Undisclosed Data Breach Helped Enable Phishing Scam At University
from the how-the-data-gets-used dept
Officials at Indiana University have concluded that a 2006 phishing attack against university members was made possible by an earlier breach of one of the university's main servers. This all came to light when one recipient of a phishing email -- a cybersecurity Ph.D. student -- wondered how an attacker could get his university email address, since he had never given it out to anyone. After requesting documents under the Indiana Public Records Act, the student discovered that the university had previously suffered an undisclosed breach, which is how the attacker obtained his information. This simple story underlines some important points. It shows that breaches aren't harmless; even if the stolen data isn't immediately used for direct fraud, it's likely to be used in other ways down the road. If stolen data can help a phisher do a better job of personalizing an email to make it look more legitimate, then that stolen data has value. The case also demonstrates the importance of disclosure. People whose data is lost need to be aware of it so that they can be on guard for fraud. When we hear about massive losses of data, such as the incidents at the Veterans Administration or TJ Maxx, it's easy to get lost in the staggering numbers and think of it all as an abstraction. But this incident shows, along with others before it, that breaches do have real consequences for the victims.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
The critical factor of permissions is often overlooked here. Why should you give up your personal information in the first place, to anyone? The answer is that you've also given them permission to use it.
Those who receive your personal information as the result of a data breach do not receive with it your permission to do anything. Its just useless junk data.
Without the force of consent, these bits and bytes have no value. I dont see whats the big deal
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Humm
Your info will be leaked, it’s a problem that is almost impossible to avoid. The point of the post is that if your info is leaked you should be made aware of it. So that if you get an email from someone who "knows you", you can tell em to f-off. Otherwise anyone could be put in a situation of trust and give up things they should not. Permission is not something criminals or even gray area companies will care about. They will use the info regardless.
[ link to this | view in chronology ]
Since when do spammers care whether or not they are running a legal operation, or using legaal phone numbers?
[ link to this | view in chronology ]
Learn to read first.
This was not spem, It was Phishing.
In case Mr. Anon up there doesn't know the difference. Spam is for the most part advertisements sent en mass to get you to buy something. spammers make money off the clicks. And no, they don't wait for your permission before sending you spam. If they did it wouldn't be spam, rather it wold be a legitimate opt in advertisement.
PHISHING on the onther hand is an attemt to gain your trust to the point that you will be willing to disclose personal information that could be used to compromise your or somebody elses security.
Working for AOL we were constantly recieveing mail about our secure ID's. This was an attempt to comprimise our servers.
Back to the post. I would have to agree with Joe on this one. The act of not informing students who's data was lost is pure negligence. They had a right to know so they could take the steps necessary to ensure they did not become victems of fraud.
[ link to this | view in chronology ]
Re: Learn to read first.
email spam blockers block a number of things. I'm going to guess they try and block as much phishing as possible.
hmm sounds like spam to me
[ link to this | view in chronology ]
Re: Re: Learn to read first
yes, you sure can call phishing spam. Nonetheless, that simply isn't the subject of this article.
What the article does say:
1) The more info you have about a person/user, the better your phising attempt will be : "breaches do have real consequences for the victims".
2) People who's information has been ~stolen~ should be informed, in order to take appropriate measures or simply be on the look out.
Spam is definitely unsollicited and mass mailings to non-optin users is illegal in most countries.
You might think about googlin' for some definitions...
[ link to this | view in chronology ]
Re: Re: Re: Learn to read first
The subject of the email is phishing, which I called spam. Spam and phishing are about the same. You think all those unsolicited ads are for legit businesses? I bet you've never responded to one. How do you know theyre not scams also? As soon as you buy rxm3ds with your credit card number, theyll go to town with it. The difference between phishing and spam is only a minor matter of technique.
And my points are still relevant, which is that in both cases it is people in possession of data that they are not authorized to have, used in ways they were not authorized to use it. The real problem here is that they have it and are using it, not that someone gave it up--willingly or negligently.
Stopping leaking of information is impossible. Utterly impossible. All you can do is create an ineffective chilling effect on industry by creating a climate of hostility towards data breaches and making people less likely to enjoy the fruits of the generosity with data.
You can't stop the spammers either but you can create a chilling effect if you're vicious enough.. and thats one industry we wouldnt mind chilling.
So pick your target.
[ link to this | view in chronology ]
Re: Re: Re: Learn to read first
[ link to this | view in chronology ]
Guns dont kill people, people do.
OK so personal information doesnt cause phishing, people do. So one might propose to stop the people that phish.
Then one might say 'hold on! the jerks that lose control of their guns and let kids and criminals use them to kill people are the real criminals'. This is the state of the art in data-breach discourse.
I am merely taking it one step further. Guns are not data. Information wants to be free. Trite, but true, I think. Go ahead and try and stop it from being free. Nothing is more futile.
The guns dont jump out of their gun safes on their own accord. Since data does, it requires a different treatment.
[ link to this | view in chronology ]