[clug] Hack attack on University of East Anglia's Climatic Research Unit

[Daniel Pittman]

David Howe <david at qednet.biz> writes:

> Any thoughts from clugers about the likely route the hackers took?

Nope.  It is pretty much impossible to know without access to the technical
details from the site.

If you are looking for a general lesson to take home, the most commonly
disclosed causes of attacks like this are:

1. Someone uses the same username and password for their corporate or
   University login that they do for a low-value online site, and someone
   obtains those credentials.

2. Someone uses a weak password, full stop.

3. Someone didn't keep patches up to date, so a three year old vulnerability
   got exploited for the attacker to get in.

> Would this have been overly difficult?

Almost certainly not.  Security at most places is weak, at best, especially if
you can get inside the perimeter.  A University is very porous in that regard,
and often has "special" needs for people who are politically positioned well
enough to have exceptions made to general security rules.[1]

However, without knowing the detail we can only speculate.

        Daniel

Footnotes: 
[1]  Much like a corporation, actually.

-- 
✣ Daniel Pittman            ✉ daniel at rimspace.net            ☎ +61 401 155 707
               ♽ made with 100 percent post-consumer electrons