April 14, 2004, 3:06 PM — Malicious hackers in recent weeks have infiltrated computer systems at universities in the U.S. and worldwide, leading to questions about the security of scientific research data, according to an official at the U.S. National Science Foundation.
The systems were located at universities and research facilities that operate high-performance computer centers, including facilities that are part of a project funded by the U.S. National Science Foundation (NSF) and called TeraGrid, said Sangtae Kim, director of the Division of Shared CyberInfrastructure at the NSF, an independent U.S. government agency.
Supercomputing centers at U.S. universities including the National Center for Supercomputing Applications (NCSA) at the University of Illinois at Urbana-Champaign and the Center for Advanced Computing Research (CACR) at the California Institute of Technology are partners in the TeraGrid project.
Systems at TeraGrid partner facilities were hacked, but no systems that make up TeraGrid itself were compromised, Kim said.
NSF does not know who was behind the attack, but believes it was part of a much larger action that affected high-end systems worldwide, including sites in Europe. Many of the compromised systems are connected to university research centers, he said.
Stanford University's Information and Technology Systems and Services (ITSS) group published a security alert on Saturday warning researchers about compromises of a number of systems running the Sun Solaris and Linux operating systems on the Stanford campus. The advisory also noted that the attacks were part of a move against "a large number of research institutions and high performance computing centers."
The university became aware of the intrusions after users noticed discrepancies in the time of their last reported log-in, which indicated that their log-in information had been hijacked. Other systems began performing poorly or reporting errors after the intruders installed so-called "rootkits," or programs that allow the malicious hacker to disguise his or her presence and gather information such as user names and passwords from the compromised system, the ITSS alert said.
Attackers gained access to the systems by cracking or sniffing passwords from insecure network traffic such as Telnet remote communications sessions or from password files on other compromised systems, according to the alert.
Once logged on to a system, the attackers looked for systems that were not up to date with their operating system patches, then used known software exploits to elevate their privileges from user to administrator (or "root") status.
Other systems fell to hackers because of loose security configuration for Network File Service (NFS), a way to share files and directories over networks or the Internet. Many institutions applied loose security to these shared directories to "facilitate the distribution of system management and data processing tasks," the advisory said.
The ITSS group recommended that compromised systems be taken off the network and completely rebuilt, with new versions of the operating system and up-to-date patches installed.
Universities that cooperate to conduct scientific research are particularly susceptible to compromise because of the open nature of their mission, according to Jonathan Bingham, president of Intrusic Inc., in Waltham, Massachusetts, which sells technology to spot covert and illicit activity on computer networks, which it terms "noiseless action."
"You've got large groups of individuals trying to access systems from all over world, so universities commonly have portions of their network set up almost like the Internet, in that access is wide open," he said.
Malicious hackers can easily gain access to less secure areas of a university's network, then listen to network traffic to capture the credentials needed to access more sensitive areas, he said.
While some experts raised the specter of massive denial of service (DoS) attacks using the hijacked supercomputers, the real threat to the TeraGrid project and the universities that got hacked is from stealthier behavior, such as quietly leaking sensitive research data or discoveries from compromised research machines, Bingham said.
While rebuilding and patching compromised systems will close the holes that intruders used, it is no guarantee that the malicious hackers behind the compromise do not still have access to the sensitive networks.
"Once they're in a network of this size and scope, they're going to compromise other systems using stealth techniques that are different from the ones they used to get in. Once you figured out (the compromise) and know what systems are vulnerable, they're already on a different system," he said.
