Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

3/29/2017
10:55 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Millions of Stolen US University Email Credentials for Sale on the Dark Web

Researchers find booming underground market for stolen and fake email credentials from the 300 largest universities in the US.

Stolen email addresses and passwords from the largest US universities are offered for sale on the Dark Web at anywhere from $3.50 to $10 apiece.

But that's only a snapshot of a lucrative underground market for pilfered – and even spoofed and phony - student, faculty, staff, and alumni email credentials, according to new research published today by the nonprofit Digital Citizens Alliance (DCA) that searched the Dark Web for credentials from the top 300 US universities.

With the help of research firm ID Agent, they found 13,930,176 credentials from those big schools, with the University of Michigan (122,556), Penn State (119,350), University of Minnesota (117,604), Michigan State (115,973), and Ohio State (114,032), with the most credentials for sale, and MIT with the biggest ratio of stolen and spoofed email addresses to number of enrolled and staff, 2.81:1, followed by Carnegie Mellon University, 2.4:1, Cornell University, 2.39:1, and others.

"I've been scraping the Dark Web since 2009. There were 2.2 million .edu [emails] there back in 2015, 2.8 million in 2016, and now almost 14 million a year later. That's a significant spike," says Brian Dunn, managing partner at ID Agent.

Source: DCA
Source: DCA

Dunn says the massive increase likely has to do with third-party website breaches, where university users register with their .edu email addresses with social media, e-commerce, and other websites that suffered breaches, either reported or unreported. "There have been significant third-party breaches in 2016," he notes. ID Agent has seen a 547% increase in all types of credentials (including universities') for sale in the Dark Web over the past three years. Think big breaches at Yahoo, DropBox, LinkedIn, and others.

The caveat, however, is that the researchers don't know how many of the stolen passwords are valid (they can't legally confirm that). Also, some of the emails are spoofed or phony, but DCA notes that doesn't mean they aren't a danger to a university: spoofed emails are often used in phishing attacks. Also, the report only looked at the largest US universities, so other high-profile but smaller-enrollment universities weren't included.

Purveyors of the .edu credentials in the Dark Web are typically cybercriminals, hacktivists, and scammers, the researchers say.

"[The] .edu [domain] is a generally valuable email domain just like .gov and .mil," Dunn says.

Source: DCA
Source: DCA

Buyers can use those stolen credentials to cash in on university discounts, such as software and Amazon Prime memberships, for example. They also can use them for phishing or gaining further access to university financial, research, and other potentially lucrative information.

Many breaches of all types begin with stolen user credentials. Dunn says one of his firm's clients estimates that 94% of network login attempts are executive via automated scripts of reused credentials. "When you [an attacker] can automate that with a script, you can have tremendous amount of success."

A University of Michigan spokesperson said the majority of the U-M credentials found in the study likely were the source of students, staff, and alumni, using their school email address when registering for third-party websites, and they don't indicate any new threats to the university.  Even so, "we explicitly discourage" using UMICH passwords for other online accounts.

"Our Information Assurance group, and other Big 10 IT security organizations, have analyzed the report and have determined that there is no new risk or significant threat to the university's systems or data," the spokesperson said, adding that the university has tools and processes that "help limit any exposure" when user accounts are compromised.

But the spokesman pointed out that "there is no evidence that the accounts and credentials were valid - at U-M or elsewhere."

Ohio State University said DCA's report doesn't indicate any new threats to OSU. "Together with our peer institutions, the university has reviewed the report and determined that there is no new risk or significant threat to the university's systems or data. Ohio State has a robust security framework which complies with industry standards and includes a number of technology tools and processes to limit exposure for potentially compromised accounts," an OSU spokesperson said in a statement.

Hacked university emails and credentials have been in the spotlight plenty of times before. The Research and Education Networking ISAC (REN-ISAC) last year notified universities about the compromise of some 2.2 million user credentials. And back in 2012, the hacktivist group Team GhostShell dumped on Pastebin some 36,000 names, email usernames and passwords, phone numbers, and other personal online information of students, faculty, and staff from 53 of the largest universities in the world, including Michigan, Harvard, Stanford, Cornell, Johns Hopkins, and Carnegie Mellon.

DCA, while working on its project, reached out to Team GhostShell via Twitter and ended up communicating via email for several months with a member of GhostShell who claimed to be the the leader of hacktivist group Team GhostShell, "DeadMellox," who last year came out of the shadows and gave his name as Razvan Eugen Gheorghe, 25, based in Bucharest, Romania. Razvan told the DCA that the data he leaked was only the tip of the iceberg and higher-ed personal information is constantly being abused.

In an email exchange with Dark Reading arranged via DCA, Razvan pointed out that the higher-ed credentials for sale in the Dark Web represent a small portion of the overall problem.  "The findings themselves of those so called millions of stolen credentials represent a spec of private information compared to the overall hacking that's being done on a daily basis all around the net," he wrote.

Razvan, whose identity as DeadMellox could not be confirmed by Dark Reading, said it's up to the higher-ed institutions to school their users on security threats. "It's better to have young students and people in general learn about cybersecurity from their schools, rather than some shady hacker marketplace online," he said in the email.

Source: DCA
Source: DCA

The basic goal of the DCA report was to shed light on the Dark Web's abuse of .edu email accounts and credentials. "We wanted to give their [universities'] IT security teams something they can use and talk about with administrators and stakeholders on the scale of the problem … what kind of challenges they are facing," says Adam Benson, deputy executive director of DCA.

University email accounts are juicy targets for opportunistic cybercriminals: "Some of these schools have thousands of people coming in every year with different levels of sophistication, and education about financial and medical records [for instance]" and may be using a credit card for the first time, he says. 

Related Content:

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
3/30/2017 | 12:14:28 PM
Re: "Majority"...?
"A University of Michigan spokesperson said the majority of the U-M credentials found in the study likely were the source of students, staff, and alumni" using their school email address when registering for third-party websites, and they don't indicate any new threats to the university. 

 

 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
3/29/2017 | 8:47:25 PM
"Majority"...?
"A University of Michigan spokesperson said the majority of the U-M credentials found in the study likely were the source of students, staff, and alumni"

Um, who else would there even be?

Okay, sure, probably a few professors emeriti.  But other than that?
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11547
PUBLISHED: 2020-04-05
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
CVE-2020-11548
PUBLISHED: 2020-04-05
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
CVE-2020-11542
PUBLISHED: 2020-04-04
3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the <KEY>MYKEY</KEY> substring.
CVE-2020-11533
PUBLISHED: 2020-04-04
Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).
CVE-2020-11529
PUBLISHED: 2020-04-04
Common/Grav.php in Grav before 1.6.23 has an Open Redirect.