A disabled firewall and an unapplied patch allowed hackers to infiltrate a server at the University of Colorado, Boulder, exposing the personal information of nearly 45,000 students, the university said Tuesday.
Attackers exploited a Symantec Norton AntiVirus vulnerability to launch a worm into the server of the College of Arts and Sciences’ Academic Advising Center, the university said in a statement. The suspects made off with the names and Social Security numbers of 44,998 students enrolled at the college since 2002. The university discovered the attack on May 12.
"The server’s security settings were not properly configured and its sensitive data had not been fully protected," Bobby Schnabel, the school’s vice provost for technology, said in the statement. "Through a combination of human and technical errors, these personal data were exposed, although we have no evidence that they were extracted."
Schnabel told SCMagazine.com today that he blamed the event on the fact that the compromised server was overseen by a smaller IT staff "with more general sets of responsibilities" than the university's central IT department.
"Sometimes you don’t get the attention to security you get in a big, central organization," he said.
IT officials believe the attackers were not trying to purge sensitive information, but instead gain control of the machine for use as a botnet. Had the firewall been enabled, the worm would have been stopped, Schnabel told SC.
Chandler Hall, vice president of marketing and a co-founder of network security firm Arxceo, told SCMagazine.com today that the college should have had a network-layered defense to stop both signature-based and zero-day attacks.
"I think bottom line — there’s always going to be a human factor," he said. "I would never point a finger at a large LAN environment and say that it was poor practice."
As a result of the incident, the college is ordering the IT operations at the Arts and Sciences Advising Center to come under the control of the central IT department at the university, Schnabel said.
In addition, the college has instituted a plan to stop using Social Security numbers as identifiers, according to the statement.
Technology-wise, the university plans to implement new host-based intrusion detection (HIDS) software, which monitors systems for suspicious activity. Last fall, the school deployed a "restrictive network firewall" that has helped cut down on vulnerabilities.
The university also conducts a security awareness program, in addition to conducting regular risk assessments.
Symantec, in an email statement sent to SCMagazine Wednesday night, said it was reaching out to the university to get more information on the incident. The company recommends regularly applying vendor patches as a way to protect against system threats.
Click here to email reporter Dan Kaplan.
Get more IT security news. Click here for SC Magazine Blogs.
