Failure to patch flaw exposes data on 60,000 at Antioch

Personal data belonging to students, former students and employees may have been compromised

Windows systems may be the most frequently attacked by malicious hackers, but they certainly are not the only targets.

Serving as the latest reminder of that fact is Antioch University, which recently disclosed that Social Security numbers and other personal data belonging to more than 60,000 students, former students and employees may have been compromised by multiple intrusions into its main ERP server.

The breaks-in were discovered February 13 and involved a Sun Solaris server that had not been patched against a previously disclosed FTP vulnerability, even though a fix was available for the flaw at the time of the breach, university CIO William Marshall said Friday.

The university was alerted to the breach while IT officials were investigating a separate virus that had also infected the system and was broadcasting obscene material from it, Marshall said. That particular virus was programmed to broadcast the material on the 13th of each month and was detected by the university's antivirus software, when it started doing so on February 13, he said.

"When we went in and did further investigation, we found that there was an IRC bot installed on the system," Marshall said.

According to Marshall, the university ERP system, based at Antioch's main campus in Yellow Springs, Ohio, appears to have been breached on three separate occasions.

The first break-in occurred June 9, 2007, when intruders gained remote access to the ERP server via the unpatched Solaris FTP vulnerability. "The first one was an automated attack. It happened very, very quickly," Marshall said. The IRC bot discovered February 13 appears to have been installed on the system one day after the initial intrusion, he said. Forensic analysis shows that the third time the server was illegally accessed was October 11, 2007, Marshall said.

As far as the university can tell, the data on the server appears not to have been illegally downloaded or copied by the intruders, he said.

Following the discovery of the intrusions, the infected server was taken offline, the data on it was backed up and the operating system was reinstalled from scratch, Marshall said. "That's the only way we can be sure that we got everything on it that shouldn't be there," he said.

The compromised server contained information on current and former students and employees across all of Antioch's six campuses going back to 1996, Marshall said.

The system also contained information on individuals who had applied to Antioch but may have never attended the university and information on vendors who may have supplied their Social Security numbers in order to get paid. The compromised data included names, addresses, Social Security numbers, telephone numbers and academic records.

Notices informing the affected individuals about the breach and urging them to take measures to protect against ID theft were sent out last week, Marshall said. There are a couple of reasons for the delay, Marshall said. First, the university needed at least two weeks to understand the full scope of the breach, he said. The university also did not want to compromise investigations by law enforcement authorities by disclosing the breach prematurely, he said.

The main lesson from the intrusions is to make sure that patches get installed in a timely fashion whatever the environment, Marshall said. Just because Windows systems get patched and attacked the most often is no reason for getting complacent about security on other operating systems, he said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jaikumar Vijayan

Show Comments



Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >



Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?