April 26, 2024

Harvard Hacked Staff E-Mails

The searches, first reported by The Boston Globe, involved the e-mail accounts of 16 resident deans, but most of them were not told of the searches until the last few days, after The Globe inquired about them. Resident deans straddle the roles of administrators and faculty members, teaching classes as lecturers while living in Harvard’s undergraduate residential houses as student advocates and advisers.

In August, an administration memo to the resident deans, on how to advise students being brought up on cheating charges before the Administrative Board, a committee of faculty members responsible for enforcing regulations, made its way to news organizations. The e-mail searches were intended to find the source of leak, but no one was disciplined in the matter.

Last August, Harvard publicly revealed that “nearly half” the students in a large class were suspected of having cheated on a take-home final exam in the spring of 2012 — either working together in violation of instructions, or outright plagiarizing material. Students identified the class as a government course with 279 people enrolled.

Harvard declined to comment on Saturday about the e-mail searches, but offered what appeared to be an oblique defense.

“If circumstances were to arise that gave reason to believe that the Administrative Board process might have been compromised, then Harvard College would take all necessary and appropriate actions under our procedures to safeguard the integrity of that process, which is designed to protect the rights of our students to privacy and due process,” Michael D. Smith, dean of the Faculty of Arts and Sciences, said in a prepared statement.

The handling of the search — if not the search, itself — may have contradicted the Faculty of Arts and Sciences policy on electronic privacy, and faculty members interviewed said they expected a backlash. The privacy policy states that the administration can search faculty members’ electronic records “in extraordinary circumstances such as legal proceedings and internal Harvard investigations.”

But it also says that a faculty member must be notified in advance of such a search, “unless circumstances make prior notification impossible, in which case the faculty member will be notified at the earliest possible opportunity.”

Over months of investigations and hearings by the Administrative Board, some of the accused students insisted that their degree of collaboration was no more than the accepted norm, and that the professor and teaching fellows were partly to blame. The episode drew particular attention because the class was popular with varsity athletes, some of whom left school rather than face the loss of a year of athletic eligibility.

On Jan. 31, Dr. Smith said that “somewhat more than half” of those cases resulted in students being required to withdraw, putting the number forced out at roughly 70.

Article source: http://www.nytimes.com/2013/03/10/education/harvard-searched-staff-e-mails.html?partner=rss&emc=rss

Google Says Hackers in China Stole Gmail Passwords

In a blog post, the company said the victims included senior government officials in the United States, Chinese political activists, officials in several Asian countries, military personnel and journalists.

It is the second time Google has pointed to an area of China as the source of an Internet intrusion. Its latest announcement is likely to further ratchet up the tension between the company and Chinese authorities.

Last year, Google said it had traced a sophisticated invasion of its computer systems to people based in China. The accusation led to a rupture of the company’s relationship with China and a decision by Google not to cooperate with China’s censorship demands. As a result, Google decided to base its Chinese search engine in Hong Kong.

The more recent attacks were not as technically advanced, relying on a common technique known as phishing to trick users into handing over their passwords. But Google’s announcement was unusual in that it put a spotlight on the scale, apparent origins and carefully selected targets of a coordinated campaign to hijack e-mail accounts.

Google said that once the intruders had logged into the accounts, they could change settings for mail forwarding so that copies of messages would be sent to another address. The company said it had “disrupted” the campaign and had notified the victims as well as government agencies. Executives at Google declined to comment beyond the blog post. The company recommended that Gmail users take additional security steps, like using a Google service known as two-step verification, to make it more difficult to compromise their e-mail accounts. But it emphasized that the password thefts were not the result of a general security problem with Gmail.

Google acknowledged that it had been alerted to the problem in part by Mila Parkour, a security researcher in Washington who posted evidence of a type of phishing attack on her blog in February. She documented examples of what has recently been described as a “man-in-the-mailbox” attack, in which the intruder uses the account of one victim and his e-mail contacts to gain the trust of a new victim.

Ms. Parkour wrote that the method used in this attack “is far from being new or sophisticated,” but that she was posting information about it because of “the particularly invasive approach of the attack.”

She highlighted a fake document titled “Draft US-China Joint Statement” that was circulated among people with e-mail accounts at the State Department, the Defense Department, the Defense Intelligence Agency and Gmail. Clicking to download the document directed users instead to a fake Gmail log-in page that captured their passwords.

Caitlin Hayden, a spokeswoman for the National Security Council, said the White House was looking into the matter.

“We have no reason to believe that any official U.S. government e-mail accounts were accessed,” Ms. Hayden said in an e-mail.

Google said the attacks apparently originated in Jinan, a provincial capital in eastern China. The city is a regional command center for the Chinese military, one of seven in the country. It is also home to the Lanxiang Vocational School, which was founded with military support. Last year, investigators looking into the attack on Google’s systems said they had traced some of the hacking activity back to the school.

At the time, government and school officials strongly denied any connection with the attack, and China’s foreign ministry said linking the Chinese authorities to such attacks was “baseless, highly irresponsible and hype with ulterior motives.”

That earlier attack appeared to be aimed at gathering information on human rights activists who were involved in political campaigns aimed at China. It was part of a wave of attacks that hit a range of American companies beginning in mid-2009 and that was first publicly disclosed by Google in January 2010.

Chinese government media officials were not immediately available to comment on Google’s latest announcement.

Rafal Rohozinski, a network security specialist at the SecDev Group in Ottawa, said it was impossible to lay blame for the campaign on the Chinese government with any certainty. Because of the borderless nature of the Internet, it is easy for intruders to connect through a series of countries to mask their identities. “The fact that someone is harvesting Gmail credentials is not surprising,” Mr. Rohozinski said.

This year, the Chinese government has stepped up its controls over the Internet within the country, with increased scrutiny of news and blog sites, particularly in the wake of political upheaval in North Africa and the Middle East.

The government has also apparently crippled some virtual private network services, or VPNs, which have been used by Chinese and expatriates to gain access to corporate e-mail or get around controls that block many Web sites from being entered in China, like YouTube, Facebook and Twitter.

Security specialists said the Google warning to users was an indication that efforts to place the responsibility for Internet security on individuals was failing.

“I think this is impossible to solve by going to one user at a time and trying to teach them how to behave on the Internet,” said Nir Zuck, founder and chief technology officer of Palo Alto Networks. “It doesn’t matter how much education you put into it — you will always have end users that will make a mistake.”

John Markoff reported from San Francisco and David Barboza from Shanghai.

Article source: http://www.nytimes.com/2011/06/02/technology/02google.html?partner=rss&emc=rss