600,000 Cambridge and Oxford Universities Email Addresses Found on Darknet

[DronVR]

600,000 Cambridge and Oxford Universities Email Addresses Found on Darknet

The cybersecurity firm found on the darknet about 600,000 email addresses associated with Oxford and Cambridge Universities.

A study by RepKnight, a cybersecurity firm, found more than 600,000 email addresses on a dark network connected to Cambridge or Oxford Universities. About 400,000 addresses are in Cambridge.

Earlier, in the darknet, a trend of selling so-called grading sheets was noticed, thanks to which you can get a university diploma. However, it is not known how much this option is working and whether it is possible to really provide these sheets as evidence of training in the above educational institutions. (approx. Pavluu - it is extremely doubtful, however, sales of such goods were really popular) This trend has been developing in the sale of email accounts.

By the way, last year, the Digital Citizens Alliance report found up to 14 million email addresses associated with 300 US universities hosted for sale on a dark network. Emails received from educational institutions pose a significant threat to cybersecurity, as they can be used to launch widespread phishing companies or to disseminate misinformation about educational institutions. The credibility of such letters is usually higher, so for scammers this is a significant advantage.

Research results
According to a RepKnight report, the study was based on a list of email addresses for each college, faculty, and administration department at associate universities. Researchers used a darknet web monitoring tool called BreachAlert.

The study found that more than half of the Oxford diplomas exhibited were associated with specific colleges, while 97% of the Cambridge diplomas were offered by faculty or university staff. Further analysis of 24 leading universities in the United Kingdom led to the discovery of nearly 5 million diplomas on sale, as well as 600,000 email addresses of students, staff and others involved in the educational process.

Why is this dangerous? The fact is that educational institutions collect an impressive amount of data about students and if you compromise these data, you can make good money from selling them on the dark. There are a lot of holes in the information security of most universities, since, as a rule, access to university information is made as simple as possible for students. From here various vulnerabilities are born that lead to similar leaks.

How to prevent these data leaks?
According to a report published by Gemalto , a company specializing in digital technology and cybersecurity, in the first half of 2017 there were 918 cases that created vulnerabilities that led to 1.9 billion compromised data records.

Data theft is the most popular cybercrime and these thefts account for about 70-75% of all crimes on the network. In the education sector, there is an increase in potential vulnerabilities (+ 103% per year) and + 4000% growth in compromised data. This suggests that criminals are well aware of the weaknesses of university cybersecurity and are actively using them.

So what measures should higher education institutions take to prevent this from happening?

• Use systems in which, in order to log in, you need to use not only a username and password (for example, a code word, a digital code from SMS, etc.)
• The system must use the location, time, and device data that are used to attempt to log in to decide whether to allow or deny access.

Students are also prone to sharing passwords, and this can contribute to the emergence of new vulnerabilities. Therefore:

• The system should be configured to prevent simultaneous logins, that is, the student should be limited to one session at any given time. This helps prevent an attacker from entering the system at the same time as a genuine student. In the event of a violation, students can be held accountable by checking their login history.
• Another way is to restrict access to student credentials. Students should only be allowed access to certain levels of the network, that is, they have limited access to confidential information. This can help ensure network security, as institutions have more control.

Conclusion
In addition, educational institutions should have appropriate software and tools for monitoring network traffic that will help in detecting malicious activities. Traffic needs to be scanned regularly, and it is also worth stopping the use of unofficial software on university computers.

The human factor also contributes significantly to data breaches, and therefore all parties involved must take special care to ensure that they do not disclose confidential information knowingly or unconsciously.

The dark network will always provide trading platforms through which cybercriminals can sell and buy credentials. Everyone should make sure there is no passport, ID card or anything else.

Source
Translation and notes: @pavluu