Back to school might be a little riskier this year when it comes to your data. Hackers have infiltrated the systems of 62 colleges according to the US Department of Education in a security briefing last week.
It looks like criminals were able to exploit an authentication vulnerability in a commonly used enterprise resource planning application.
ZDNet reports that the attackers are also compiling lists of potential targets by scanning for other institutions that are vulnerable to the flaw. The affected application, Ellucian Banner ERP, is implemented by more than 1,400 institutions. Ellucian released a fix for the flaw in May, but some customers presumably haven’t applied yet the patch.
After exploiting the vulnerability, the attackers began running scripts in the admissions and enrollment sections of the app to create thousands of fake student accounts, Department of Education officials said.
The officials said these fake accounts were then used for criminal activity, although they didn’t specify which type of crimes were involved. Whatever the crimes may have been, fraudulent account creation is never a good thing.
Ellucian disagrees with the Department of Education’s assessment, and believes the activity is unrelated to the flaw in its application. The company claims the attacks extend to institutions that don’t use its products, and it blames automated attacks against application portals.
“Attackers are utilizing bots to submit fraudulent admissions applications and obtain institution email addresses through admission application portals,” Ellucian said in a statement. “Ellucian recommends adding reCAPTCHA capabilities to the admission process to reduce the likelihood of experiencing fraudulent applications for admissions, even if institutions are not currently experiencing this issue.”
Regardless of whether the attacks involve Ellucian’s product, the company does agree with the Department of Education’s advice to apply patches and take proactive measures against fraudulent activity. New-school security awareness training can help students, faculty, and staff defend themselves against phishing attacks.
If you need assistance with your business cybersecurity needs contact DarkHound SecOps at [email protected]
Additional Resources: https://www.ed.gov/news/press-releases/department-releases-new-guidance-protecting-student-privacy-while-using-online-educational-services