In an apparent exploitation of security holes, for-profit hackers have uploaded unauthorized pages to hundreds of universities’ websites. No schools which were contacted had any idea the pages existed. It appears that no personal info was compromised, those these pages were put in place to help the hackers make money.
Source of article: Hackers plant pages on university web sites by Personal Money Store
Hacker pages hosted on university websites
The hack on dot-edu extension websites used departmental web sites, student pages, or upload functionality to create these fake pages. These web sites seem to send traffic to sites that are for-profit. Having pages on a university domain means that the hackers create the appearance the university endorses these pages – which improves search engine rankings and profits. From conversations with webmasters and information technology departments of universities around the country, it appears that these sites have flown almost entirely under the radar. Universities were already removing these pages as of 3 p.m. Wednesday afternoon.
Ohio business Street Smarts linked to hacked pages
The domain names that these unauthorized pages link to are owned by Street Smarts. When called for remark, the phone number listed on the site registration told the caller only "wrong number". Shortly after these phone calls, these web sites were taken offline. In 2008, there was a comparable hack of both government and educational websites. This 2008 hacker attack embedded JavaScript into domains ending in dot-edu and dot-gov that redirected visits to government and educational websites to one of three pages, or pages that differed only in name — myhome-loan-expert.com, latest-mortgages-rates.com and creditloansrates.com. There is a phone number that is out of service in Texas listed on the educational websites hacked. That phone number is also used on hundreds of websites with the JavaScript redirect posted in 2008. The code on the redirected and unauthorized websites appear to be nearly identical in CSS, JS, and HTML. To put it simply, the same company likely! perpetrated both attacks.
Risk to the student's personal information
This hack of educational web sites tries to make money off phony data and exploits the good name of schools. This security hole doesn’t appear to have released any details. Put simply, hackers could get data in, but not out. Security holes like this could be later used, though, to gain access to social security information, financial info, and grades. Security holes like this must be closed very quickly, because education is happening a growing number of often online.
Why security exploits are dangerous
A security breach like this can make it easy for scammers to collect personal information without visitors to the website ever knowing. The webpages created for this attack look very much like legitimate university websites. Identity theft and fraud are both dangers of entering personal details on sites like this.
The schools affected
The colleges, universities, and educational institutions affected by this attack are not listed in complete here. A search for these unauthorized pages showed these 50 schools as the first victims. You need to do a very extensive search for these unauthorized pages in case you are the webmaster or administrator for an educational website.
- Beacon University
- Harvard University
- McNeese University
- Northeastern Illinois University
- Cornell University
- Georgia Tech
- The Browning School
- Valparaiso University
- Los Rios Community College District
- East Central University of Oklahoma
- Rutgers University
- Yale University
- University of Texas Medial Branch
- Stony Brook University
- Saint Xavier University
- Hardin Simmons University
- Arizona State University
- Stanford University
- Austin Independent School District
- Smith College of Massachusetts
- Highpoint University
- Rensselaer Polytechnic Institute
- Catholic Theological Union
- University of Washington
- Westminster Theological Seminary
- Lake Forest College in Chicago
- Southeastern Louisiana University
- American Samoa Community College
- Columbia College of Chicago
- University of Arkansas Fort Smith
- UC San Diego
- University of Scranton
- Piedmont Technical College
- Assumption University of Thailand
- Chemeketa Community College
- Information Sciences Institute at the University of Southern California
- University of Tennessee Martin
- The City University of New York
- Milwaukee Institute of Art & Design
- Instituto Guatemalteco Americano
- The University of Utah
- Juniata College
- Ohio State
- California State Christian University
- Sharif University of Technology
- The University of North Carolina at Chapel Hill
- Brigham Young University
- The University of Arkansas
- The University of Virginia
No comments:
Post a Comment