Security gaps exploited in grade scandal remain, may be difficult to close

Washington Post: Montgomery County school officials have not yet closed gaps in their computer system that allowed students at a high-performing Potomac high school to change dozens of grades using a device that can be bought from Amazon.com for $69. And other school systems, including Fairfax County, remain just as vulnerable, school officials said Tuesday.... At least eight students at Winston Churchill High School are believed to have used the readily available device to obtain teachers' passwords for the school system's grading system. ... Computer experts said that Churchill teachers were lucky to catch the students. Just about every school system that protects its teachers' data with a simple username and password is vulnerable, experts said, and accessing a teacher's computer files is extremely common. ... "That's the first hack that every kid who becomes a criminal has done," said Alan Paller, director of research at the SANS Institute, an information security group.

Read more ...

Criminal investigation opened in grade-changing scandal at Churchill High

Washington Post: The Montgomery County state's attorney has opened a criminal investigation into a grade-changing scheme at Winston Churchill High School, officials said Wednesday, elevating the digital subterfuge into a major scandal at one of the region's most prestigious public schools.... Police, prosecutors and school officials are examining the actions of at least eight students who allegedly used a USB device to steal teachers' passwords and change the grades of 54 students. Nearly 700 student records have been subpoenaed, and three of the eight students identified as ringleaders have left the school.

Read more ...

Cyber Crooks Target Public & Private Schools

What's happening: It's not just businesses that are losing money to cybercriminals. This post shows that schools are also at risk. We can conclude, by inference, that not-for-profits are being hit as well. The news just hasn't surfaced.

What it means: Every small and medium size organization is at financial risk from cybercrime.

What to do: Management must get on top of this problem. Check bank transactions daily. Train staff to recognize cybercrime danger signs. Tightly manage technology controls. Consider a separate PC used only for on-line banking. Check your cyber-insurance. Be prepared to sue your bank: Email our Guide An Emerging Information Security Minimum Standard of Due Care to your attorney.


**********************************

Brian Krebs: Washington Post: A gang of organized cyber criminals that has stolen millions from businesses across the United States over the past month appears to have turned its sights on public schools and universities.

On the morning of Aug. 17, hackers who had broken into computers at the Sanford School District in tiny Sanford, Colorado initiated a batch of bogus transfers out of the school's payroll account. Each of the transfers was kept just below $10,000 to avoid banks' anti-money laundering reporting requirements, and went out to at least 17 different accomplices or "money mules" that the attackers had hired via work-at-home job scams.

http://voices.washingtonpost.com/securityfix/2009/09/cyber_mob_targets_public_priva.html?wprss=securityfix