UT Austin Hit By Massive Security Breach 557
mrpuffypants writes "Reported in the Austin-American Statesman: The University of Texas' security was compromised over the weekend, leaking out nearly 60,000 records on students, staff, and faculty. Official word from the school can be found here. Most troubling of all is that, like most schools, UT still uses SSNs for student ID numbers, and that was part of the information taken from them in the attack."
All they got... (Score:5, Funny)
Phew, I feel so much better now!
Re:All they got... (Score:5, Insightful)
What's the big panic about SSNs? (Score:4, Informative)
Why are Americans so paranoid about who knows their SSN?
Re:What's the big panic about SSNs? (Score:3, Funny)
Why are Americans so paranoid about who knows their SSN?
Because it's a lawless and uncivilized colony filled with criminals who will steal your identity to get a free meal at Ponderosa without a twinge of guilt.
Re:What's the big panic about SSNs? (Score:2, Insightful)
Re:What's the big panic about SSNs? (Score:5, Insightful)
It's like security through the obscurity of these numbers.
Re:What's the big panic about SSNs? (Score:5, Insightful)
2. It's an antiquated system. Back in the day, before massive amounts of information were available on computer, you'd occasionally hear about a guy who's number was stolen. It's a bad thing, but it was a rarity. The system worked because your number was secret, and there were few real ways to get it.
These days, SSN's are being compromised by thousands at a time. This is a broken system, and it should be fixed.
Perhaps thumbprints or retinal scans as a system of identification. But if you think about it, this leaves us with the same problem. The retinal or thumb image needs to be kept somewhere for the purposes of comparison. The files can be stolen just as easily as SSN's.
Maybe there is no solution.
crypto is a solution (Score:5, Insightful)
There's a solution if you use cryptography. Assign everybody a social security number. Also, give them a private key (or better, let them pick their own). Then, publish everyone's social security numbers and the public keys that match up with their private keys. (The government could even provide a service that allows people to look up public keys based on social security number.)
Then, everyone's number is out in the open. Whenever you want to do something with it, you create a message along the lines of this:
Then you sign that message with your private key. Once you've done that, anyone can use your public key to verify the signature. That means they can be assured that, unless someone has stolen your private key or broken the crypto, it could only have been you that wrote that message.
Thus, your social security number becomes public knowledge, but that doesn't help anybody because they'd need your private key to do anything with it. And, most importantly, there never is any situation where you have to give your private key to anyone. Your secret remains your own. No third-party ever gets a copy of it. This is important for two reasons:
Re:crypto is a solution (Score:4, Insightful)
Re:crypto is a solution (Score:3, Insightful)
Most people aren't going to want to remember their password. What happens if someone looses their private key (misplaced, corrupt data...there are a ton of things that could go wrong.) It's hard enough for people to keep track of paper; much less a disk/USB keyring thing/whatever the private key would be on. Much less keep it safe from being stolen.
Just a few thoughts. Users are pretty clueless; you'll either end up with "password" or a post-it note with the password written down taped on their monitors, stuck in their wallets, or under the keyboard. And people will be afraid of loosing/breaking their private key and leave it at home; making an additional thing to remember when going for that new car, new job, bank transation...
That said, a private key system would be great because figuring out someone's SSN is amazingly easy, I'm sure. Many universities and colleges use them for student numbers, account logins (well, part of it anyway)...all I'd need to do is pay attention in line while picking up some financial aid papers, or paycheck, or registering for classes, or registering to graduate...the list goes on much longer than I'd like.
Oh, yeah; what you said about third parties not having much incentive to keep it a secret is slightly wrong. My university doesn't care who finds it out. I'm tagged by my SSN no matter what I do (see a few examples above); it's printed on my paycheck and I'm required to write it on pretty much anything I send them. And I'm sure most universities are worse. Ugh!
Biometrics are bad m'kay? (Score:3, Informative)
Then there was the amusing experiment where a bunch of Germans managed to fool retina scanners using printed images of eyes that could be taken at a reasonable distance with a camera.
Xix.
Re:What's the big panic about SSNs? (Score:3, Interesting)
Precisely. The problem isn't that people can find out your SSN. It's that far too many people think that SSNs are somehow a secret authentication key that only you could possess.
If you walked up to any organization and said, "Hi, I'm CmdrTaco, gimme the keys to Fort Knox", they'd ask for some ID. They don't take knowledge of a name as proof of ID. Yet far too many people will accept the one that walks up and say "Hi, I'm 123-45-6789, gimme the keys to Fort Knox". An SSN is just like a name. It's not a digital signature.
Note that the fuss a lot of people make over insisting their SSNs be "secure" actually makes the problem worse, not better. Increasing the obscurity slightly doesn't improve the technical security. But it does tend to make people sloppy and overconfident, and leads them to rely on the obscurity of the number as a substitute for authentication. The reason we have a problem in the first place is all those people that mistakenly believe that SSNs are somehow secure in the first place.
We'd be better off if you were _required_ to use SSN as your student ID, and drivers license ID, frequent shopper card ID, whatever. Plaster it all over the place, and make sure that everyone realizes the number is every bit as public as your name, and thus of no more value for proving an identity. Agitating for "privacy of SSNs" is counter-productive.
Re:What's the big panic about SSNs? (Score:4, Insightful)
Why are Americans so paranoid about who knows their SSN?
Because I can use your SSN to apply for a credit card in your name and then, when the bill comes due, it falls on your head (until you explain that that wasn't actually you). Then I can do it again.
Re:What's the big panic about SSNs? (Score:3, Insightful)
Djeez. No wonder you all need a homeland security office and ultraparanoid officials everywhere, if the underlying 'security' mechanisms are SO easy to break.
It may surprise some of you but in the rest of the world you actually need to show some real identity document, like a passport or drivers license, to get anyone to actually trust your identity.
Maybe something to implement in the next, say, 20 years in the great USA ?
Yeah. This sounds like a flame. So sue me. Another thing US residents seem to be really good at
Re:What's the big panic about SSNs? (Score:3, Funny)
One problem is that, by and large, a change in the way 'The System' works is, to Americans, an admission of defeat. But the US of A never loses at anything because it is the best. I mean, if a conversion to metric was ever implemented, the terrorists will have won!
Re:What's the big panic about SSNs? (Score:4, Informative)
In Germany, the post offers a service called postident [deutschepost.de] - the mail carrier will only give you the letter if you show him your passport, and he'll send the passport number back to the sender of the letter.
The system is in place for years, afaik it's the only way to open accounts at internet only banks. No need for a magic SSN.
Re:What's the big panic about SSNs? (Score:3, Insightful)
That's funny. Those ten or so credit card applications I get in the mail each week say nothing about coming to see them IN PERSON.
Re:What's the big panic about SSNs? (Score:4, Informative)
From that I can only assume that you live in the US ? Which, I guess, just proves my point that it is a system just waiting to be abused.
Never mind what those spams may say, in Europe you cannot get a bankaccount without applying in person. I guess there may be CC companies that are so eager to close that they trust me without proof. But I reckon that even those will send letters to your address that you have to return to them, signed. Which does prove at least two things to them: (A) you have physical access to the mailbox/streetaddress you supplied, and (B) they have your signature on paper, which can be useful to prove you signed it (and if need be, all the way though handwriting recognition experts).
In any case, that is better than nothing.
Why there hasn't been any reform on SSNs (Score:4, Interesting)
Every effort to reduce the power of credit bureaus and protect individual privacy has been defeated or weakened by the credit bureaus and credit issuing companies. Their claim is that a central database tied to everyone's SSN is critical to doing business. Of course, they neglect to mention that they do plenty of business outside of the US without having such a system in place, AND the fact that SSNs are not guaranteed to be unique.
At this point, reasonable souls would start to question whether this is a government for the people, by the people, or a government for big business, buy the politicians! Face it, it won't be until the system is completely broken, with millions of people affected, and with the costs of keeping the current way of doing business too high to continue, that they'll change. By then, it'll be too damn late...
Re:What's the big panic about SSNs? (Score:3, Informative)
This surprises me as well, and I am from Canada. I have actually never applied for a credit card in person. I've done it by internet and by mail. Sometimes you have to pick it up at the bank branch, other times it comes in the mail to your home.
I actually work in the Credit Card division (VISA or Mastercard, but I won't tell you which ;-) of one of North America's 10 largest banks and I can tell you that this 'not in person' system DOES have its problems. Fraud is the curent biggest monetary loss for the bank. I won't post some of the methods the crooks use to take advantage of this mail and internet system (because I don't want to help budding fraudsters,) but it is truly nefarious. Fraud of credit cards is actually incredibly easy in Canada and the US, and it's going to get worse before it gets better. One big problem is that you don't need a PIN for the cc's and it is very rare that a merchant actually looks at the signature on the card. You could sign any old name and get away with it.
Now in Canada the system with SIN (social insurance numbers) is better than the US because by law, they can only be used for purposes related to paying taxes to the government. My SIN number is only used when starting a new job, opening a bank account that earns taxable interest, applying to university, paying taxes, and that's about it.
Re:What's the big panic about SSNs? (Score:3, Interesting)
Re:What's the big panic about SSNs? (Score:3, Funny)
Hmm.
Well, depending on the resolution with which you record "birthdate" (days? minutes? seconds?) one could probably just about prove that the combination of name and birthdate is already unique, regardless of the SSN.
Unless maybe when your name is real common.
Come to think of it, names should maybe be deprecated altogether. Just record the time of birth, and the GPS coordinates thereof. ;-) ;-)
Provably unique, and names are confusing anyhow.
Or else, we can design a domain name system for that too; A network of central servers that can facilitate a name lookup. Just input GPS and date/time and it tells you the name of the subject !
I wish I had known... (Score:3, Funny)
Changing GPA (Score:2, Insightful)
This does mean a spam has a few thousand live accounts of young (read: target audence) college students (read: active email users).
That is bad in more ways that one.
robi
Action (Score:5, Interesting)
Re:Action (Score:4, Insightful)
As I undertsand, the SSN isn't even a *good* unique identifier - for one thing it has no built-in checksum, and it's possible that your number isn't unique (could be wrong on the latter, but it's not really my point..)
Just issuing consecutive numbers to students who enrol is just one extremely simple way to replace using SSNs.
My bank issues me a number that identifies my account, my mobile phone company gives me a number to identify my phone, why is it so hard for unis to issue numbers to identify students?
Why were the unis in Washington so unhappy with the change? Sure, a few thousand people need to be given numbers and that can take a while to physically issue - but if the law allowed, perhaps a phased implementation of the scheme, so new people are given one of the new numbers?
Re:Action (Score:3, Informative)
Anyone born in the last 15 years has often had an SSN assigned shortly after birth. Previously, it was typically issued when you opened your first bank account, or when you took your first job.
So that, combined with a person's age (or reasonable approximation) has a strong correlation for checking validity.
If you see a 45-year-old male with a brooklyn accent showing up with an SSN that was issued five years ago in Oregon, it would raise an eyebrow or two.
Back to this breakin.. It's time to treat data repositories like banks: Regulate them, and refer anyone who even tries to break into one to www.bop.gov for a nice long visit.
Re:Action (Score:3, Informative)
Re:Action (Score:3, Informative)
Re:Action (Score:3, Informative)
1) The purposes of reporting individual tax information (such as wages and salaries).
2) The payment and qualification for social security benefits.
Alot of people do not believe the above, because they have gotten used to it and have accepted that people will use their SSN for means of unique identification number. It's great for database developers to just use your social security number as your customer ID. Because we know that SSN's are unique. Example, if you go to a hospital, what do you think your ID is? Now, you have the absolute, 100% right to refuse to give ANYONE your social security number. (Aside for the above reasons) In the above example, the hostipals will probably insist. But they most definately treat non-americans (either visiting the US or here on a Visa). These people do not have SSN's. The SSN's have become a defacto National ID card only because people have let it become so. That being said, your social security number is NOT a national ID card system, although it is being used like one whether we like it or not.
Re:Action (Score:3, Insightful)
In Massachusetts, it is also illegal to use a student's social security number as identificaion.
So instead, they label it a "Student ID Number" and remove the dashes before they print it on the card. Somehow, that makes it legal.
And in this same world, I can go to jail for backing up my DVDs. Excuse me while I puke all over my keyboard.
I used to go to UT Austin (Score:3, Informative)
Re:I used to go to UT Austin (Score:3, Informative)
As for student notification, go to the bottom of the UT article; The last section is headed "How will affected individuals be notified?" and gives an e-mail address.
Re:I used to go to UT Austin (Score:4, Informative)
Am I Affected?
Is your SSN in the following ranges?
449-31-98xx - 450-91-24xx
451-12-32xx - 451-20-35xx
451-20-64xx - 452-20-40xx
If so, within these ranges, 55,200 people of the following types, including but not limited to:
Current students, faculty and staff
Former students, faculty and staff
Job applicants
Retirees
may be affected.
Illegal? (Score:2)
Re:Illegal? (Score:3, Informative)
Re:Illegal? (Score:2, Interesting)
Re:Illegal? (Score:3, Interesting)
Re:Illegal? (Score:3, Interesting)
(I don't remember the exact text)
How much force that warning has is debatable. Certainly, any individual student can protest "You've got no right to see my SSN!". When this happens, he typically gets bounced around a few offices until someone responds "Ok, just make up a random number and lets get on with it"
Re:Illegal? (Score:3, Informative)
Lets see. (pulls out wallet and get SSN card)
Nothing on the front but my name, SSN, my signature and the Social Security logo.
On the back I have this:
plus the SSA form number.
Nope, don't see anything telling me not to share this number....
Kent
Re:Illegal? (Score:3, Insightful)
apply for a car loan.....tell them they have no right to see your SSN.....get rejected....
go to the DMV apply for a DL...tell them they have no right to see your SSN.....get rejected....
see the pattern?
Slightly OT - choice of credentials (Score:5, Interesting)
But why are SSNs so sensitive? It's like a credit card number -- it's printed some places, gets bandied about in others. Not exactly confidential, and no intuitive or documented boundaries on who should be trusted to with it. So it's a scary number that can be used for bad things, but you'll have to give it out in many circumstances where you aren't fully aware of how it'll be used. Makes it tricky to know who has it, or to make an informed decision about where you use it.
Again, it's easy to see how the practice of using it as a credential has continued (and got worse), but when did it start?
Re:Slightly OT - choice of credentials (Score:4, Informative)
Who would have thunk it?
Re:Google your SSN (Score:3, Interesting)
They took it down about 3 months later....
Re:Google your SSN (Score:3, Funny)
muahahahaaa....
Re:Slightly OT - choice of credentials (Score:5, Informative)
A bigger problem is that everyone assumes SSNs are unique. They aren't. At best they can only uniquely identify 1 billion people. "Easy," you say, "There aren't 1 billion people in the United States." There were 281 million in 2000. The birth rate is 14.5 per 1000, and the death rate is 8.7 per 1000. While the birth rate is declining, the life expectancy of a person is lengthening. Additionally, it can not be expected that the birth rate will continue to decline to 0. This means that, while it won't happen any time soon, eventually there will be more than 1 billing people in the US.
The next problem is that when you die, your SSN is NOT REUSED until your estate is closed, at a minimum. My mother's estate was not closed for nearly two YEARS after her death, and hers was a simple estate. Some accounting setups could cause you SSN to be used for many years after your death.
Re:Slightly OT - choice of credentials (Score:5, Insightful)
If someone is using a driver's license acquired in your name with your social security number, they could very well build up a criminal record in your name in some other state. A routine traffic stop could then lead to you getting arrested.
With that in mind, if someone asks you what yours is, the first thing that comes out of your mouth should not be that number. It should be "I don't think you need to know that information." Note that in the historical past (I don't know if this is still true) if you knew someone's name and birth date, you could use an Internet information service to find out their social security number and criminal history.
Re:Slightly OT - choice of credentials (Score:2)
Are the stolen records ever used? (Score:5, Interesting)
Re:Are the stolen records ever used? (Score:3, Informative)
No offense.
One Copy? (Score:2, Interesting)
But nothing says that these cracker(s) are smart. Possibly just lucky.
robi
Who needs to hack, just work for a university (Score:5, Interesting)
Re:Who needs to hack, just work for a university (Score:2, Funny)
But I would prefer that to having my identity stolen and have horrible credit, depending on the girls.
from what Ive seen (Score:3, Interesting)
Its a very scary.. but what can you do..
Penalties (Score:5, Interesting)
Not to adapt a blame-the-victim mindset, but I mean really, why is this stuff on an internet-connected machine to begin with? I work in health care, and with HIPAA coming into effect, we've been moving a substantial part of our network off the internet -- if there's no physical connection, we can't get hacked.
This stuff needs to be taken seriously, and not just in punishing the offenders. Look at it this way: If your bank got robbed tomorrow and all the items in your safe deposit box were made off with, would you blame the bank if you found out that the vault was left open and the deposit boxes were made of cardboard? I sure would.
Re:Penalties (Score:4, Informative)
Re:Penalties (Score:3, Insightful)
Am I the only one who thinks that there should be penalties for the hack-ee when private information is stolen?
I would imagine that under such a system, no organization would ever admit to being cracked since they would be financially liable. And having some third-party prove that the organization was cracked without access to the computer records would be quite a feat.
GMD
Re:Penalties (Score:3, Insightful)
There is already a penalty of sorts- any corporation victimized in this way will get a big overtime bill from their IT department as it patches the holes and audits the damage. They also claim to lose revenue for the period the systems were offline.
Look at the huge dollar amounts of "damage" that companies quote when they suffer a "hacker attack". Those are big losses- it must be some kind of punishment.
Now, one might say that amount of punishment isn't a sufficient deterrent against poor security, because corporations so far haven't invested enough in prevention.
Are there approaches the government could take to increase the magnitude of that punishment? Yes, two ways:
Clarification? (Score:5, Insightful)
On another note, UT is phasing out SSN in many aspects of the students life. My wifes UT ID does not contain her ssn, it has a student # now. Though I assume that there are still many points of interface with the UT system that expects to see ssn.
Yikes... (Score:3, Interesting)
Colleges and Universities need to fix systems! (Score:3, Interesting)
At least the University is acting responsibly... (Score:5, Interesting)
It is good to see the University being so frank and honest about this matter. I am sure some heads are gonna roll, but at least the people affected will be provided with information and know how it happened.
Speaking of how it happened... the article does not go into technical details, but I am curious how this database was accessible to the world and was spitting out data to qualifying queries of SSNs without any security context... I am sure someone here on
Re:At least the University is acting responsibly.. (Score:3, Interesting)
Then someone just wrote a script to brute force the SSN range it seems from the 2nd link
Re:At least the University is acting responsibly.. (Score:4, Funny)
Unfortunately the literal translation of this is:
I am so fired!
The bigger breach . . . (Score:3, Funny)
We demand that our child State of Texas cease and decist in the molestation of our look and feel.
Sincerely,
Volunteer Graduate of 1994
PS, The UTK English Department is the Home of the Vowels [harbrace.com]
Hey, here's an idea (Score:3, Interesting)
Apart from that all of the credit reporting, etc. goes through shadow companies that you can do nothing to if they screw you over (IE issue a credit card to a you that's not you).
We need to make using an SSN for identification purposes entirely illegal, credit card companies and banks be damned. Or say it is a National ID and come up with a better way of securing identities.
at least some are getting smarter (Score:5, Interesting)
Dear Students:
The following three bulleted topics are of student interest:
* Social Security Number is removed from WildCARD ID
With complaints about identity theft nearly doubled last year as the fast-growing crime topped the government's list of consumer frauds for the third consecutive year, WildCARD offices on the Evanston and Chicago campuses have started issuing new WildCARD identifications without social security numbers.
The re-designed WildCARDS are being issued at no charge to faculty, staff and students who wish to exchange their existing card for one minus a social security number printed on the front. Those without a card to exchange because it was lost or stolen will be
charged a $15 replacement fee.
"The new purple WildCARD looks the same as the old one, but as opposed to printing the person's social security number that used to be their Northwestern "id" number, we have implemented a shortened "emplid" number which the University is issuing that has no association whatsoever with one's social security number," said Arthur Monge, manager of WildCARD and Vending.
"We are not mandating that WildCARD holders be issued a new card, but the option is available for anyone who feels concerned about having the social security number visible on their existing card. It is a matter of personal choice to replace their existing card for one with an "emplid" number, at no charge, unless they have lost their card or it has been stolen." Since switching to a new WildCARD is optional, it can be done at one's leisure. Existing WildCARDS will continue to work, so if someone doesn't feel the need to have one without a social security number immediately, they can continue using their existing card until it expires.
Northwestern University's multi-purpose, one-card program, WildCARD, was developed nine years ago to provide better identification for members of the University community and to simplify use of existing services, control access, reduce handling of cash, and enhance security. Students, faculty, staff, spouses and domestic partners of active, full-time faculty or staff, authorized contractors working within the University community, Research Park tenants, and individuals affiliated with a University department are all eligible for a WildCARD. For more information, call Art Monge (847) 467-3135 or check the WildCARD Web site at:
http://www.univsvcs.northwestern.edu/WildCar
* New vending machine refund bank locations
If you didn't already know it, there are vending machine refund banks located throughout both campuses. A complete list can be found on the WildCARD & Vending web site at:
http://www.univsvcs.northwestern.edu/WildCar
New locations include the Family Institute at 618 Library Pl (front desk), Lake Shore Center at 850 N. Lake Shore Drive (front desk) and at Wieboldt Hall, 339 E. Chicago (Administrative office, 2nd fl). One is also planned for Galter Library in the near future.
Each vending machine should have a sticker on it that indicates the nearest refund bank. If one is missing, please inform the Evanston Wildcard Office at 7-6843.
* Other tidbits of information:
--The Abbott Hall ATM now sells stamps
--A Pepsi vending machine promotion is taking place now. Pepsi is giving away 80 Willie the Wildcat bobble head dolls. Look for a sticker on your next Pepsi purchase.
SSN as ID number (Score:3, Insightful)
But nothing wakes up a university -- especially a state school -- like the threat of litigation. If the cracker followed up and committed full-scale identity theft, the students would have grounds for a lawsuit against the school. Consider the recent New Hampshire lawsuit [slashdot.org] that dealt with SSNs and other personal information. With the potential for bloodthirsty lawyers, universities might finally get serious about protecting their students' information.
Bush's daughter (Score:3, Interesting)
Could this possibly be related?
Re:Bush's daughter (Score:2, Funny)
OOPS!!! (Score:2)
Re:OOPS!!! (Score:2)
It's not the IT department.. it's the provost (Score:5, Informative)
Re:It's not the IT department.. it's the provost (Score:3, Interesting)
I will say this in defense of the IT people there... its gotta be pretty fucking hard to lock down a system that has almost 70,000 users (between students, faculty, staff, alumni, etc).
SS as ID is INSANE!!! (Score:2)
Re:SS as ID is INSANE!!! (Score:3, Informative)
A common misconception. Federal agencies are now somewhat restricted in how they use it (5 U.S.C. Sec. 552A) and some states have laws about it in certain circumstances, but one the whole there's nothing illegal about it.
Some Googling:
http://www.cpsr.org/cpsr/privacy/ssn/ssn.faq.html# IsItIllegalToAsk
p loyalert0205.asp
http://www.lawcommerce.com/newsletters/art_OHS_em
http://www.usdoj.gov/foia/privstat.htm
I'm sure intrepid Googlers out there could find more.
SSN's? Big deal. (Score:3, Interesting)
Big deal. If anyone wants to know my ssn, it's "336721433".
SSN's are public information.
Already fixed (Score:4, Funny)
They probably just copied over the DB containing the University's security procedures.
`Recapturing'? (Score:5, Insightful)
UT says:
Someone is more than a little bit confused about the nature of digital storage if they think they can `recapture the stolen data'.
`Ah, cool, we've managed to delete the copy they made of our data.'
(whispers)
`Another copy? How many copies did they steal?'
Isn't there a law?? (Score:2, Informative)
I know that many institutions and businesses use it (SSN) that way, but isn't it against the law? Or did I misinterpret the statement from the bank?
Re:Isn't there a law?? (Score:5, Informative)
Private businesses can request your SSN if they want... you don't have to give it though. But if you don't, they don't have to give you whatever you're looking for either :)
However, UT is a public school and is subject to the restrictions on government agencies... here's [uncg.edu] a page with some info on the use of SSNs in public schools.
Anyways, as a former UT Austin student, I'd be annoyed if my SSN was one of the ones that got out... and if so, I wonder how UT plans on contacting me--as far as I know, they don't have my current address, phone number, or any other type of contact info. As a side note, the first year I was there (1988), a lot of professors posted exam grades outside the classroom indexed by SSN... I guess someone put a stop to that :)
What the? (Score:2, Insightful)
Hold on, why were UT's internal data reporting systems hooked up to the internet? I thought sensitive information like this was only exchanged over secure intranet and stored in systems with no access to public networks?
SSN's are used too much (Score:3, Interesting)
StarTux
SSN at UT (Score:5, Informative)
For many years, UT had a non-centralized IT infrastructure. That is, the Colleges did one thing, the Administrative Computing Group did another thing, the Academic Computing Group did yet another thing, and the Libraries something else entirely. This was recently changed with the introduction of a new Office of Information Technology head by a new Vice Provost (Dan Updegrove, originally at Yale). One of the very first things I heard him address was the Social Security number problem in which every student, faculty, and staff member used their SSN as their ID. That practice had to change in order to meet both legal and privacy standards (see FERPA [cpsr.org]) , and UT has been trying for the past couple of years to make that happen. The trouble is, it was so integrated into all of the different services and departments that it is a slow process to remove it. They started to phase it out, but now UT is seeing the effects of this particular practice. I'm likely one of the ones who will be affected, so I'm waiting for them to announce where people can find that out. (It may be at the UT site, http://www.utexas.edu/datatheft/ [utexas.edu].
The Daily Texan (student newspaper) has an article about the theft [dailytexanonline.com], as does the Houston Chronicle [chron.com].)
By the way, your Social Security Number isn't public information. It is required for use by some agencies of the government, but you are not required to provide your SSN to private groups unless they need to interact with certain government agencies (this includes your employers, who deal with the IRS). That being said, SSNs are so commonly used a search may pull up that information- but that doesn't mean it is legally public info.
last semester for SSN identification (Score:3, Informative)
Honey pot (Score:3, Insightful)
When will those admin idiots learn? (Score:3, Funny)
This is really sickening. A lot of schools still use SSN as student IDs. In State University of New York, until very recently, your SSN was used on your grad reports, your dorm phone bills, your administrative notices, and teachers even insisted that this SSN/Student ID should be written at the top of every homework. Old phone bills with your name, date of birth, address and SSN were often found in classrooms or on the floor.
When I approached a SUNY teacher about this potential ID theft problem (back in 1999), his answer was: "I've been doing this for 20 years and I've never heard of this problem". Shocking, astonishing conclusion: The American academia is clueless! Oh no! How can that be! (But hey, it explains so much.)
It took a few ruined students and an order from the Attorney General (IIRC) for stopping NY schools from using SSNs as student IDs.
I am not really surprised that some administrative cretins are still camping on their position after all the theft ID problems of the last few years. After all, Schools Are Clueless.
I would like to entertain the hope that a few of these moronic school administrations would be sued 'till they bleed by ruined students, but how could ruined students afford this kind of legal costs?
Now wait a DAMNED MINUTE!! (Score:4, Funny)
That information wasn't leaked, it was FREED!
User logon names as SSNs (Score:4, Interesting)
(Extra credit props points to anyone who can name the system that I am talking about... Hint, this was late 70s to early 80s)
Learn about fraud alerts (Score:3, Informative)
http://www.fightidentitytheft.com/flag.html
and if the drawbacks don't sound too bad (think carefully!) make the calls. It takes about a half hour. Much less than the time you'll spend untangling the mess of an identity theft. You may also consider calling your bank and creditors to ask them to put similar holds on your contact info so that some clever scammer doesn't have your statements forwarded to Timbuktu, thus gaining them extra time to run amok and causing you even more grief. This isn't paranoia talking, it's experience.
Here are the numbers.
Credit Bureau Fraud Departments
TransUnion
Fraud Victim Assistance Department
Phone: 800-680-7289
Equifax
Consumer Fraud Division
Phone: 800-525-6285 or: 404-885-8000
Experian
Experian's National Consumer Assistance
Phone: 888-397-3742
Part of the problem is ... (Score:5, Insightful)
Aside from the fact that the custodian of the information certainly has a lot to blame in this, there is another big part of the problem. That problem is what people can actually do with the information.
An SSN is identity. It is nothing more than that. The problem is people make the incorrect assumption that it is authenticity (I can recite the number, or read it off a little card in my wallet, so it must be me), and authority (this account has your SSN and is overdrawn, so you are liable for it).
If any law change is needed, it is a law change that says that it is illegal for an SSN to be accepted for any purpose other than identity. What that means is that if I walk into a bank and open an account citing some SSN, the bank needs to understand that all this does is identify someone, and not necessarily me. If the bank causes harm to the real owner of the SSN by having provided any derogatory credit information based on that SSN, then the bank shall be fully liable for having not taking reasonable measures to ensure accuracy of information. And by that, what I mean is that the bank can't simply say that the victim needs to track down the perpetrator to cover the costs. The banks need to be forced to properly authenticate the information they use, especially when and where it might be used in a negative way.
And I don't mean to pick on banks (I just happen to have an open case with Chase Manhattan bank which continues to allow someone to operate a credit card account with my SSN, reported on my credit reports, without my consent, and after I have advised them of the fraud). Such a law should apply to anyone and everyone who accepts and uses SSN data for anything. It's the negative things that can be done (like bad credit info) that needs to be stopped (in addition to other stupidities like running computers insecurely and connecting systems to the internet that have no business being there).
Am I Affected? (Score:3, Informative)
* 449-31-98xx - 450-91-24xx
* 451-12-32xx - 451-20-35xx
* 451-20-64xx - 452-20-40xx
If so, within these ranges, 55,200 people of the following types, including but not limited to:
* Current students, faculty and staff
* Former students, faculty and staff
* Job applicants
* Retirees
may be affected.
Princeton's security breach ... (Score:3, Informative)
http://www.ispep.cx/files/tucson.princeton.edu.tx
Mod this up as Informative...
UT dishonest about source of attack (Score:3, Interesting)
A click on the travel.fp3 file listed a couple hundred SSNs. It was completely wide open.
UT made it sound like a deliberate attack, but it looks to me more like administrative incompetence (and cya).
Perspectives from one of UT's sister universities (Score:3, Informative)
The administration's response was "Come Summer 2005, when we have our new Student Information System, we won't use anyone's SSN" but that in the meantime, we're screwed because they weren't going to change anything.
A month ago I discovered the 'secure' portion of the Housing department's website had been indexed by Google, including the ID # (Social Security Number) of all 1200+ residents living in the on-campus dorms. This highlighted the need for the immediate cessation of collecting and storing SSN's, so I've introduced a follow-up resolution our Student Congress is looking to pass soon basically demanding each department document every way they use SSN's and the security measures in place to protect them, after which we want a committee of students and faculty to go through the documentation and approve or deny their use and storage of the SSN's.
Our school paper, The Shorthorn (www.theshorthorn.com [theshorthorn.com]) is supposed to do a story in tomorrow's (Friday's) issue concerning the leak at UT-Austin and the fact that administrators so far at UT-Arlington are ignoring the need to provide secyrity for SSN's NOW, and not just in 2005.
It should be interesting to see if the administration has finally 'seen the light' and will listen to us, this time.
Salon gets it right (Score:5, Insightful)
I thought the Slashdot community would appreciate Salon getting the terminology right on this one. It may seem like a silly point to some, but the distinction between "cracker" and "hacker" is huge in my mind, and it always makes me happy to see a journalistic outlet get it right, for a change.
Re:What is SSN? (Score:4, Informative)
Re:As a recent graduate... (Score:4, Informative)
You can't (not to say that you shouldn't make it more difficult, but just don't fool yourself into thinking that it's possible to do absoultely). It's like your house or car, you can take steps to make it more difficult to break in/steal, but there is absolutely nothing you can do to stop someone is wants to target YOU. So the best thing to do is to introduce a bit of paranoia in your life and assume therefore that it COULD happen and adjust accordingly. So for you're indentity, you do regular checks of your credit report, you keeps tabs on your bank accounts, you review your credit card statements, etc. The absolute worse thing that can happen is for someone to grab your identity and use it for a length of time without your knowledge. Getting your cc company to forgive unauthorized purchases is easy, as long as you do it within 30 days of your statement. Having someone apply for a cc with your info can bite you in the butt if you're trying to buy that car or get that mortgage, so you make sure you check well in advance and make sure that window of exposure is a small as possible.
Re:As a recent graduate... (Score:3, Informative)
- Experian [experian.com]
- Equifax [equifax.com]
- Trans Union [transunion.com]
Review who is looking at your credit report, and report suspicious activity to them. Having seen a few personal credit reports of people who were using their personal credit to establish a business line of credit, I've seen statements on them like: "Don't issue any credit to this person before contacting me at 111-222-3333".Re:As a recent graduate... (Score:3, Informative)