Universities are increasingly being attacked by criminal hackers. Not only private data is at risk, the entire company can be paralyzed. But how do universities react to attacks? We tried it.
When the hackers attack his university, Thomas Grünewald is shocked. But he’s not surprised. “We were aware of certain risks and may have been wrong to accept them for too long,” says the President of the Niederrhein University of Applied Sciences when we asked him about it a few days later.
It was a lack of attention that opened the door for the intruders – with potentially far-reaching consequences: They gained access to an internal system by exploiting an unprotected interface. They smuggled in a program that helped them read files on a server, including the /etc/passwd file, which contains usernames that have access to the server.
The intruders’ next step would have been to search for passwords, configuration files, and private keys. It would take a ransomware gang some time, but they might have penetrated the heart of the university systems through this gap at some point, stole data and then encrypted everything, then demanded a ransom to unlock it. As is currently happening at the HAW Hamburg .
Attackers particularly like to strike between the years
The difference: In the case of the Niederrhein University of Applied Sciences, we were the intruders. “Rene Rehme, ethical hacker, and Eva Wolfangel, tech journalist,” is how we introduce ourselves in the email to the President and his security team warning of the vulnerability.
We put the IT security of Germany’s universities and colleges to the test by attacking some of them from outside – just as criminal attackers are currently doing on a massive scale: A good time to launch attacks was between Christmas and New Year, when the attention of IT managers is lower than usual.
That’s what malicious hackers do. At the turn of the year 2022/23, they targeted the city of Potsdam, the West Saxon University of Applied Sciences in Zwickau and the HAW Hamburg. Shortly before, it had hit Heilbronn University, Ansbach University, Ulm University of Applied Sciences, Münster University of Applied Sciences , Leipzig University of Applied Sciences and the University of Duisburg-Essen twice Attackers are blackmailed: They threaten to publish the captured data.
Are universities coveted victims or just poorly protected?
The starting point of our research was the question: If universities are currently being attacked so severely, is it because they are attractive victims – for example because there is interesting data? Or are they just poorly protected? From what we’ve seen over the past few weeks, the latter is definitely true. We not only found extremely critical gaps, but also sometimes malicious code that criminal attackers had already left in the IT systems – unnoticed by the universities themselves.
(c) Eva Wolfangel
