|
|
Harvard database shared via BitTorrent
Author: Gareth HalfacreePublished: 14th March 2008
The Harvard University Graduate School of Arts and Science's website was vulnerable to data theft.
The databases – joomla.sql, contacts.sql, and hgs.sql – contain information including Social Security numbers, names, dates of birth, and addresses both real and electronic. The security breach occurred some time in February according to a press release by the department concerned, but it is only since the cracker made the data available on a peer-to-peer network that the university has realised the full extent of the damage.
The person responsible for the breach – or at least the uploading of the data to BitTorrent – included a note with the 125MB archive claiming the attack was carried out “to demonstrate that persons like tgatton [server administrator] [...] they don't know how to secure a website.”
Although the original reason for the attack may have been to prove a point, making the data available publicly changes things for the worse. Not every criminal who is capable of making use of the information included in the database is smart enough to be able to retrieve it from the improperly secured server, but the vast majority of them will be able to use a BitTorrent client.
Harvard University has written to all those affected apologising for the breach, and will provide credit monitoring and identity theft recovery services free of charge. The site affected has also been secured – at least against this particular exploit.
Do you think the cracker had a valid point to make about the security of the website, or did he cross the line when he uploaded the data unmunged to BitTorrent? Share your thoughts over in the forums.
Related articles on bit-tech.net
Comments (13)
Stats: 0.093 seconds
he definatly went about it the wrong way thats all i can say! and you dont torrent peoples personal infomation like that, 1000's of students are now living a paranoid life waiting for the cerdit cards to suddenly max out due to fraud.
He didn't have to jeopardise the personal data of thousands of people to prove it. He's not smart -- he's just an idiot.
I spy a personal grudge. He's an idiot to drag thousands of other people into it, tbh - now everyone hates the hacker, instead of hating the admin. He'd have been better off sending all the info to the admin's boss, if he really wanted to cause trouble for him.
And a minor point, he's undoubtably an ass, but I don't think he's an idiot.
being an LPT (licensed penetration tester) and a CISSP, I think the # of laws he's broken are somewhere in the neighborhood of 40-50 depending on his location, I'd estimate the jail sentence he's likely to get if caught and charged with the offenses would be somewhere in the neighborhood of 30 years minimum mandatory.
who knows maybe the admin gave him a royal "**** you, my servers are secure"
(there are server/network admins that are arrogant enough to think the stuff they do is 100% secure all the time)
of course sharing all the info wasn't the right method, but why does harvard have this type of data in a SQL database unencrypted?
AND WHY ARE THEY USING JOOMLA?
(WTF)
Albeit sounding a little harsh,, I would think this is probably what happened. Contacting the council for the college would have been a more appropriate action. While trying to make a tough example of the Sys Admin is one thing, I would think this person is in for a rough ride if caught.