Forgot your password?
typodupeerror
Privacy

UT Austin Hit By Massive Security Breach 557

Posted by timothy
from the wonder-if-they-got-mine dept.
mrpuffypants writes "Reported in the Austin-American Statesman: The University of Texas' security was compromised over the weekend, leaking out nearly 60,000 records on students, staff, and faculty. Official word from the school can be found here. Most troubling of all is that, like most schools, UT still uses SSNs for student ID numbers, and that was part of the information taken from them in the attack."
This discussion has been archived. No new comments can be posted.

UT Austin Hit By Massive Security Breach

Comments Filter:
  • by FirstManOnMoon (613282) on Thursday March 06, 2003 @02:15PM (#5450560)
    "Those SSNs that matched selected individuals in a UT database were captured, together with e-mail address, title, department name, department address, department phone number, and names/dates of employee training programs attended. It is important to note that no student grade or academic records, or personal health or insurance information was disclosed."

    Phew, I feel so much better now!
    • Re:All they got... (Score:5, Insightful)

      by stoolpigeon (454276) <bittercode@gmail> on Thursday March 06, 2003 @02:20PM (#5450621) Homepage Journal
      They'll get the rest later using the SSN. That and a name are often all you need. Who cares about grades- when they know who you are and have your social you are screwed.
      • by Gordonjcp (186804) on Thursday March 06, 2003 @02:24PM (#5450671) Homepage
        Seriously. In the UK the closest equivalent is a National Insurance number, which you give out to quite a few people. Banks often want this (because it's unique to you, which makes record-keeping easier). Your employer will want it, so their accountants can calculate your tax. Your doctor will probably want it, again, because it's a unique identifier.

        Why are Americans so paranoid about who knows their SSN?
        • by Anonymous Coward

          Why are Americans so paranoid about who knows their SSN?

          Because it's a lawless and uncivilized colony filled with criminals who will steal your identity to get a free meal at Ponderosa without a twinge of guilt.
        • Because EVERYTHING is tied to it. Should someone get a hold of your SSN they can get a credit card in your name, or whatever.
          • by joebp (528430) on Thursday March 06, 2003 @02:36PM (#5450814) Homepage
            Should someone get a hold of your SSN they can get a credit card in your name, or whatever.
            I think I see where the problem lies.

            It's like security through the obscurity of these numbers.
            • by wideBlueSkies (618979) on Thursday March 06, 2003 @03:04PM (#5451121) Journal
              1. Please mod the parent as insightful. (Or even funny). This is the best description of the problem I've ever heard.

              2. It's an antiquated system. Back in the day, before massive amounts of information were available on computer, you'd occasionally hear about a guy who's number was stolen. It's a bad thing, but it was a rarity. The system worked because your number was secret, and there were few real ways to get it.

              These days, SSN's are being compromised by thousands at a time. This is a broken system, and it should be fixed.

              Perhaps thumbprints or retinal scans as a system of identification. But if you think about it, this leaves us with the same problem. The retinal or thumb image needs to be kept somewhere for the purposes of comparison. The files can be stolen just as easily as SSN's.

              Maybe there is no solution.
              • by Anonymous Coward on Thursday March 06, 2003 @04:28PM (#5451975)

                There's a solution if you use cryptography. Assign everybody a social security number. Also, give them a private key (or better, let them pick their own). Then, publish everyone's social security numbers and the public keys that match up with their private keys. (The government could even provide a service that allows people to look up public keys based on social security number.)

                Then, everyone's number is out in the open. Whenever you want to do something with it, you create a message along the lines of this:

                My name is John Doe, and my social security number is 987-65-4321. I hereby authorize CreditCards-R-Us to issue me a credit card linked with my social security number.

                Then you sign that message with your private key. Once you've done that, anyone can use your public key to verify the signature. That means they can be assured that, unless someone has stolen your private key or broken the crypto, it could only have been you that wrote that message.

                Thus, your social security number becomes public knowledge, but that doesn't help anybody because they'd need your private key to do anything with it. And, most importantly, there never is any situation where you have to give your private key to anyone. Your secret remains your own. No third-party ever gets a copy of it. This is important for two reasons:

                1. Third-party institutions don't have much incentive to guard your secret well. Many of them will do their due diligence in guarding it, but the bottom line is that it's just not their ass on the line, so they won't try really hard. Even if they mean well, they're a busy corporation or university or whatever, and they have other things to get done.
                2. If you are forced to give out your secret to get anything done (for example, register for classes), over time lots and lots of organizations will get (and store) a copy of it. This is bad, because the probability that information will get stolen is pretty close to proportional to the number of people who have a copy of it!
                • by Drakonian (518722) on Thursday March 06, 2003 @06:46PM (#5453437) Homepage
                  Yeah, until they look under your keyboard and see the sticky with your private key. The weakest link in security is often the human.
                • Dang -- typed up a huge reply and lost it. Since I'm too tired to re-type the whole thing; here's my summary:

                  Most people aren't going to want to remember their password. What happens if someone looses their private key (misplaced, corrupt data...there are a ton of things that could go wrong.) It's hard enough for people to keep track of paper; much less a disk/USB keyring thing/whatever the private key would be on. Much less keep it safe from being stolen.

                  Just a few thoughts. Users are pretty clueless; you'll either end up with "password" or a post-it note with the password written down taped on their monitors, stuck in their wallets, or under the keyboard. And people will be afraid of loosing/breaking their private key and leave it at home; making an additional thing to remember when going for that new car, new job, bank transation...

                  That said, a private key system would be great because figuring out someone's SSN is amazingly easy, I'm sure. Many universities and colleges use them for student numbers, account logins (well, part of it anyway)...all I'd need to do is pay attention in line while picking up some financial aid papers, or paycheck, or registering for classes, or registering to graduate...the list goes on much longer than I'd like.

                  Oh, yeah; what you said about third parties not having much incentive to keep it a secret is slightly wrong. My university doesn't care who finds it out. I'm tagged by my SSN no matter what I do (see a few examples above); it's printed on my paycheck and I'm required to write it on pretty much anything I send them. And I'm sure most universities are worse. Ugh!
              • by xixax (44677)
                While biometrics might be OK as part of a comprehensive security system, they do have problems all of their own, for a start, you can't isue someone with a new thumb [counterpane.com] if the system gets compromised. (say if I manage o get a silicon cast of your thumb).

                Then there was the amusing experiment where a bunch of Germans managed to fool retina scanners using printed images of eyes that could be taken at a reasonable distance with a camera.

                Xix.

            • by Anonymous Coward

              Precisely. The problem isn't that people can find out your SSN. It's that far too many people think that SSNs are somehow a secret authentication key that only you could possess.

              If you walked up to any organization and said, "Hi, I'm CmdrTaco, gimme the keys to Fort Knox", they'd ask for some ID. They don't take knowledge of a name as proof of ID. Yet far too many people will accept the one that walks up and say "Hi, I'm 123-45-6789, gimme the keys to Fort Knox". An SSN is just like a name. It's not a digital signature.

              Note that the fuss a lot of people make over insisting their SSNs be "secure" actually makes the problem worse, not better. Increasing the obscurity slightly doesn't improve the technical security. But it does tend to make people sloppy and overconfident, and leads them to rely on the obscurity of the number as a substitute for authentication. The reason we have a problem in the first place is all those people that mistakenly believe that SSNs are somehow secure in the first place.

              We'd be better off if you were _required_ to use SSN as your student ID, and drivers license ID, frequent shopper card ID, whatever. Plaster it all over the place, and make sure that everyone realizes the number is every bit as public as your name, and thus of no more value for proving an identity. Agitating for "privacy of SSNs" is counter-productive.

        • by Fulcrum of Evil (560260) on Thursday March 06, 2003 @02:29PM (#5450743)

          Why are Americans so paranoid about who knows their SSN?

          Because I can use your SSN to apply for a credit card in your name and then, when the bill comes due, it falls on your head (until you explain that that wasn't actually you). Then I can do it again.

          • Hm. So I need only your name and your SSN ??

            Djeez. No wonder you all need a homeland security office and ultraparanoid officials everywhere, if the underlying 'security' mechanisms are SO easy to break.

            It may surprise some of you but in the rest of the world you actually need to show some real identity document, like a passport or drivers license, to get anyone to actually trust your identity.

            Maybe something to implement in the next, say, 20 years in the great USA ?

            Yeah. This sounds like a flame. So sue me. Another thing US residents seem to be really good at ;-)
            • "It may surprise some of you but in the rest of the world you actually need to show some real identity document, like a passport or drivers license, to get anyone to actually trust your identity."

              One problem is that, by and large, a change in the way 'The System' works is, to Americans, an admission of defeat. But the US of A never loses at anything because it is the best. I mean, if a conversion to metric was ever implemented, the terrorists will have won!

  • by Patrick13 (223909) on Thursday March 06, 2003 @02:15PM (#5450564) Homepage Journal
    I wish I had known about it, I would have asked them to change my transcripts to give me a better GPA. :P
    • Changing GPA (Score:2, Insightful)

      by robi2106 (464558)
      Reading the article (as I am sure everyone already has), would tell you that the informatio nwas not tied in to any student grades. Two different systems / databases.

      This does mean a spam has a few thousand live accounts of young (read: target audence) college students (read: active email users).

      That is bad in more ways that one.

      robi
  • Action (Score:5, Interesting)

    by StingRayGun (611541) <ryanrray@@@gmail...com> on Thursday March 06, 2003 @02:15PM (#5450565)
    What legal action may the students and faculty take? In Washington it is illegal to use a students SSN to identify students. There was groaning at every campus in Washington for weeks. I bet there as glad as me that Washington was so on top of this.
    • Re:Action (Score:4, Insightful)

      by Gossy (130782) on Thursday March 06, 2003 @02:44PM (#5450899)
      Why is it such a hassle for Unis to generate their own unique IDs for students?

      As I undertsand, the SSN isn't even a *good* unique identifier - for one thing it has no built-in checksum, and it's possible that your number isn't unique (could be wrong on the latter, but it's not really my point..)

      Just issuing consecutive numbers to students who enrol is just one extremely simple way to replace using SSNs.

      My bank issues me a number that identifies my account, my mobile phone company gives me a number to identify my phone, why is it so hard for unis to issue numbers to identify students?

      Why were the unis in Washington so unhappy with the change? Sure, a few thousand people need to be given numbers and that can take a while to physically issue - but if the law allowed, perhaps a phased implementation of the scheme, so new people are given one of the new numbers?
      • Re:Action (Score:3, Informative)

        by mr. methane (593577)
        There are some "validations" in the SSN. One of them makes it easy to spot a "number picked at random", and the other, which you do need a lookup table for, tells you when the number was issued and in what area of the country it was issued.

        Anyone born in the last 15 years has often had an SSN assigned shortly after birth. Previously, it was typically issued when you opened your first bank account, or when you took your first job.

        So that, combined with a person's age (or reasonable approximation) has a strong correlation for checking validity.

        If you see a 45-year-old male with a brooklyn accent showing up with an SSN that was issued five years ago in Oregon, it would raise an eyebrow or two.

        Back to this breakin.. It's time to treat data repositories like banks: Regulate them, and refer anyone who even tries to break into one to www.bop.gov for a nice long visit.
    • Re:Action (Score:3, Informative)

      by Orne (144925)
      Maybe the ACLU could give them some pointers [foxnews.com] about what to do...
    • Re:Action (Score:3, Informative)

      by cdrudge (68377)
      Is it illegal to use the number for identification or is it illegal to require the number for identification. I know that the college I attended, they would use your SSN if you provided it, but they would assign another SID if you asked them to without penalty. On financial aid information though, your SSN is required.
    • Re:Action (Score:3, Informative)

      by sjlutz (540312)
      Actually, it is illegal for anyone to ask for you social security number except for:
      1) The purposes of reporting individual tax information (such as wages and salaries).
      2) The payment and qualification for social security benefits.
      Alot of people do not believe the above, because they have gotten used to it and have accepted that people will use their SSN for means of unique identification number. It's great for database developers to just use your social security number as your customer ID. Because we know that SSN's are unique. Example, if you go to a hospital, what do you think your ID is? Now, you have the absolute, 100% right to refuse to give ANYONE your social security number. (Aside for the above reasons) In the above example, the hostipals will probably insist. But they most definately treat non-americans (either visiting the US or here on a Visa). These people do not have SSN's. The SSN's have become a defacto National ID card only because people have let it become so. That being said, your social security number is NOT a national ID card system, although it is being used like one whether we like it or not.
    • Re:Action (Score:3, Insightful)

      by Tokerat (150341)

      In Massachusetts, it is also illegal to use a student's social security number as identificaion.
      So instead, they label it a "Student ID Number" and remove the dashes before they print it on the card. Somehow, that makes it legal.

      And in this same world, I can go to jail for backing up my DVDs. Excuse me while I puke all over my keyboard.
  • by JJAnon (180699) on Thursday March 06, 2003 @02:16PM (#5450573)
    and so far, there has been NO communication from UT about the possible theft - the only reason I heard about it is that someone forwarded the article to me this morning. UT seems to be adopting a 'lets-hope-nothing-screwy-happens' attitude to the whole thing, and that is very worrying. There is no way to tell if your ID was one of those stolen - which strikes me as being a little weird. It would make sense to inform the affected individuals as soon as possible, so that they could start being a little more vigilant about their credit histories. But apparently that goes against the wishes of the authorities up high.
    • That's really odd that you haven't. I'm at UT in Houston (the grad school), and I got an e-mail about it this morning from our departmental IT person. The only reason we didn't get it sooner is that we've been on a retreat since Monday.

      As for student notification, go to the bottom of the UT article; The last section is headed "How will affected individuals be notified?" and gives an e-mail address.

    • by Cowboy (98435) on Thursday March 06, 2003 @03:10PM (#5451196) Journal
      from the following URL [slashdot.org]...
      Am I Affected?
      Is your SSN in the following ranges?

      449-31-98xx - 450-91-24xx
      451-12-32xx - 451-20-35xx
      451-20-64xx - 452-20-40xx
      If so, within these ranges, 55,200 people of the following types, including but not limited to:

      Current students, faculty and staff
      Former students, faculty and staff
      Job applicants
      Retirees
      may be affected.

  • I thought it was illegal to use Social Security Numbers as student ID #s? At least that's what my school told us a couple years ago when they switched ours from them. My school's in MI - maybe it's a state law?
    • Re:Illegal? (Score:3, Informative)

      by JJAnon (180699)
      It is not illegal - at least in Texas. UT has been promising to transition to a UT-EID (electronic ID, an alphanumeric identifier) for a while, and I think the current schedule is for it to happen this Fall, but it still uses SSNs for identification.
      • Re:Illegal? (Score:2, Interesting)

        by Anonymous Coward
        It is actually very illegal. This was ruled illegal back in the early 90's. The problem is that the state government of Tx just does notcare about it. And now adays, nothing will happen to them.
      • Re:Illegal? (Score:3, Interesting)

        by cryptor3 (572787)
        I think the current schedule is for it to happen this Fall, but it still uses SSNs for identification
        But the big question is when will they purge the SSNs from their databases (and backups)?
    • Re:Illegal? (Score:3, Interesting)

      by Minna Kirai (624281)
      There's been a little blurb on the bottom of the Social Security cards which says "Do not share this number, or disclose it to anyone not representing the Social Security Administration".

      (I don't remember the exact text)

      How much force that warning has is debatable. Certainly, any individual student can protest "You've got no right to see my SSN!". When this happens, he typically gets bounced around a few offices until someone responds "Ok, just make up a random number and lets get on with it"
      • Re:Illegal? (Score:3, Informative)

        by kperrier (115199)
        There's been a little blurb on the bottom of the Social Security cards which says "Do not share this number, or disclose it to anyone not representing the Social Security Administration".

        Lets see. (pulls out wallet and get SSN card)

        Nothing on the front but my name, SSN, my signature and the Social Security logo.

        On the back I have this:

        Do not laminate this card.

        This card is invalid if not signed by the number holder unless health or age prevents signature.

        Improper use of this card and/or number by the number holder or any other person is punishable by fine, imprisonment or both.

        This cars is the property of the Social Security Administration and must be returned upon request. If found, return to:
        SSA-ATTN: FOUND SSN CARD
        P.O. Box 17087 Baltimore Md. 21203
        Contact your local Social Security office for any other matter regarding this card.

        plus the SSA form number.

        Nope, don't see anything telling me not to share this number....

        Kent
      • Re:Illegal? (Score:3, Insightful)

        by The_K4 (627653)
        Um yeah, go apply for a Credit Card....tell them they have no right to see your SSN.....get rejected....
        apply for a car loan.....tell them they have no right to see your SSN.....get rejected....
        go to the DMV apply for a DL...tell them they have no right to see your SSN.....get rejected....
        see the pattern?
  • by 1984 (56406) on Thursday March 06, 2003 @02:17PM (#5450580)
    OK, so I can see how a university might come to use SSNs as an identifier. They're unique and everyone already has one. Easy.

    But why are SSNs so sensitive? It's like a credit card number -- it's printed some places, gets bandied about in others. Not exactly confidential, and no intuitive or documented boundaries on who should be trusted to with it. So it's a scary number that can be used for bad things, but you'll have to give it out in many circumstances where you aren't fully aware of how it'll be used. Makes it tricky to know who has it, or to make an informed decision about where you use it.

    Again, it's easy to see how the practice of using it as a credential has continued (and got worse), but when did it start?
    • by sweetooth (21075) on Thursday March 06, 2003 @02:28PM (#5450728) Homepage
      Google can answer most of your questions with nifty links like this [privacyrights.org], or this [cpsr.org].

      Who would have thunk it?
    • by parc (25467) on Thursday March 06, 2003 @02:39PM (#5450841)
      There's a problem with your statement "They're unique and everyone already has one." First, not everyone has one. You were not legaly required to have an SSN until 20 or so years ago. Of course, without one you can't get social security benefits.

      A bigger problem is that everyone assumes SSNs are unique. They aren't. At best they can only uniquely identify 1 billion people. "Easy," you say, "There aren't 1 billion people in the United States." There were 281 million in 2000. The birth rate is 14.5 per 1000, and the death rate is 8.7 per 1000. While the birth rate is declining, the life expectancy of a person is lengthening. Additionally, it can not be expected that the birth rate will continue to decline to 0. This means that, while it won't happen any time soon, eventually there will be more than 1 billing people in the US.
      The next problem is that when you die, your SSN is NOT REUSED until your estate is closed, at a minimum. My mother's estate was not closed for nearly two YEARS after her death, and hers was a simple estate. Some accounting setups could cause you SSN to be used for many years after your death.
    • by Greyfox (87712) on Thursday March 06, 2003 @02:45PM (#5450907) Homepage Journal
      Because every company on the planet uses the number to identify you. When you apply for a loan, a driver's license, a credit card or insurance, the Social Security number is all they need. Given yours, I can request a car or home loan in your name, get a nice fat check and skip out of town or out of the country. And you might not ever know about it until the credit collectors catch up with you, you're denied credit or you don't get a job when they run a credit check on you. Assuming they even tell you your credit history is why they didn't hire to. Many employers ignore the laws stating that they have to tell you if that's why they don't hire you.

      If someone is using a driver's license acquired in your name with your social security number, they could very well build up a criminal record in your name in some other state. A routine traffic stop could then lead to you getting arrested.

      With that in mind, if someone asks you what yours is, the first thing that comes out of your mouth should not be that number. It should be "I don't think you need to know that information." Note that in the historical past (I don't know if this is still true) if you knew someone's name and birth date, you could use an Internet information service to find out their social security number and criminal history.

  • by Sgs-Cruz (526085) on Thursday March 06, 2003 @02:17PM (#5450581) Homepage Journal
    I've seen a whole bunch of 'stolen credit card #' type stories on Slashdot lately... the thing is, we never hear about any repercussions of these thefts. Do the thieves ever use the stolen records in large quantities? Follow-up is good :). Any info people have, post it here (I'm thinking of, in response to the Amazon CC# thefts from a few weeks ago, etc.)
  • One Copy? (Score:2, Interesting)

    by robi2106 (464558)
    A smart cracker would already have lined up the buyer(s) for the information (probably spam companies) before doing the crack. At least one copy of the data would have been made at the time of the crack to insure that it doesn't get captured and lost.

    But nothing says that these cracker(s) are smart. Possibly just lucky.

    robi
  • by efflux (587195) on Thursday March 06, 2003 @02:17PM (#5450585)
    My school still uses SSN's as student id's. I've found that as a student employee I run into thousands of id's a day. I know it's the same way for a lot of student employees on campus. When will schools learn the benefits of a autogenerated key?
    • our university goes by random numbers, unfortunately they use the year you are supposed to graduate! so my student id 2003###### looks out of place in all the first year classes I am in, hopefully the young females dont notice....:P

      But I would prefer that to having my identity stolen and have horrible credit, depending on the girls.
  • from what Ive seen (Score:3, Interesting)

    by odyrithm (461343) on Thursday March 06, 2003 @02:18PM (#5450598)
    in schools, its very easy to retrieve information, I went round no less than 10 junior schools in my area to get information on the new students that are about to enter the new year in the secondary school I work as the information manager.. NOT ONE of the schools asked me for ID, they showed me to a machine and logged me in and let me walk out of the door with the information on floppy...

    Its a very scary.. but what can you do..
  • Penalties (Score:5, Interesting)

    by Skyshadow (508) on Thursday March 06, 2003 @02:18PM (#5450600) Homepage
    Am I the only one who thinks that there should be penalties for the hack-ee when private information is stolen?

    Not to adapt a blame-the-victim mindset, but I mean really, why is this stuff on an internet-connected machine to begin with? I work in health care, and with HIPAA coming into effect, we've been moving a substantial part of our network off the internet -- if there's no physical connection, we can't get hacked.

    This stuff needs to be taken seriously, and not just in punishing the offenders. Look at it this way: If your bank got robbed tomorrow and all the items in your safe deposit box were made off with, would you blame the bank if you found out that the vault was left open and the deposit boxes were made of cardboard? I sure would.

    • Re:Penalties (Score:4, Informative)

      by Conare (442798) on Thursday March 06, 2003 @02:30PM (#5450750) Journal
      "I work in health care, and with HIPAA coming into effect, we've been moving a substantial part of our network off the internet -- if there's no physical connection, we can't get hacked. " Oh really? Something like 60% of breaches are internal. What are you going to do now? Put everyone on their own separate network? We are going to see a lot of medical data stolen since Bush took the teeth out of the HIPAA requirements.
    • Re:Penalties (Score:3, Insightful)

      by GuyMannDude (574364)

      Am I the only one who thinks that there should be penalties for the hack-ee when private information is stolen?

      I would imagine that under such a system, no organization would ever admit to being cracked since they would be financially liable. And having some third-party prove that the organization was cracked without access to the computer records would be quite a feat.

      GMD

    • Re:Penalties (Score:3, Insightful)

      by Minna Kirai (624281)
      there should be penalties for the hack-ee

      There is already a penalty of sorts- any corporation victimized in this way will get a big overtime bill from their IT department as it patches the holes and audits the damage. They also claim to lose revenue for the period the systems were offline.

      Look at the huge dollar amounts of "damage" that companies quote when they suffer a "hacker attack". Those are big losses- it must be some kind of punishment.

      Now, one might say that amount of punishment isn't a sufficient deterrent against poor security, because corporations so far haven't invested enough in prevention.

      Are there approaches the government could take to increase the magnitude of that punishment? Yes, two ways:
      • Declare that knowingly running an insecure server is a public safety violation. Fine administrators who do this. (This requires more effort from police and lawyers. Maybe someday it will happen)
      • Spend less government effort pursuing "hackers", and reduce the legal repurcussions once they're caught. This would permit freelance hackers to mete out more punishment towards insecure corporations by attacking them more often. (This reduces the current government expenditures on enforcement and prosecution. But, it'll never happen)

  • Clarification? (Score:5, Insightful)

    by binaryDigit (557647) on Thursday March 06, 2003 @02:19PM (#5450606)
    The UT link appears to be /.ed, but when I read it before it sounded like a simple brute force ssn lookup. The attacker simply generated random ssn and sent them against a page that returned information based on ssn. The attacker then simply harvested "positive" hits. The problem was that this interface was exposed to the public and that it had no means of throttling/preventing multiple requests/failed requests.

    On another note, UT is phasing out SSN in many aspects of the students life. My wifes UT ID does not contain her ssn, it has a student # now. Though I assume that there are still many points of interface with the UT system that expects to see ssn.
  • Yikes... (Score:3, Interesting)

    by TopShelf (92521) on Thursday March 06, 2003 @02:20PM (#5450623) Homepage Journal
    It's amazing how much information you can get kicked back by simply trolling SSN's. This reminds me of the scandal last year [infoworld.com] with Yale's admissions information, which a Princeton administrator obtained by simply entering SSN's and birthdates on their web site. A brute-force attack like this one, simply adding birthdate to the mix, could have successful results in other places, I'm sure.
  • by revcorrupt (254160) on Thursday March 06, 2003 @02:21PM (#5450640) Homepage
    This is NOT the first time, and I do not believe that it will be the last. I work and attend a medium sized college and I happen to know from other employees that our systems have been compromised on several occasions, and in fact they are still being compromised. I do not believe that any critical information has been stolen, but the security of the critical systems at our nations colleges and universities needs to improve. Our college refuses to publicly admit that they have had a serous breach or deny any knowledge of current security problems. It's quit frustrating to be a computer security enthusiast and attend a college that refuses to admit they have a serious problem.
  • by Dman33 (110217) on Thursday March 06, 2003 @02:22PM (#5450645)
    "There are six to 12 ways we could have reduced the risk to the database," Updegrove said. "The sad thing is, we didn't do any of them."

    It is good to see the University being so frank and honest about this matter. I am sure some heads are gonna roll, but at least the people affected will be provided with information and know how it happened.

    Speaking of how it happened... the article does not go into technical details, but I am curious how this database was accessible to the world and was spitting out data to qualifying queries of SSNs without any security context... I am sure someone here on /. has an opinion as to how this happened?
  • by GMontag (42283) <gmontag&guymontag,com> on Thursday March 06, 2003 @02:22PM (#5450648) Homepage Journal
    This johnny-come-lately "UT" is ripping off the initials and the colors of the original UT [utk.edu] (est. 1794 thank you very much)!!

    We demand that our child State of Texas cease and decist in the molestation of our look and feel.

    Sincerely,
    Volunteer Graduate of 1994

    PS, The UTK English Department is the Home of the Vowels [harbrace.com] ;-)
  • Hey, here's an idea (Score:3, Interesting)

    by buffer-overflowed (588867) on Thursday March 06, 2003 @02:23PM (#5450657) Journal
    SSN's are valuable because you can use them for identity theft. You can use them for identity theft because they're a national ID card. Something "they" (the mythical them) say they are not.

    Apart from that all of the credit reporting, etc. goes through shadow companies that you can do nothing to if they screw you over (IE issue a credit card to a you that's not you).

    We need to make using an SSN for identification purposes entirely illegal, credit card companies and banks be damned. Or say it is a National ID and come up with a better way of securing identities.
  • by squarefish (561836) on Thursday March 06, 2003 @02:23PM (#5450662)
    Northwestern recently sent this out to all students:

    Dear Students:

    The following three bulleted topics are of student interest:

    * Social Security Number is removed from WildCARD ID
    With complaints about identity theft nearly doubled last year as the fast-growing crime topped the government's list of consumer frauds for the third consecutive year, WildCARD offices on the Evanston and Chicago campuses have started issuing new WildCARD identifications without social security numbers.

    The re-designed WildCARDS are being issued at no charge to faculty, staff and students who wish to exchange their existing card for one minus a social security number printed on the front. Those without a card to exchange because it was lost or stolen will be
    charged a $15 replacement fee.

    "The new purple WildCARD looks the same as the old one, but as opposed to printing the person's social security number that used to be their Northwestern "id" number, we have implemented a shortened "emplid" number which the University is issuing that has no association whatsoever with one's social security number," said Arthur Monge, manager of WildCARD and Vending.

    "We are not mandating that WildCARD holders be issued a new card, but the option is available for anyone who feels concerned about having the social security number visible on their existing card. It is a matter of personal choice to replace their existing card for one with an "emplid" number, at no charge, unless they have lost their card or it has been stolen." Since switching to a new WildCARD is optional, it can be done at one's leisure. Existing WildCARDS will continue to work, so if someone doesn't feel the need to have one without a social security number immediately, they can continue using their existing card until it expires.

    Northwestern University's multi-purpose, one-card program, WildCARD, was developed nine years ago to provide better identification for members of the University community and to simplify use of existing services, control access, reduce handling of cash, and enhance security. Students, faculty, staff, spouses and domestic partners of active, full-time faculty or staff, authorized contractors working within the University community, Research Park tenants, and individuals affiliated with a University department are all eligible for a WildCARD. For more information, call Art Monge (847) 467-3135 or check the WildCARD Web site at:
    http://www.univsvcs.northwestern.edu/WildCard /inde x.html

    * New vending machine refund bank locations
    If you didn't already know it, there are vending machine refund banks located throughout both campuses. A complete list can be found on the WildCARD & Vending web site at:
    http://www.univsvcs.northwestern.edu/WildCard /vend ing.html#refundloc

    New locations include the Family Institute at 618 Library Pl (front desk), Lake Shore Center at 850 N. Lake Shore Drive (front desk) and at Wieboldt Hall, 339 E. Chicago (Administrative office, 2nd fl). One is also planned for Galter Library in the near future.

    Each vending machine should have a sticker on it that indicates the nearest refund bank. If one is missing, please inform the Evanston Wildcard Office at 7-6843.

    * Other tidbits of information:
    --The Abbott Hall ATM now sells stamps
    --A Pepsi vending machine promotion is taking place now. Pepsi is giving away 80 Willie the Wildcat bobble head dolls. Look for a sticker on your next Pepsi purchase.
  • SSN as ID number (Score:3, Insightful)

    by TPIRman (142895) on Thursday March 06, 2003 @02:23PM (#5450663)
    While my university doesn't use the SSN for our student ID number, it still asks students to put it on countless forms and enter it into countless databases. It's always made me uneasy, and I hadn't even thought of the potential for a computer break-in. Rather, I was unsettled that any student worker who checked out a book for me at the library could see my SSN on his screen after scanning my ID card.

    But nothing wakes up a university -- especially a state school -- like the threat of litigation. If the cracker followed up and committed full-scale identity theft, the students would have grounds for a lawsuit against the school. Consider the recent New Hampshire lawsuit [slashdot.org] that dealt with SSNs and other personal information. With the potential for bloodthirsty lawyers, universities might finally get serious about protecting their students' information.
  • Bush's daughter (Score:3, Interesting)

    by wayward_son (146338) on Thursday March 06, 2003 @02:24PM (#5450668)
    Doesn't one of Bush's daughters go to UT?

    Could this possibly be related?
  • Sorry....we'll do our best to lock the barn door now that the cow's escaped!.......
  • by agrounds (227704) on Thursday March 06, 2003 @02:24PM (#5450678)
    I used to admin at a University. One of the most frustrating things I encountered was the incessant desire for there to be no restrictions on any of the computing systems that the students used. This includes the servers. The firewall was just an expensive router. We were not allowed to run blocks from the internet to inside IPs, as that defeated the spirit of free access. I tried to explain why it was a 'Bad Thing(tm)' repeatedly, but alway met with resistance from the shared governance committee. One cannot blame the administrators in this thing. I assure you they feel just as powerless as I did. This kind of thing will become more and more rampant as clueless faculty (or upper-management in the business world) are allowed to influence major IT decision-making.
    • Actually, my fiance goes to UT, and I can assure you that this is entirely the administrator's fault (well, and the hackers, but since we're in the "blame the victim" mindset here)... UT has no such "free access" restrictions in place. half the campus can't even send mail outside the UT mail systems.

      I will say this in defense of the IT people there... its gotta be pretty fucking hard to lock down a system that has almost 70,000 users (between students, faculty, staff, alumni, etc).
  • Back when TV's were 4 inches accross and black and white, a nine digit number was "good enough" security in a slow and analog world. In modern times the entire idea of using JUST A BUNCH OF NUMBERS as ID is INSANE. And isn't it illegal to use S.S. numbers as a form of ID in the states?

    • by rela (531062)
      And isn't it illegal to use S.S. numbers as a form of ID in the states?

      A common misconception. Federal agencies are now somewhat restricted in how they use it (5 U.S.C. Sec. 552A) and some states have laws about it in certain circumstances, but one the whole there's nothing illegal about it.

      Some Googling:

      http://www.cpsr.org/cpsr/privacy/ssn/ssn.faq.html# IsItIllegalToAsk
      http://www.lawcommerce.com/newsletters/art_OHS_emp loyalert0205.asp
      http://www.usdoj.gov/foia/privstat.htm

      I'm sure intrepid Googlers out there could find more.

  • SSN's? Big deal. (Score:3, Interesting)

    by Slime-dogg (120473) on Thursday March 06, 2003 @02:25PM (#5450689) Journal

    Big deal. If anyone wants to know my ssn, it's "336721433".

    SSN's are public information.

  • by Anonymous Coward on Thursday March 06, 2003 @02:26PM (#5450704)
    They immediately disconnected the compromised database from the Internet, later hooking up a database of useless information.

    They probably just copied over the DB containing the University's security procedures.
  • `Recapturing'? (Score:5, Insightful)

    by TKinias (455818) on Thursday March 06, 2003 @02:27PM (#5450710)

    UT says:

    UT, in conjunction with the U.S. Attorney's Office, the U.S. Secret Service, and other law enforcement agencies, has focused its efforts since Sunday evening on identifying the perpetrator(s) of the break-in and recapturing the stolen data.

    Someone is more than a little bit confused about the nature of digital storage if they think they can `recapture the stolen data'.

    `Ah, cool, we've managed to delete the copy they made of our data.'
    (whispers)
    `Another copy? How many copies did they steal?'

  • Isn't there a law?? (Score:2, Informative)

    by PDXNerd (654900)
    A few years ago I got a new bank account and they told me that due to a federal social security law they could not use my SSN as an identification source and that anyone who used it as such was breaking the law.

    I know that many institutions and businesses use it (SSN) that way, but isn't it against the law? Or did I misinterpret the statement from the bank?
    • by Dahan (130247) <khym@azeotrope.org> on Thursday March 06, 2003 @02:47PM (#5450934)
      In general, government agencies (other than the IRS) can't require you to give them your SSN. There are a few exceptions though... and some govt. agencies want you to think that you need to give them your SSN when you don't actually need to. As an example, if you apply for a passport, the form [state.gov] threatens you with a $500 fine if you don't fill in your SSN. However, it's the IRS that wants to know if you're applying for a passport--you can actually tell the IRS directly, rather than sending your SSN to the State Dept. and having them tell the IRS.

      Private businesses can request your SSN if they want... you don't have to give it though. But if you don't, they don't have to give you whatever you're looking for either :)

      However, UT is a public school and is subject to the restrictions on government agencies... here's [uncg.edu] a page with some info on the use of SSNs in public schools.

      Anyways, as a former UT Austin student, I'd be annoyed if my SSN was one of the ones that got out... and if so, I wonder how UT plans on contacting me--as far as I know, they don't have my current address, phone number, or any other type of contact info. As a side note, the first year I was there (1988), a lot of professors posted exam grades outside the classroom indexed by SSN... I guess someone put a stop to that :)

  • What the? (Score:2, Insightful)

    by Baracus (628287)

    Hold on, why were UT's internal data reporting systems hooked up to the internet? I thought sensitive information like this was only exchanged over secure intranet and stored in systems with no access to public networks?

  • by StarTux (230379) on Thursday March 06, 2003 @02:29PM (#5450744) Journal
    They just should not be used by any third party, one thing I was amazed on after moving from the UK to the US was just how many companies/people here ask for that information when really its not necessary.

    StarTux
  • SSN at UT (Score:5, Informative)

    by yar (170650) on Thursday March 06, 2003 @02:56PM (#5451030)
    I have both attended at work at UT in IT, so I can give you my observations.

    For many years, UT had a non-centralized IT infrastructure. That is, the Colleges did one thing, the Administrative Computing Group did another thing, the Academic Computing Group did yet another thing, and the Libraries something else entirely. This was recently changed with the introduction of a new Office of Information Technology head by a new Vice Provost (Dan Updegrove, originally at Yale). One of the very first things I heard him address was the Social Security number problem in which every student, faculty, and staff member used their SSN as their ID. That practice had to change in order to meet both legal and privacy standards (see FERPA [cpsr.org]) , and UT has been trying for the past couple of years to make that happen. The trouble is, it was so integrated into all of the different services and departments that it is a slow process to remove it. They started to phase it out, but now UT is seeing the effects of this particular practice. I'm likely one of the ones who will be affected, so I'm waiting for them to announce where people can find that out. (It may be at the UT site, http://www.utexas.edu/datatheft/ [utexas.edu].

    The Daily Texan (student newspaper) has an article about the theft [dailytexanonline.com], as does the Houston Chronicle [chron.com].)

    By the way, your Social Security Number isn't public information. It is required for use by some agencies of the government, but you are not required to provide your SSN to private groups unless they need to interact with certain government agencies (this includes your employers, who deal with the IRS). That being said, SSNs are so commonly used a search may pull up that information- but that doesn't mean it is legally public info.
  • by dj_whitebread (171775) on Thursday March 06, 2003 @03:03PM (#5451100) Homepage
    Just to let everybody know, this was the last semester that UT was using SSN's as id's. We are in the process of switching over to what they call the EID. The EID is just a text string (similar to a user login). This is what we have to use to access online services for several years. Within months it was going to be our official identifier in all of the university's systems.
  • Honey pot (Score:3, Insightful)

    by oxfletch (108699) on Thursday March 06, 2003 @03:04PM (#5451129)
    What we need is a honey pot full of fake SSNs ... when people try to use them (obviously stolen), the Feds go round and arrest the bastards.
  • by SysKoll (48967) on Thursday March 06, 2003 @03:10PM (#5451204)

    This is really sickening. A lot of schools still use SSN as student IDs. In State University of New York, until very recently, your SSN was used on your grad reports, your dorm phone bills, your administrative notices, and teachers even insisted that this SSN/Student ID should be written at the top of every homework. Old phone bills with your name, date of birth, address and SSN were often found in classrooms or on the floor.

    When I approached a SUNY teacher about this potential ID theft problem (back in 1999), his answer was: "I've been doing this for 20 years and I've never heard of this problem". Shocking, astonishing conclusion: The American academia is clueless! Oh no! How can that be! (But hey, it explains so much.)

    It took a few ruined students and an order from the Attorney General (IIRC) for stopping NY schools from using SSNs as student IDs.

    I am not really surprised that some administrative cretins are still camping on their position after all the theft ID problems of the last few years. After all, Schools Are Clueless.

    I would like to entertain the hope that a few of these moronic school administrations would be sued 'till they bleed by ruined students, but how could ruined students afford this kind of legal costs?

    -- SysKoll
  • by goldspider (445116) <ardrake79NO@SPAMgmail.com> on Thursday March 06, 2003 @03:42PM (#5451513) Homepage
    "The University of Texas' security was compromised over the weekend, leaking out nearly 60,000 records on students, staff, and faculty."

    That information wasn't leaked, it was FREED!

  • by weave (48069) on Thursday March 06, 2003 @03:44PM (#5451530) Journal
    Think this all is bad, the first college I attended used SSNs as your logon id. All one had to do is logon and type "?WHO" to get a list of 100s of usernames logged onto the system, then run *system/who to tie it to a name.

    (Extra credit props points to anyone who can name the system that I am talking about... Hint, this was late 70s to early 80s)

  • by Davorama (11731) on Thursday March 06, 2003 @03:57PM (#5451671) Journal
    I highly recommend to everyone to read this page carefully

    http://www.fightidentitytheft.com/flag.html

    and if the drawbacks don't sound too bad (think carefully!) make the calls. It takes about a half hour. Much less than the time you'll spend untangling the mess of an identity theft. You may also consider calling your bank and creditors to ask them to put similar holds on your contact info so that some clever scammer doesn't have your statements forwarded to Timbuktu, thus gaining them extra time to run amok and causing you even more grief. This isn't paranoia talking, it's experience.

    Here are the numbers.

    Credit Bureau Fraud Departments

    TransUnion
    Fraud Victim Assistance Department
    Phone: 800-680-7289

    Equifax
    Consumer Fraud Division
    Phone: 800-525-6285 or: 404-885-8000

    Experian
    Experian's National Consumer Assistance
    Phone: 888-397-3742
  • by Skapare (16644) on Thursday March 06, 2003 @05:00PM (#5452249) Homepage

    Aside from the fact that the custodian of the information certainly has a lot to blame in this, there is another big part of the problem. That problem is what people can actually do with the information.

    An SSN is identity. It is nothing more than that. The problem is people make the incorrect assumption that it is authenticity (I can recite the number, or read it off a little card in my wallet, so it must be me), and authority (this account has your SSN and is overdrawn, so you are liable for it).

    If any law change is needed, it is a law change that says that it is illegal for an SSN to be accepted for any purpose other than identity. What that means is that if I walk into a bank and open an account citing some SSN, the bank needs to understand that all this does is identify someone, and not necessarily me. If the bank causes harm to the real owner of the SSN by having provided any derogatory credit information based on that SSN, then the bank shall be fully liable for having not taking reasonable measures to ensure accuracy of information. And by that, what I mean is that the bank can't simply say that the victim needs to track down the perpetrator to cover the costs. The banks need to be forced to properly authenticate the information they use, especially when and where it might be used in a negative way.

    And I don't mean to pick on banks (I just happen to have an open case with Chase Manhattan bank which continues to allow someone to operate a credit card account with my SSN, reported on my credit reports, without my consent, and after I have advised them of the fraud). Such a law should apply to anyone and everyone who accepts and uses SSN data for anything. It's the negative things that can be done (like bad credit info) that needs to be stopped (in addition to other stupidities like running computers insecurely and connecting systems to the internet that have no business being there).

  • Am I Affected? (Score:3, Informative)

    by AggieScott (456489) on Thursday March 06, 2003 @05:36PM (#5452572)
    Is your SSN in the following ranges?

    * 449-31-98xx - 450-91-24xx
    * 451-12-32xx - 451-20-35xx
    * 451-20-64xx - 452-20-40xx

    If so, within these ranges, 55,200 people of the following types, including but not limited to:

    * Current students, faculty and staff
    * Former students, faculty and staff
    * Job applicants
    * Retirees

    may be affected.
  • by x-empt (127761) on Thursday March 06, 2003 @06:18PM (#5453126) Homepage
    Funny how this security breach at Princeton never got the media attention it deserved:

    http://www.ispep.cx/files/tucson.princeton.edu.txt [ispep.cx]

    Mod this up as Informative...
  • by randomthought (89154) on Thursday March 06, 2003 @07:37PM (#5453868)
    I stumbled on a UT site yesterday that had a number of exposed social security numbers, after reading an article [wired.com] in Wired about open Web enabled databases. The UT site now appears to be down, but you can see the Google cached version here [216.239.33.100]

    A click on the travel.fp3 file listed a couple hundred SSNs. It was completely wide open.

    UT made it sound like a deliberate attack, but it looks to me more like administrative incompetence (and cya).

  • I'm a student at UT-Arlington, the next largest school in the UT System. Last October our Student Congress passed a resolution I wrote asking them to basically make it easier for students to be able to request to no longer use their Social Security Numbers as their ID # - UTA currently has a system in place where you can request to use a randomly generated ID# instead of your SSN, but no one knows about it and they don't advertise it or make it easy.

    The administration's response was "Come Summer 2005, when we have our new Student Information System, we won't use anyone's SSN" but that in the meantime, we're screwed because they weren't going to change anything.

    A month ago I discovered the 'secure' portion of the Housing department's website had been indexed by Google, including the ID # (Social Security Number) of all 1200+ residents living in the on-campus dorms. This highlighted the need for the immediate cessation of collecting and storing SSN's, so I've introduced a follow-up resolution our Student Congress is looking to pass soon basically demanding each department document every way they use SSN's and the security measures in place to protect them, after which we want a committee of students and faculty to go through the documentation and approve or deny their use and storage of the SSN's.

    Our school paper, The Shorthorn (www.theshorthorn.com [theshorthorn.com]) is supposed to do a story in tomorrow's (Friday's) issue concerning the leak at UT-Austin and the fact that administrators so far at UT-Arlington are ignoring the need to provide secyrity for SSN's NOW, and not just in 2005.

    It should be interesting to see if the administration has finally 'seen the light' and will listen to us, this time.

  • by CleverNickName (129189) <wilNO@SPAMwilwheaton.net> on Thursday March 06, 2003 @11:29PM (#5455636) Homepage Journal
    In their newswire [salon.com], Salon [salon.com] titled this story [salon.com], "Computer crackers steal students social security numbers."

    I thought the Slashdot community would appreciate Salon getting the terminology right on this one. It may seem like a silly point to some, but the distinction between "cracker" and "hacker" is huge in my mind, and it always makes me happy to see a journalistic outlet get it right, for a change.

The economy depends about as much on economists as the weather does on weather forecasters. -- Jean-Paul Kauffmann

Working...