Undisclosed Data Breach Helped Enable Phishing Scam At University

from the how-the-data-gets-used dept

Officials at Indiana University have concluded that a 2006 phishing attack against university members was made possible by an earlier breach of one of the university's main servers. This all came to light when one recipient of a phishing email -- a cybersecurity Ph.D. student -- wondered how an attacker could get his university email address, since he had never given it out to anyone. After requesting documents under the Indiana Public Records Act, the student discovered that the university had previously suffered an undisclosed breach, which is how the attacker obtained his information. This simple story underlines some important points. It shows that breaches aren't harmless; even if the stolen data isn't immediately used for direct fraud, it's likely to be used in other ways down the road. If stolen data can help a phisher do a better job of personalizing an email to make it look more legitimate, then that stolen data has value. The case also demonstrates the importance of disclosure. People whose data is lost need to be aware of it so that they can be on guard for fraud. When we hear about massive losses of data, such as the incidents at the Veterans Administration or TJ Maxx, it's easy to get lost in the staggering numbers and think of it all as an abstraction. But this incident shows, along with others before it, that breaches do have real consequences for the victims.
Hide this

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team


Reader Comments

Subscribe: RSS

View by: Time | Thread


  • identicon
    Anonymous Coward, 17 Apr 2007 @ 1:49pm

    What good are just plain email addresses? They still need your permission to spam you. Thats the law.

    The critical factor of permissions is often overlooked here. Why should you give up your personal information in the first place, to anyone? The answer is that you've also given them permission to use it.

    Those who receive your personal information as the result of a data breach do not receive with it your permission to do anything. Its just useless junk data.

    Without the force of consent, these bits and bytes have no value. I dont see whats the big deal

    link to this | view in chronology ]

  • identicon
    Wyatt, 17 Apr 2007 @ 2:09pm

    Humm

    Well if you think about it like this. An old lady gets her info injected into the world, say just an email address, name and some other basic stuff. She then gets an email from someone who says they know her and have all the info to prove it. This person could ask for a lot of things from this lady. She has trust for this person since they "know her". Not knowing that her info was leaked, she believes all of it.

    Your info will be leaked, it’s a problem that is almost impossible to avoid. The point of the post is that if your info is leaked you should be made aware of it. So that if you get an email from someone who "knows you", you can tell em to f-off. Otherwise anyone could be put in a situation of trust and give up things they should not. Permission is not something criminals or even gray area companies will care about. They will use the info regardless.

    link to this | view in chronology ]

  • identicon
    Josh, 17 Apr 2007 @ 2:34pm

    Seroiusly Anonymous Coward

    Since when do spammers care whether or not they are running a legal operation, or using legaal phone numbers?

    link to this | view in chronology ]

  • identicon
    Pete, 17 Apr 2007 @ 2:54pm

    Learn to read first.

    Wow. I love it when people are so exited to post first that they forget to read the article.

    This was not spem, It was Phishing.

    In case Mr. Anon up there doesn't know the difference. Spam is for the most part advertisements sent en mass to get you to buy something. spammers make money off the clicks. And no, they don't wait for your permission before sending you spam. If they did it wouldn't be spam, rather it wold be a legitimate opt in advertisement.

    PHISHING on the onther hand is an attemt to gain your trust to the point that you will be willing to disclose personal information that could be used to compromise your or somebody elses security.

    Working for AOL we were constantly recieveing mail about our secure ID's. This was an attempt to comprimise our servers.

    Back to the post. I would have to agree with Joe on this one. The act of not informing students who's data was lost is pure negligence. They had a right to know so they could take the steps necessary to ensure they did not become victems of fraud.

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 17 Apr 2007 @ 3:14pm

      Re: Learn to read first.

      spam is unsolicited email. phishings are unsolicited.

      email spam blockers block a number of things. I'm going to guess they try and block as much phishing as possible.

      hmm sounds like spam to me

      link to this | view in chronology ]

  • identicon
    Jon, 17 Apr 2007 @ 3:41pm

    Re: Re: Learn to read first

    Dear Anonymous,

    yes, you sure can call phishing spam. Nonetheless, that simply isn't the subject of this article.

    What the article does say:
    1) The more info you have about a person/user, the better your phising attempt will be : "breaches do have real consequences for the victims".
    2) People who's information has been ~stolen~ should be informed, in order to take appropriate measures or simply be on the look out.

    Spam is definitely unsollicited and mass mailings to non-optin users is illegal in most countries.

    You might think about googlin' for some definitions...

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 17 Apr 2007 @ 3:48pm

      Re: Re: Re: Learn to read first

      I think I know the definitions well enough, thanks. I'm sorry you disagree with them.

      The subject of the email is phishing, which I called spam. Spam and phishing are about the same. You think all those unsolicited ads are for legit businesses? I bet you've never responded to one. How do you know theyre not scams also? As soon as you buy rxm3ds with your credit card number, theyll go to town with it. The difference between phishing and spam is only a minor matter of technique.

      And my points are still relevant, which is that in both cases it is people in possession of data that they are not authorized to have, used in ways they were not authorized to use it. The real problem here is that they have it and are using it, not that someone gave it up--willingly or negligently.

      Stopping leaking of information is impossible. Utterly impossible. All you can do is create an ineffective chilling effect on industry by creating a climate of hostility towards data breaches and making people less likely to enjoy the fruits of the generosity with data.

      You can't stop the spammers either but you can create a chilling effect if you're vicious enough.. and thats one industry we wouldnt mind chilling.

      So pick your target.

      link to this | view in chronology ]

    • identicon
      Wyatt, 17 Apr 2007 @ 3:48pm

      Re: Re: Re: Learn to read first

      Or better yet, use your brain! So frustrating to read some of these posts from people that shouldn’t be able to tie their shoe, let alone type bla bla bla on a keyboard. My grammar may be bad, but at least I can consider things in a meaningful way.

      link to this | view in chronology ]

  • identicon
    Anonymous Coward, 17 Apr 2007 @ 4:01pm

    Allow me to produce the pertinent analogy:

    Guns dont kill people, people do.

    OK so personal information doesnt cause phishing, people do. So one might propose to stop the people that phish.

    Then one might say 'hold on! the jerks that lose control of their guns and let kids and criminals use them to kill people are the real criminals'. This is the state of the art in data-breach discourse.

    I am merely taking it one step further. Guns are not data. Information wants to be free. Trite, but true, I think. Go ahead and try and stop it from being free. Nothing is more futile.

    The guns dont jump out of their gun safes on their own accord. Since data does, it requires a different treatment.

    link to this | view in chronology ]


Follow Techdirt
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Discord

The latest chatter on the Techdirt Insider Discord channel...

Loading...
Recent Stories

This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it
Close

Email This

This feature is only available to registered users. Register or sign in to use it.