don't let others use your computer
6. Use a business computer for business and a "fun" computer for personal stuff like games, chat, etc.
7. Seek experienced help if you aren't sure of something.
There are plenty more, but this well get you started.
Past Breaches:
Unknown
Posted by Evan Francen at 11/29/2007 1:19 PM 
Categories: Intrusion, Indiana University-Purdue University Fort Wayne
Categories: Intrusion, Indiana University-Purdue University Fort Wayne
Posts Atom 1.0
Comments