Cyber spying on universities explained

Cyber spying on universities is the practice of obtaining secrets and information without the permission and knowledge of the university through its information technology system. Universities in the United Kingdom, including Oxford and Cambridge, have been targets,^[1] as have institutions in the United States and Australia.^[2]

Universities are targets for cyber espionage due to the wealth of personally identifiable information they possess on students, employees, people who buy tickets to sporting events, and, if the university has an academic medical center, on patients treated there. Information about research projects with industrial or military application are also targets. The culture of information sharing within universities tends to make them easy targets.^{[3] [4] [5]}

Breaches can occur from people sharing credentials, phishing, web-crawlers inadvertently finding exposed access points, password cracking, and other standard hacking methods.^[4] University credentials are bought and sold on web forums, darknet markets and other black markets.^{[6] [7]}

The result of such efforts have included theft of military research into missile design or stealth technologies,^[8] as well as medical data.^[9]

As a precaution against such attacks, Stanford University advises its employees to take IT precautions when they travel abroad.^[10]

Moreover, in March 2018, the United States charged and sanctioned nine Iranians and the Iranian company Mabna Institute for hacking and attempting to hack hundreds of universities on behalf of the Iranian government.^{[11] [12] [13]}

Credentials used by Sci-Hub to access paywalled scientific articles have been subsequently used by hackers seeking to breach university firewalls to access other information.^[14]

See also

• List of data breaches

Notes and References

1. News: Yeung . Peter . Bennett . Rosemary . University secrets are stolen by cybergangs . The Times . 5 September 2017 . en.
2. News: Koziol . Michael . Major universities hit by data breach affecting thousands of job applicants at top firms . The Sydney Morning Herald . 8 June 2018 . en.
3. News: Thompson . Cadie . Hackers next big target: Your kids' college . CNBC . 21 August 2014.
4. News: Roman . Jeffrey . Universities: Prime Breach Targets . Data Breach Today . February 3, 2015 . en.
5. News: Campbell . Susan . Why schools are prime targets for data breaches . WPRI . 28 August 2018.
6. News: Guilford . Gwynn . For $390 you can illegally buy an elite university email account on China's biggest online marketplace — Quartz . Quartz . September 10, 2014 . en.
7. News: Public Service Announcement: Cyber-Related Scams Targeting Universities, Employees, And Students . FBI Internet Crime Complaint Center . May 5, 2014 . en.
8. News: Blair . Dennis C. . Alexander . Keith . Op-Ed: China's Intellectual Property Theft Must Stop . The New York Times . August 15, 2017 . en.
9. Web site: Columbia Medical Center, Hospital To Pay $4.8M Fine for Data Breach . iHealthBeat . . 8 May 2014 . 17 February 2015 . https://web.archive.org/web/20160207081508/http://www.ihealthbeat.org/articles/2014/5/8/columbia-medical-center-hospital-to-pay-4point8m-fine-for-data-breach . 7 February 2016 .
10. News: Foiling Cyberspies on Business Trips. Weed. Julie. November 13, 2017. The New York Times. en.
11. Web site: Foreign Economic Espionage in Cyberspace . US National Counterintelligence and Security Center (. 2018.
12. News: Volz . Dustin . U.S. charges, sanctions Iranians for global cyber attacks on behalf of Tehran . Reuters . March 23, 2018 . March 24, 2018.
13. News: Carpenter . Todd A. . FBI Indicts 9 Iranians who Targeted Scholars to Steal Content . The Scholarly Kitchen . 28 March 2018.
14. News: Pitts . Andrew . Guest Post: Think Sci-Hub is Just Downloading PDFs? Think Again - The Scholarly Kitchen . The Scholarly Kitchen . 18 September 2018.