Cutting-Edge Hackers Threaten Higher Ed

For IT professionals in higher education, cybercrime has become much more sophisticated than hackers simply sending out email blasts in hopes of finding an unsuspecting recipient. Criminals now create fake online ecosystems that look so real that even the most skeptical individual may be convinced they’re legitimate.

Then there’s the problem of information shared on social media, which is so plentiful that it makes it easy to gather information about an organization and create targeted messages that are even more persuasive.

“No matter how much training we give a faculty or staff member about how to recognize a suspicious message, it’s hard to blame them for failing to recognize a message that is crafted and customized to look as innocuous as possible,” Nicci Fagan, director of Central and Eastern U.S. higher education sales for CDW-G, wrote in an EdTech post.

Technology solutions enable IT pros to stay up-to-date, but communication is the key to security. Users need to understand just how advanced these attacks can be and the serious threat they pose.

“IT staff who develop campus awareness initiatives may find it useful to educate users not only on specific signs to watch out for—for example, characteristics of phishing emails—but also on the broader context of hacking itself,” Fagan said. “Many users may not realize, for example, the extent to which hacking has become a big business, complete with the tools and resources to craft effective deception.”

Dark Web Making Itself at Home on Campus

The dark web, a place inhabited by people looking for ways to profit from selling malware, poses a real threat to higher education. The Digital Citizens Alliance recently found nearly 14 million email addresses and passwords for faculty, staff, students, and alumni from U.S. colleges and university, 79% of them added to the dark web last year.

“Because [higher-education institutions] have large-capacity Internet connection links that served all the students and large-capacity servers that are designed for many users, they are almost always on and attackers never have to worry if a part of their infrastructure will be available for use,” Will Glass, a senior analyst for the cybersecurity firm FireEye, wrote in the Alliance study.

The first line of defense is better passwords. The report noted that too many young people use the same password for multiple services, making it easier for hackers. Colleges and universities are also installing security systems that automatically block users from downloading unapproved applications.

“We are constantly working to make sure that we incorporate layers of security, all working together to help protect the university’s data and assets,” said Timothy Cureton, IT security coordinator at Arkansas State University, Jonesboro. “At the same time, this approach still allows us to have that openness that we’ve always had and want to continue to have.”

Higher Ed IT Takes on Cyberthreats

Cyberthreats have become an increasingly difficult threat to defend against, particularly on college campuses, where systems need to be as open as possible for students. What makes it even more challenging for higher-ed IT departments is that the end users are usually the biggest problem.

“I’m an old military guy—or I should say I’m a young military guy—and one of the things I’ve learned is that security is as strong as its weakest link,” Keith McIntose, vice president and chief information officer (CIO) at the University of Richmond, Richmond, VA, said in an article for EducationDive. “You know, we use a chain analogy. It requires everyone who is accessing information on our network—faculty, staff, and students—to be security-aware.”

End users are most often the ones who either use unsecure passwords or click on suspicious links, allowing hackers to gain access. Students are natural targets, but staff and faculty who have access to institutional and proprietary data can be a bigger risk.

The University of Dayton, Dayton, OH, has launched a campaign to reinforce the idea that everything done on the Internet is a potential security risk. The Dayton IT department runs regular phishing tests, sends updates and warnings, and offers incentives and prizes to people who participate in the program.

“Our goal here is that this is no different than any athlete training for the toughest competition,” said Thomas Skill, associate provost and CIO at Dayton. “Every day, the bad guys out there are coming up with newer, better, smarter, faster ways to trick us into doing stuff, so we’ve gotta be exercising every day with our effort to understand when we can recognize a phish and when we can’t, and we’re tracking all the data on what we’re doing here.”

Is Ransomware Targeting Education?

Education may or may not be the main target for ransomware schemes, according to difference sources. One study from the security-analyst firm BitSight Technologies found that 13% of educational institutions examined by the company had experienced a ransomware attack in the last year, compared to 5.9% of government agencies or 3.5% of health-care providers.

Ransomware disables data from a system until users pay a ransom for its release. U.S. Department of Justice statistics for 2016 indicate there are nearly 4,000 ransomware attacks every day.

“Establishing email security protocols, monitoring key third-party vendors, tracking security ratings, and avoiding file sharing are all ways to mitigate risks associated with ransomware,” Stephen Boyer, co-founder and chief technology officer of BitSight, said in an article for Campus Technology.

Another report from the security firm Datto painted a much different picture for education. The company surveyed 1,100 managed service providers and placed education ninth on its list of ransomware attacks at 12%, far behind professional services (44%) and health care (38%). The study also found that 46% of ransomware attacks came from email phishing, followed by 36% resulting from lack of employee training.

“Malicious emails, coupled with a general lack of employee cybersecurity training, are the leading cause of a successful ransomware attack,” the authors wrote in Datto’s 2016 Global Ransomware Report. “Today’s businesses must provide regular cybersecurity training to ensure all employees are able to spot and avoid a potential phishing scam in their inbox, a leading entrance point for the malware.”

Study Finds Security Risks in 3-D Printers

International Data Corp. (IDC) recently reported that the $2.5-billion 3-D printing market grew by 20% in 2015. IDC also predicted that education spending on 3-D printing hardware and materials will increase to more than $500 million by 2019.

That kind of spending could be very attractive to hackers. New research on 3-D printing security found printing orientation and insertion of fine defects are areas of concern because of the potential harm to users caused by deliberately weakened products.

“These are possible foci for attacks that could have devastating impact on users of the end products, and economic impact in the form of recalls and lawsuits,” said Nikhil Gupta, an associate professor of engineer at New Your University and a member of the team that did the research.

Since computer-assisted design files used in the printing process don’t include printer-head orientation, hackers could change the process without detection, according to the research. Hacking the orientation could make as much as a 25% difference in the strength of a product.

Hackers could also attack printers connected to the Internet, adding internal defects into products as they are being printed. The researchers were able to introduce submillimeter defects, which could weaken the product, that couldn’t be detected using normal monitoring methods.

More Malware Attacks, Harder to Detect

Malware attacks are happening more often and are harder to detect, according to the State of the Endpoint Report from the Ponemon Institute. Of the 694 IT security administrators surveyed, the number of respondents with a strategy in place to deal with malware fell from 43% in 2015 to 38% this year.

The report found that 68% had experienced distributed denial-of-service (DDoS) attacks, where multiple systems are used to target a single system. In addition, 80% said that they believed their mobile endpoints—defined as laptops, desktops, smartphones, printers, POS machines, or ATMs—had been targets, up from 58% in 2015.

As troubling as that may sound, a bigger concern involves employees. More than 80% of respondents said the biggest threat to endpoint security was negligent or careless employees who don’t follow security policies.

“You’ve got how many different types of laptops? How many versions of Windows? How many applications for those devices? How many phone types, etc.?” asked Michael Davis, chief technology officer of the security start-up firm CounterTack in an article for InformationWeek. “IT has to struggle with all of that variation, while also trying to enforce a standard set of security protocols. And then, on top of that, they have to deal with the end user, so it’s very difficult to enforce anything, even from a purely technology perspective.”

More Malware Attacks on the Horizon

College students love their electronic devices, but that love affair could make them prime candidates for malware attacks. Research from the IT security firm Check Point found mobile malware used against Android devices is now among the most prevalent forms of attacks for the first time, while iOS platforms could soon see a steep increase.

The firm reported that while Android attacks are still more common and will become even harder to detect, the popularity of iPhones and iPads make those devices high-quality targets for cybercriminals. Check Point said it identified more than 1,400 different malware types globally in February, with the Conficker, Sality, and Dorkbot families as the most common variants.

“On top of these risks, we’ll experience a trend of cybercriminals using advanced techniques to not only take over and control individual devices but groups of multiple devices,” David De Laine, regional managing director for Check Point, told the industry newsletter ARNnet. “Controlling one device is fun, but controlling an army of devices is a real moneymaker. Botnets are getting bigger and more well-orchestrated, giving hackers a range of malicious capabilities from massive spamming schemes and heavy DDOS attacks to cryptocurrency mining.”

A denial-of-service (DOS) attack is an attempt to make a device or network unavailable to its user. A distributed denial-of-service (DDOS) is an attack on more than one unique Internet protocol address.

Malware Targets Android Phones

Most college students can’t function without their smartphone nearby. If it’s an Android device, there’s a malware that could make their lives miserable.

The malware, called Mazar Android Bot, is spread through a text message with a malicious link that takes over the user’s device, according to a report from ITProPortal. The text alerts the user that a multimedia message has been sent and includes a link to view the message.

The user is then prompted to download the package with the malware that bears a generic name such as “MMS Messaging” to make it look like a legitimate application.

Once downloaded, the malware alerts the attacker that a new device has been compromised. The malware can install a proxy application that lets the attacker intercept all Internet traffic on the device. It also makes it possible for man-in-the-middle attacks, which are used to steal account logins, social media credentials, and banking information.

Security experts believe the malware is of Russian origin because Mazar Bot can’t be installed on phones owned by Russians. The bad news is that as it spreads the malware is likely to evolve into new forms.

“Attackers may be testing this new type of Android malware to see how they can improve their tactics and reach their final goals, which probably is making more money,” Andra Zaharia, a security specialist at Heimdal Security, said in a report for MSN.com. “We can expect this malware to expand its reach.”

Security Is a Problem for Higher Ed

Higher education continues to receive failing grades when it comes to keeping its files safe from hackers, finishing last in a recent study conducted by the security ratings firm BitSight. The problem for higher ed is tight budgets, a lack of control, and an open environment needed for bring-your-own-device programs.

Despite eight recorded breaches this year, higher ed has stayed out of the headlines because the attacks tended to be small. However, the large amount of valuable intellectual property, connections to other campus organizations, and student information are tempting to hackers.

“They have a lot of intellectual property that would be nice for others to have, and their systems aren’t very well protected,” Stephen Boyer, chief technology officer and co-founder of BitSight, said in an article in CRN Magazine. “I think we’re going to continue to see these types of breaches.”

The open culture of academia is another security issue, according to Robert Desman, director of business development at Carceron Managed IT Services.

“More than any single thing, it’s a cultural issue, and we’re still in the infancy of where the institutions are in terms of being security-conscious,” Desman said. “They’ll go ahead and build up their police forces if they have a lot of incidents, but it’s always a case of closing the barn door after the horses have gotten out.”

Cybercriminals Target Ed Sector

The 2015 Global Threat Intelligence Report found that the education sector accounted for more than a third of all the reported malware incidents. NTT.Com Security analyzed more than six billion attacks and reported that the bring-your-own-device (BYOD) format instructors are beginning to use could be to blame.

Students and staff use a variety of devices on institutional networks, often providing personal information in the process. Cybercriminals understand that and so focus their attacks on those networks.

“The history of open networks at education institutions has resulted in network architectures where there is usually no strong separation between areas containing sensitive data and untested areas where professors, students, or visitors can connect,” said Chris Camejo, director of assessment services for NTT.Com Security. “This makes it more difficult to prevent, detect, and respond to attack. IT officials must develop a strategy that is custom to the BYOD culture that they have embraced.”