'Security Concerns' Caused Three-Day Internet Outage at the University of Michigan Last Week (cbsnews.com) 19
On August 30th the University of Michigan announced it had finally restored its internet connectivity and Wi-Fi network, according to the Ann Arbor News, "after several days of outages caused by a 'significant security concern,' officials said." The outage coincided with the first days of the new school year, although "classes continued through the outage."
The internet was shut down on 1:45 p.m. on Sunday, Aug. 27, after the Information Assurance team at the university identified a security concern, according to previous reporting. The Information Assurance team fights cybersecurity threats and malicious actors... The investigation into the security issue is ongoing and no other information will be released, said Santa Ono, president of University of Michigan.
But a local CBS station heard some theories from cybersecurity experts: "The fact that they took their systems down, like proactively took their systems down, is the indication that it is a cybersecurity incident," said co-founder and CTO of SensCy Dave Kelly. "The reason why you do that is that you don't want it to spread further."
"They probably didn't know to what extent they'd been compromised," senior penetration tester and ethical hacker at NetWorks Group Chris Neuwirth said. "They probably didn't know how many accounts were compromised or the initial entry point that the threat actor used to gain access into the network." Sources close to the investigation told CBS News Detroit that U-M detected malware on its Wi-Fi network and decided to shut it down in response.
So, did the school avoid a disaster? Neuwirth thinks it very well could have. "They likely had very robust backups and data recover, plans, procedures in place that helped them make the decision very confidently and rapidly," he said. "Four days in that they're already bringing up their systems tells me that it's likely that a lot of what they had been preparing for worked."
Kelly said these types of incidents are on the rise. "There's been a large increase in cybersecurity incidents," he said. It's been trending up, quite frankly, for the last several years. It used to be that these threat actors were targeting the government and Fortune 500 companies, but they've started to, more and more over the years, look at universities."
Thanks to long-time Slashdot reader regoli for sharing the news.
But a local CBS station heard some theories from cybersecurity experts: "The fact that they took their systems down, like proactively took their systems down, is the indication that it is a cybersecurity incident," said co-founder and CTO of SensCy Dave Kelly. "The reason why you do that is that you don't want it to spread further."
"They probably didn't know to what extent they'd been compromised," senior penetration tester and ethical hacker at NetWorks Group Chris Neuwirth said. "They probably didn't know how many accounts were compromised or the initial entry point that the threat actor used to gain access into the network." Sources close to the investigation told CBS News Detroit that U-M detected malware on its Wi-Fi network and decided to shut it down in response.
So, did the school avoid a disaster? Neuwirth thinks it very well could have. "They likely had very robust backups and data recover, plans, procedures in place that helped them make the decision very confidently and rapidly," he said. "Four days in that they're already bringing up their systems tells me that it's likely that a lot of what they had been preparing for worked."
Kelly said these types of incidents are on the rise. "There's been a large increase in cybersecurity incidents," he said. It's been trending up, quite frankly, for the last several years. It used to be that these threat actors were targeting the government and Fortune 500 companies, but they've started to, more and more over the years, look at universities."
Thanks to long-time Slashdot reader regoli for sharing the news.
It was all over the midwest US (Score:2)
Probably Compromised Systems (Score:5, Interesting)
Sources close to the investigation told CBS News Detroit that U-M detected malware on its Wi-Fi network and decided to shut it down in response.
That doesn't make sense. Maybe malware on computers connected to the WiFi? That HAS to be an ordinary day. My guess is that they detected suspicious outbound traffic from a few computers/servers and shut down the internet connection in response, then took several days to determine what had actually happened and restore servers to a known previous state or remove the malware and close the hack points. We may end up hearing what happened through a breach disclosure in the next couple of weeks.
Re: (Score:2)
Unplugging everything is not a bad tactic against an worm. If you have some plan in place to patch unaffected systems before plugging everything back in.
Re: (Score:2)
Re: (Score:2)
Re:Probably Compromised Systems (Score:4, Informative)
I have some inside knowledge on this one. The PR folks who were talking to the media and doing these releases keep confusing "WiFi" with "the network" and just about anything else techie.
The University of Michigan took down their core network in order to isolate the security incident. The most popular theory of the security incident is correct. In this case, it was targeting specific research data that is highly controlled. Additionally, there were some internal attacks going on the network that didn't seem targeted but was most likely used to distract the security teams from the actual target. Taking down the core network and essentially "unplugging" from the network was only way to disconnect the bad actors and make sure all systems were healthy before they could reconnect. And given how large and complex their network is, that takes a LONG time to audit and evaluate every system to make sure others weren't compromised.
The WiFi was just ancillary damage. It wasn't the core issue. Just constant bad reporting.
Re: (Score:2)
Just remember guys... (Score:2)
It's not question of IF you're going to get hacked, it's a question of WHEN.
Re: (Score:2)
What we need to do is define and then design/code/train to 'acceptable risk'. For commercial avionics, the goal is the residual risk for an aircraft loss from software is 10 ^ -9.
The problem we have now is the likelihood of a security failure looks to be something like 10 ^ -4
The perspective of "all software has bugs" and "you will be hacked" relieves developers and managers of the responsibility to prevent that as much as possible.
Ask Boeing what their 737 MAX failures cost them. Now ask yourself, "How w
That's how you do it. (Score:1)
First thing I did at a former employer when we were showing signs of compromise. Came in on a Sunday specifically to just turn everything off as soon as possible.
All servers off, all power out, every single desktop and laptop in the building collected and put into a locked room.
Had the boss's backing throughout - he even helped collect the machines from across the site and make sure we'd got every device.
Then we started the servers back up extremely carefully from absolutely blank drives, and re-imaged eve
Re: (Score:2)
I for one say, thank you!
I wonder if anyone has ever done a study of how much of the world works because of unknown and selfless people making the effort in the face of resistance to do the right thing.
VPN still down for some (Score:1)
Vectors of attack (Score:1)
Re: Vectors of attack (Score:1)
Study (Score:1)