UC Berkeley computers hacked, 160,000 at risk
This post was updated at 2:16 p.m. PDT with comment from an outside database security software vendor.
Hackers broke into the University of California at Berkeley's health services center computer and potentially stole the personal information of more than 160,000 students, alumni, and others, the university announced Friday.
At particular risk of identity theft are some 97,000 individuals whose Social Security numbers were accessed in the breach, but it's still unclear whether hackers were able to match up those SSNs with individual names, Shelton Waggener, UCB's chief technology officer, said in a press conference Friday afternoon.
(Credit:
University of California at Berkeley)
The attackers accessed a public Web site and then bypassed additional secured databases stored on the same server. In addition to SSNs, the databases contained health insurance information and non-treatment medical information, such as immunization records and names of doctors patients had seen. No medical records (i.e. patient diagnoses, treatments, and therapies) were taken, as they are stored in a separate system, emphasized Steve Lustig, associate vice chancellor for health and human services.
"Their ID has not been stolen," he added. "Some data has been stolen."
The server breach began on October 9, 2008, and continued through April 9, when a campus computer administrator doing routine maintenance discovered messages left by the attackers. Logs indicate that the hacks originated from overseas, "primarily in the Asian theater," Waggener said, later specifying traces to China.
While campus police and the FBI were immediately notified of the breach, it wasn't until April 21, Waggener said, that officials learned data had been stolen. Since then, the focus of the investigation has been figuring out what was taken and who is at risk. The hackers' specific techniques are still being determined as part of the ongoing criminal investigation, he said.
From the looks of it, however, one outside database security software vendor, Sentrigo CTO Slavik Markovich, suspects an SQL injection, in which a small malicious script is inserted into a database that feeds information to the Web site. Markovich also questions whether the university has appropriate monitoring tools in place to have not noticed the hack for six months, and why it hosted data with different levels of sensitivity on the same server.
The university started notifying the 160,000 people at risk via e-mail and snail mail on Friday. Victims include an assortment of current and former Berkeley students--as well as their parents or spouses, if linked to insurance coverage--who had University Health Services health care coverage or received services. Also included are 3,400 students of Mills College in Oakland, Calif., which contracts with the university for health services.
The university has warned those affected to put a fraud alert on their credit reporting accounts. It has also set up a Web site and hotline to help the victims.
In 2005, a PC was stolen from a Berkeley graduate admission office that held sensitive data on some 98,000 people, stretching back three decades. And the university has dealt with security viruses and the like, Waggener said. But this was the first such server breach.
With this, Waggener said, Berkeley joins a long list of prestigious institutions suffering from such increasingly sophisticated and malicious attacks. "We're defending against attacks from around the world," he said.
Michelle Meyers is an associate editor who tracks online happenings in media, entertainment, and politics. E-mail Michelle. 
People need to be paranoid and it means spending $$$ for security.
Who's the hack that put this environment together?
Having a database server installed on a web server is a bit surprising. I would have thought that would have been on an Oracle database on a backend server. The fact a publicly available website could access the database is not surprising thou, even if it was backend.
Someone is either overworked or does not understand security...
OR just some knucklheads getting too high to care.
Either way, all have Masters in Computer Science from UC Berkeley. Looks good on the resume'!!!
Take your pick.
I have been dealing with identity theft and it is a serious life consuming pain. This is the 3rd time this has happened since I've been at UCB. This is RIDICULOUS!!
Contact me at UCBClassActionLawsuit@gmail.com
If one has already been started, please let me know, so I can join. Thanks!
The author, David Scott, has an interview that is a great exposure: www.businessforum.com/DScott_02.html -
The book came to us as a tip from an intern who attended a course at University of Wisconsin, where the book is an MBA text. It has helped us to understand that, while various systems of security are important, no system can overcome laxity, ignorance, or deliberate intent to harm. Necessary is a sustained culture and awareness; an efficient prism through which every activity is viewed from a security perspective prior to action.
In the realm of risk, unmanaged possibilities become probabilities ? read the book BEFORE you suffer a bad outcome ? or propagate one.
- by idfubar May 24, 2009 1:37 AM PDT
- Why should the University of California have its name dragged through the mud as a result of a failure of employees of the state to properly secure information? Why should the state of California (the birthplace of the computer revolution) have nothing to offer its own government by way of managed IT services so the state is not (a) doing this work itself and (b) not sending the funds to Amazon (in Seattle) or Accenture (Bermuda)!
- Reply to this comment
-
(21 Comments)Instead, what we have is a media which is ready to seize upon hysteria and a public which knows nothing better than to pontificate and threaten to sue; maybe when the state goes bankrupt we'll start to grow up...