A university in Montréal, Québec discovered keylogger devices on computer workstations used by students in university libraries.
The affected computers were express workstations in two Concordia's Webster and Vanier libraries.
University officials reported the incident to local authorities and are increasing security in the areas where public computers terminals are located, according to Concordia University's media relations director Christine Mota.
In speaking with SCMagazine.com, Mota said physical keylogger devices were found on “a few” of the university's standing workstations. The more common attack method, keylogger malware, was not used. The university said its security network was not affected.
Mota said the university cannot disclose specific numbers because a criminal investigation with the Montréal police is ongoing. “We did a visual inspection of all of our computers on both universities, and these were the only devices that were found,” she told SCMagazine.com.
The affected express workstations were available to university students, staff, retired faculty, and alumni for up to 10 minutes. Montréal universities have an agreement in which university students attending any university in the city can use the libraries at any other university. As a result, students at any Montréal university may have been affected.
The university reached out to the student, faculty, and local population with a university notice on Monday and and contacted university students whose information was discovered on the keylogger devices the following day.
Higher education institutions have increasingly been targeted by hackers. Last year, Harvard University, Pennsylvania State University, and University of Connecticut were all affected by cyber incidents. Rutgers University was affected by numerous attacks within a year, even after spending between $2 million to $3 million to bolster its cybersecurity capabilities and raising tuition to cover the additional expenses.
A security researcher published details last year demonstrating an exploit that allowed remote attackers to bypass a school computer monitoring software.
A report published last September examined the cyber preparedness of six industries and rated higher education as the lowest performing industry. The BitSight Insights report cited BYOD networks and multiple access points as causes for the poor preparedness of many colleges and universities.
