Educational Security Incidents (ESI)

Quick Facts

• Date: 11/17/2008
• Institution: University of the Cumberlands
• Type of Incident: Penetration
• Number Affected: Unknown
• Source: Pogo Was Right
• Abstract Source: Lexington Herald-Leader, Kentucky Attorney General Press Release

Abstract
A University of the Cumberlands student has been arrested and charged with hacking into student email accounts and using the information to blackmail these students. According to a press release from the Office of the Attorney General, Sungkook Kim was charged with identity theft and unlawful access to a computer following an investigation by the AG's cybercrime unit and the Williamsburg police. The investigation discovered that Kim had installed spyware on campus library computers to capture user IDs and passwords of students and faculty using the computers.

Quick Facts

• Date: 11/13/2008
• Institution: University of Maine
• Type of Incident: Penetration
• Number Affected: 200
• Source: ESI
• Abstract Source: WCSH6, Bangor Daily News

Abstract
The University of Maine announced the arrest of a former student charged with illegally accessing hundreds of student email accounts. Following a three week investigation by the University of Maine campus police, the Maine State Police Computer Crimes Task Force and the United States Secrete Service charged former UMaine business student James Wieland with one count of aggravated criminal invasion of computer privacy. The university believes that Wieland is responsible for distributing a downloadable game through email that contained a trojan key logging program. Wieland allegedly sent the email to over 1,000 student email address and had gained access to over 200 accounts as a result. The university became aware of the incident after two students received emails from each other while riding on an airplane together. It is not known why Wieland wanted access to these accounts.

Quick Facts

• Date: 9/9/2008
• Institution: Carleton University
• Type of Incident: Penetration
• Number Affected: 32
• Source: Pogo Was Right
• Abstract Source: Ottawa Citizen
• Update1 Source: CBC

Abstract
Carlton University staff members are trying to figure out how an unknown individual(s) gained access to server containing Campus Cards information. Last week someone mailed the university a list of 32 accounts along with the passwords to those accounts. The unknown individual(s) could have used this information to access e-mails, course registration, library records and personal financial information about student loans and scholarships, as well as any money the students put on their Campus Cards. The Campus Cards can be loaded with money and used at 500 different venues on campus. The individual(s) then sent an email to all 32 individuals claiming to be an undergraduate math major who obtained the information using a keystroke logging program. The university has launched an investigation into this incident and has contacted the 32 affected individuals asking them to change their passwords and pickup a new Campus Card.

Update1
Carlton University has identified the student responsible for the computer breach. Mansour Moufid, 20, a second-year math student, is currently facing a fine and other sanctions for breaking into a Carlton University server. Moufid has dropped out of Carlton and will not appeal that charges. According to Moufid, the meetings he has had with the university are "just completely bogus". Moufid is due in court on October 15 to face criminal charges for his actions.

Quick Facts

• Date: 8/15/2008
• Institution: University of Otago
• Type of Incident: Impersonation
• Number Affected: 4
• Source: Pogo Was Right
• Abstract Source: Otago Daily Times

Abstract
Computer criminals were able to gain access to four University of Otago email accounts and use this access to send out 1.55 million spam messages. The computer accounts, belonging to university employees, were compromised after the university was targeted with a wave of "spear phish" emails asking recipients to respond with username and password information. The four employees do not face any disciplinary action but instead the university's information security office is using this as an opportunity to reach out to the university community.

Quick Facts

• Date: 7/25/08
• Institution: Georgia Highlands College
• Type of Incident: Penetration
• Number Affected: Unknown
• Source: ESI
• Abstract Source: The Atlanta Journal-Constitution

Abstract
Police arrested a Georgia Highlands College student, Christopher Fowler, on Thursday and charged Fowler with computer trespassing and unlawful eavesdropping. According to college officials more charges could be brought against Fowler. Fowler allegedly hacked into Georgia Highlands College computer system to alter his grades and steal passwords for other accounts. The Georgia Bureau of Investigations was called into help the investigation after the Kennesaw State University Police suspected Fowler gained unauthorized access to the Highland College systems.