What Happens When You Intentionally Install Password Malware? You Get Arrested

At the University of Alberta, Yibin Xu, a teenager (19 to be precise) is facing criminal charges of mischief in relation to computer data, unauthorized use of computer services, fraudulently intercepting functions of a computer system and use of a computer system with intent to commit an offense, all because he installed password harvesting malware on over 300 hundred university systems.

Edmonton police issued the charges after the university identified problems late in 2016 and received complaints from users regarding the performance of the accounts. Over 3,000 accounts from students and staff were affected. Once the breach was identified, the university promptly contacted all individuals and initiated a password reset on their accounts. Luckily, the harvested passwords where not leaked and used as a part of another attack, according to the university.

This type of attack is commonly identified as a password re-use attack and occurs when one compromised password is re-used on another of the victim’s resources (bank, school, email, social, etc.) that shares (re-uses) the same password. Therefore, the breach was contained but users should be mindful of the risks in re-using passwords across resources.

As for the incident itself, malware was installed on public access systems (classrooms and labs) and the university’s response team was able to clear the infected systems once investigations commenced. As a response, the university is improving existing security controls and processes to prevent the introduction of this type of malware in the future.

How to Prevent Crimes Like This One

While there is no perfect method to prevent these attacks from occurring in the future, simple steps can be taken by any institution that has public computers without becoming a “big brother,” including:

• Remove all administrator rights. Users logging into public systems should be standard users or guests. If applications need admin rights, a least privilege solution can elevate the application and mitigate the risk of the actual user being an admin.

• Do not store the local profile of the user once they log in. If the system is compromised, the local disk could still have the remnants of a previous user’s files.

• Re-image the public computer frequently. Some solutions perform this after each use but this method will keep the system pristine and in compliance with the original specifications.

• Assess for risks frequently. These systems by definition are public and can have vulnerabilities like any other asset. They should be assessed for vulnerabilities and patched frequently to ensure that modern attack vectors due not circumvent other security controls.

• Harden the asset. Using CIS, SANS, or the US DoD STIGS harden the host to eliminate unnecessary services, applications, configuration weaknesses that could be exploited.

• Ensure physical security. Disable, remove, or cover all exposed USB ports to prevent the introduction of dongles that can be used for exploitation. These are tools that do not require software access like software keystroke loggers but can perform the same as hackers using a physical device inserted inline.

• Software inventory the systems for compliance and disable the installation of any new software, drivers, etc. except from approved sources like a software delivery tool or patch management.

Public computer systems have unique challenges for security management. The University of Alberta experienced them first hand and at the cost of resources and thousands of compromised accounts. BeyondTrust offers a free privileged account discovery tool (called DART) that can help you quickly scan your environment for privileged users, password and systems. Start there and begin locking your systems down today!

Download dart