Malicious hackers in recent weeks have infiltrated computer systems at universities in the U.S. and worldwide, leading to questions about the security of scientific research data, according to an official at the National Science Foundation.
The systems were located at universities and research facilities that operate high-performance computer centers, including facilities that are part of a project funded by the National Science Foundation (NSF) and called TeraGrid, said Sangtae Kim, director of the Division of Shared CyberInfrastructure at the NSF, an independent U.S. government agency.
Supercomputing centers at U.S. universities including the National Center for Supercomputing Applications (NCSA) at the University of Illinois at Urbana-Champaign and the Center for Advanced Computing Research (CACR) at the California Institute of Technology are partners in the TeraGrid project.
Systems at TeraGrid partner facilities were hacked, but no systems that make up TeraGrid itself were compromised, Kim said.
NSF does not know who was behind the attack, but believes it was part of a much larger action that affected high-end systems worldwide, including sites in Europe. Many of the compromised systems are connected to university research centers, he said.
Stanford University's Information and Technology Systems and Services (ITSS) group published a security alert on Saturday warning researchers about compromises of a number of systems running the Sun Solaris and Linux operating systems on the Stanford campus. The advisory also noted that the attacks were part of a move against "a large number of research institutions and high performance computing centers."
The university became aware of the intrusions after users noticed discrepancies in the time of their last reported log-in, which indicated that their log-in information had been hijacked. Other systems began performing poorly or reporting errors after the intruders installed so-called "rootkits," or programs that allow the malicious hacker to disguise his or her presence and gather information such as user names and passwords from the compromised system, the ITSS alert said.
Attackers gained access to the systems by cracking or sniffing passwords from insecure network traffic such as Telnet remote communications sessions or from password files on other compromised systems, according to the alert.
Once logged on to a system, the attackers looked for systems that were not up to date with their operating system patches, then used known software exploits to elevate their privileges from user to administrator (or "root") status.
Other systems fell to hackers because of loose security configuration for Network File Service (NFS), a way to share files and directories over networks or the Internet. Many institutions applied loose security to these shared directories to "facilitate the distribution of system management and data processing tasks," the advisory said.
The ITSS group recommended that compromised systems be taken off the network and completely rebuilt, with new versions of the operating system and up-to-date patches installed.
Rss FeedRss Feed
The Leader in Network Knowledge
Comment