An attack on the University computer network that briefly interrupted Internet service for on-campus residents two weeks ago is back.
Beginning its second round as early as Monday night, the attack continues to cripple Internet service for on-campus students allowing little or no access to off-campus websites. Officials with Information Technology Services have found 600 student computers containing “back doors” which allow hackers to control the systems from a remote location and flood the network with outgoing messages on command.
The reappearance of what is being dubbed as a “Bot” attack is the result of systems that weren’t easily identifiable last time and have sat quietly until now, said Bruce Petryshak, chief information officer at the University.
“As long as they remain infected, then this thing can flare up and trigger quite easily,” he said. “So we need to get to those machines and get them cleaned up and we’re trying to work out a way that we can do that quickly.”
But a Bot attack shouldn’t be confused with a computer virus like the fast-spreading MS Blaster virus that hit campus during student move-in last fall, Petryshak said.
“There’s viruses, there’s worms and now they’re bots,” he said, laughing. “This is actually a whole different level.”
Instead, an undetected virus on the computer can create the “back door” making it easy for attackers to take control of the system at any time, posing not only network problems, but a threat to personal security, increasing the risk of identity theft.
“Once infected, then the machines make connections to sites of attacker’s choosing, and then are able to take control of the student’s machine to make them attack other machines and possibly expose personal information,” said Kent Strickland, information security officer with ITS.
And according to Petryshak, it only takes a small number of computers to clog even a “robust” network like the University’s. Only 50 of the 600 infected computers are the cause of this week’s slow service.
“It only takes a handful of them to create a big problem, and we’ve got quite a lot (in the residence halls),” Petryshak said. “These things really clog it up. It doesn’t matter how much bandwidth we purchase, these things will just eat it up.”
Staff members with Residential Computing Connection are contacting students with infected systems to take them off the network and clean their computers. Computers on the administrative network and in labs are not affected.
Starting from scratch is the only way to clear a computer from “back doors,” Strickland said.
“The best practice recommendation is for those students to reformat their hard drives and start over,” he said. “You cannot trust those systems any longer. Attackers have had access to them and there’s no telling what they’ve done with them.”
Keeping computers updated with anti-virus software, personal firewalls and watching what software and other files are downloaded is key for preventing future attacks, Petryshak said.
“All of that diligence being a good network citizen is really important because it avoids much of this,” he said. “We’ll do as much as we can to help (students), we’ll do as much as we can to control this and keep it out of the campus, but we need their help too.”
