By Dan Goodin in San Francisco for The
Register.
This story has been reproduced with permission.
Among those who received the 2006 email purporting to come from
officials with the IU Credit Union was Christopher Soghoian, a
graduate student of computer security who wanted to know how his
email address was targeted even though it had never been used.
University officials rebuffed his attempts to learn more about the
attack, so he filed a request under Indiana's public records
act.
It turns out the perpetrators, who had ties with a machine in
China, gained unauthorized access to the university's cluster of
computers reserved for research projects, according to university documents. Once in, the attackers
rifled through the cluster's /etc/passwd file, which revealed email
addresses and other information on as many as 30,000 active users,
including Soghoian, despite his never having applied for an
account.
The university cluster not only gave up information that proved
crucial in carrying out a successful spear phishing attack. It also provided the
ideal cover to help the attackers bypass spam filters. It further
proved a useful place to stash hacker tools used in other attacks,
including ones that targeted account holders of the Florida
Commerce Credit Union and the Sandia Laboratory Federal Credit
Union, according to Soghoian.
No word yet on whether admins have tightened security on IU's
system
© The Register
2007
