Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

3/29/2017
10:55 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Millions of Stolen US University Email Credentials for Sale on the Dark Web

Researchers find booming underground market for stolen and fake email credentials from the 300 largest universities in the US.

Stolen email addresses and passwords from the largest US universities are offered for sale on the Dark Web at anywhere from $3.50 to $10 apiece.

But that's only a snapshot of a lucrative underground market for pilfered – and even spoofed and phony - student, faculty, staff, and alumni email credentials, according to new research published today by the nonprofit Digital Citizens Alliance (DCA) that searched the Dark Web for credentials from the top 300 US universities.

With the help of research firm ID Agent, they found 13,930,176 credentials from those big schools, with the University of Michigan (122,556), Penn State (119,350), University of Minnesota (117,604), Michigan State (115,973), and Ohio State (114,032), with the most credentials for sale, and MIT with the biggest ratio of stolen and spoofed email addresses to number of enrolled and staff, 2.81:1, followed by Carnegie Mellon University, 2.4:1, Cornell University, 2.39:1, and others.

"I've been scraping the Dark Web since 2009. There were 2.2 million .edu [emails] there back in 2015, 2.8 million in 2016, and now almost 14 million a year later. That's a significant spike," says Brian Dunn, managing partner at ID Agent.

Source: DCA
Source: DCA

Dunn says the massive increase likely has to do with third-party website breaches, where university users register with their .edu email addresses with social media, e-commerce, and other websites that suffered breaches, either reported or unreported. "There have been significant third-party breaches in 2016," he notes. ID Agent has seen a 547% increase in all types of credentials (including universities') for sale in the Dark Web over the past three years. Think big breaches at Yahoo, DropBox, LinkedIn, and others.

The caveat, however, is that the researchers don't know how many of the stolen passwords are valid (they can't legally confirm that). Also, some of the emails are spoofed or phony, but DCA notes that doesn't mean they aren't a danger to a university: spoofed emails are often used in phishing attacks. Also, the report only looked at the largest US universities, so other high-profile but smaller-enrollment universities weren't included.

Purveyors of the .edu credentials in the Dark Web are typically cybercriminals, hacktivists, and scammers, the researchers say.

"[The] .edu [domain] is a generally valuable email domain just like .gov and .mil," Dunn says.

Source: DCA
Source: DCA

Buyers can use those stolen credentials to cash in on university discounts, such as software and Amazon Prime memberships, for example. They also can use them for phishing or gaining further access to university financial, research, and other potentially lucrative information.

Many breaches of all types begin with stolen user credentials. Dunn says one of his firm's clients estimates that 94% of network login attempts are executive via automated scripts of reused credentials. "When you [an attacker] can automate that with a script, you can have tremendous amount of success."

A University of Michigan spokesperson said the majority of the U-M credentials found in the study likely were the source of students, staff, and alumni, using their school email address when registering for third-party websites, and they don't indicate any new threats to the university.  Even so, "we explicitly discourage" using UMICH passwords for other online accounts.

"Our Information Assurance group, and other Big 10 IT security organizations, have analyzed the report and have determined that there is no new risk or significant threat to the university's systems or data," the spokesperson said, adding that the university has tools and processes that "help limit any exposure" when user accounts are compromised.

But the spokesman pointed out that "there is no evidence that the accounts and credentials were valid - at U-M or elsewhere."

Ohio State University said DCA's report doesn't indicate any new threats to OSU. "Together with our peer institutions, the university has reviewed the report and determined that there is no new risk or significant threat to the university's systems or data. Ohio State has a robust security framework which complies with industry standards and includes a number of technology tools and processes to limit exposure for potentially compromised accounts," an OSU spokesperson said in a statement.

Hacked university emails and credentials have been in the spotlight plenty of times before. The Research and Education Networking ISAC (REN-ISAC) last year notified universities about the compromise of some 2.2 million user credentials. And back in 2012, the hacktivist group Team GhostShell dumped on Pastebin some 36,000 names, email usernames and passwords, phone numbers, and other personal online information of students, faculty, and staff from 53 of the largest universities in the world, including Michigan, Harvard, Stanford, Cornell, Johns Hopkins, and Carnegie Mellon.

DCA, while working on its project, reached out to Team GhostShell via Twitter and ended up communicating via email for several months with a member of GhostShell who claimed to be the the leader of hacktivist group Team GhostShell, "DeadMellox," who last year came out of the shadows and gave his name as Razvan Eugen Gheorghe, 25, based in Bucharest, Romania. Razvan told the DCA that the data he leaked was only the tip of the iceberg and higher-ed personal information is constantly being abused.

In an email exchange with Dark Reading arranged via DCA, Razvan pointed out that the higher-ed credentials for sale in the Dark Web represent a small portion of the overall problem.  "The findings themselves of those so called millions of stolen credentials represent a spec of private information compared to the overall hacking that's being done on a daily basis all around the net," he wrote.

Razvan, whose identity as DeadMellox could not be confirmed by Dark Reading, said it's up to the higher-ed institutions to school their users on security threats. "It's better to have young students and people in general learn about cybersecurity from their schools, rather than some shady hacker marketplace online," he said in the email.

Source: DCA
Source: DCA

The basic goal of the DCA report was to shed light on the Dark Web's abuse of .edu email accounts and credentials. "We wanted to give their [universities'] IT security teams something they can use and talk about with administrators and stakeholders on the scale of the problem … what kind of challenges they are facing," says Adam Benson, deputy executive director of DCA.

University email accounts are juicy targets for opportunistic cybercriminals: "Some of these schools have thousands of people coming in every year with different levels of sophistication, and education about financial and medical records [for instance]" and may be using a credit card for the first time, he says. 

Related Content:

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
3/30/2017 | 12:14:28 PM
Re: "Majority"...?
"A University of Michigan spokesperson said the majority of the U-M credentials found in the study likely were the source of students, staff, and alumni" using their school email address when registering for third-party websites, and they don't indicate any new threats to the university. 

 

 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
3/29/2017 | 8:47:25 PM
"Majority"...?
"A University of Michigan spokesperson said the majority of the U-M credentials found in the study likely were the source of students, staff, and alumni"

Um, who else would there even be?

Okay, sure, probably a few professors emeriti.  But other than that?
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17424
PUBLISHED: 2019-10-22
A stack-based buffer overflow in the processPrivilage() function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers (serving firewall configuration files) to achieve Remote Code Execution or Denial Of Service via a crafted file.
CVE-2019-16404
PUBLISHED: 2019-10-21
Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter.
CVE-2019-17400
PUBLISHED: 2019-10-21
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
CVE-2019-17498
PUBLISHED: 2019-10-21
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a ...
CVE-2019-16969
PUBLISHED: 2019-10-21
In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.