Posts tagged as:

hack

Hackers breach UC Berkeley computer database

by Mahesh Kukreja on May 8, 2009

University of California, Berkeley, officials said on Friday that hackers infiltrated restricted computer databases, putting at risk health and other personal information on 160,000 students, alumni and others.

The university said data include Social Security numbers, birth dates, health insurance information and some medical records dating back to 1999. Personal medical records — such as patient diagnoses, treatments and therapies — were not compromised, officials said.

The databases also included personal information of parents, spouses and Mills College students who used or were eligible for Berkeley’s health services.

In all, 97,000 Social Security numbers were stolen, said Shelton Waggener, UC Berkeley’s associate vice chancellor for information technology and its chief information officer.

Social Security numbers can be used by identity thieves to access a person’s current credit history, or bank and credit card accounts, according to the California Office of Privacy Protection. The numbers can also be used to open new bank and credit accounts, or even get a driver’s license in the victim’s name, privacy-protection officials warn.

The school has identified 160,000 total names in the database and contacted everyone regardless of whether their Social Security number also was compromised.

The server breach occurred on Oct. 6, 2008, and lasted until April 9, when campus staff performing routine maintenance found messages the school said were left by the hackers.

“The indications are that the hackers left messages to the system administrator taunting the system administrator that they had broken in,” Waggener said. “It’s a common hacker approach for identifying themselves.”

The school said it had traced the hackers’ computers to a number of overseas locations, including China, and turned that information over to the FBI and campus police. An outside Internet security firm has also been hired to conduct an audit of the school’s systems and its information security measures.

Although the breach was discovered April 9, former and current students did not receive e-mail notification of the hacks until Friday morning. The university said it took forensic technology experts until April 21 to figure out which databases were hacked.

“Since then a team of more than 20 people from across the campus have been working seven days a week to determine the exact scope and nature of the breach,” the school said.

It established a Web site at http://datatheft.berkeley.edu to answer questions about the incident.

Graduate student Kate Monroe, 27, said she was taking the school’s warning seriously and planned to have a free fraud alert added to her credit report.

“My mom has dealt with identity theft and it’s no joke,” Monroe said. “Getting her identity cleaned up has been nearly impossible.”

The school said Friday it had not received any reports of identity theft from any students who were notified.

Other posts by


Related Posts
Related Websites

{ 2 comments }

Microsoft’s Internet Explorer is Vulnerable to Attacks

by Mahesh Kukreja on December 16, 2008

Hi Guyz, Just got the news.

Microsoft Internet Explorer users, beware. There’s a security flaw in all versions of the browser that leaves you wide open for attack. At least two million computers have already been infected.

The exploit doesn’t require users to click on links or download software from the Internet. Rather, it infects users when they open a Web page. The goal is to steal passwords, according to security experts, gain access to financial data and otherwise steal the victim’s identity.

“Microsoft is continuing its investigation of public reports of attacks against a new vulnerability in Internet Explorer,” said the company in a release on its Web site. Microsoft did not offer information on when a patch might be available.

Unpatched and Dangerous

Security flaws in browsers are certainly nothing new. But the difference with this one is there is no patch. No fix from Microsoft means that millions of Internet users may be at risk of infection simply from browsing the Web, according to Graham Cluley, a senior security consultant at Sophos.

“We are seeing infections on pornographic Web sites — and it’s not clear if these have been hacked or have been deliberately set up to infect surfers,” Cluley said. “Of course, Web-site attackers don’t just target porn sites. We see something like 20,000 new infected Web pages every single day — that’s one every 4.5 seconds — and the vast majority of those are legitimate sites that have been compromised by the likes of an SQL injection attack.”

How to Protect Yourself

Some computer users may be tempted to switch, if only temporarily, to alternative browsers such as Firefox, Safari and Google Chrome. Even Microsoft has suggested this as a temporary workaround.

However, Cluley cautions that all browsers have vulnerabilities and can be exploited — and switching the browser all employees use in a corporate setting isn’t a practical option. With so many attacks being discovered all the time, he continued, enterprise Web protection is a must.

“There’s no such thing as a 100 percent flaw-free Web browser,” he stressed. “To reduce the risks, you need to change your surfing behavior and ensure that your systems are properly protected with up-to-date antivirus software, patches and firewalls.”

Whatever the browser choice, Cluley said users need to ensure they have up to date, effective security in place. Quality generic detections are proven to be effective against new malware, and URL filtering can add a significant layer of protection against Web-borne threats, he advised.

Password Management

Password management is also an issue. Sophos’ research reveals that 40 percent of people use the same password for every Web site they visit. That means if hackers manage — through this flaw or other means — to steal your password, it might unlock a huge amount of other information for them.

“Regardless of this current exploit, therefore, it is essential that people take greater care over their passwords,” Cluley said, “not just choosing hard-to-crack non-dictionary passwords, but also ensuring that they don’t use the same password for everything.”

Out-of-Cycle Patch Coming?

Cluley expects Microsoft is feverishly attempting to build a fix for this problem. But a fix won’t come overnight. Microsoft, he said, also has the challenge of testing the patch before it is released.

“After all, no one wants Microsoft to roll out a patch that doesn’t work, or one that causes more problems than it attempted to solve,” Cluley said. “We don’t know yet when Microsoft will be in a position to release a fix, but much of the online world is waiting for it with bated breath.”

Other posts by


Related Posts
Related Websites

{ 0 comments }