At the University of Alberta, Yibin Xu, a teenager (19 to be precise) is facing criminal charges of mischief in relation to computer data, unauthorized use of computer services, fraudulently intercepting functions of a computer system and use of a computer system with intent to commit an offense, all because he installed password harvesting malware on over 300 hundred university systems.
Edmonton police issued the charges after the university identified problems late in 2016 and received complaints from users regarding the performance of the accounts. Over 3,000 accounts from students and staff were affected. Once the breach was identified, the university promptly contacted all individuals and initiated a password reset on their accounts. Luckily, the harvested passwords where not leaked and used as a part of another attack, according to the university.
This type of attack is commonly identified as a password re-use attack and occurs when one compromised password is re-used on another of the victim’s resources (bank, school, email, social, etc.) that shares (re-uses) the same password. Therefore, the breach was contained but users should be mindful of the risks in re-using passwords across resources.
As for the incident itself, malware was installed on public access systems (classrooms and labs) and the university’s response team was able to clear the infected systems once investigations commenced. As a response, the university is improving existing security controls and processes to prevent the introduction of this type of malware in the future.
How to Prevent Crimes Like This One
While there is no perfect method to prevent these attacks from occurring in the future, simple steps can be taken by any institution that has public computers without becoming a “big brother,” including:- Remove all administrator rights. Users logging into public systems should be standard users or guests. If applications need admin rights, a least privilege solution can elevate the application and mitigate the risk of the actual user being an admin.
- Do not store the local profile of the user once they log in. If the system is compromised, the local disk could still have the remnants of a previous user’s files.
- Re-image the public computer frequently. Some solutions perform this after each use but this method will keep the system pristine and in compliance with the original specifications.
- Assess for risks frequently. These systems by definition are public and can have vulnerabilities like any other asset. They should be assessed for vulnerabilities and patched frequently to ensure that modern attack vectors due not circumvent other security controls.
- Harden the asset. Using CIS, SANS, or the US DoD STIGS harden the host to eliminate unnecessary services, applications, configuration weaknesses that could be exploited.
- Ensure physical security. Disable, remove, or cover all exposed USB ports to prevent the introduction of dongles that can be used for exploitation. These are tools that do not require software access like software keystroke loggers but can perform the same as hackers using a physical device inserted inline.
- Software inventory the systems for compliance and disable the installation of any new software, drivers, etc. except from approved sources like a software delivery tool or patch management.
Morey J. Haber, Chief Technology Officer and Chief Information Security Officer at BeyondTrust
Morey J. Haber is Chief Technology Officer and Chief Information Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored four Apress books: Privileged Attack Vectors (2 Editions), Asset Attack Vectors, and Identity Attack Vectors. In 2018, Bomgar acquired BeyondTrust and retained the BeyondTrust name. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition. Morey currently oversees BeyondTrust strategy for privileged access management and remote access solutions. In 2004, he joined eEye as Director of Security Engineering and was responsible for strategic business discussions and vulnerability management architectures in Fortune 500 clients. Prior to eEye, he was Development Manager for Computer Associates, Inc. (CA), responsible for new product beta cycles and named customer accounts. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.