I’ve had to handle a number of computer security breaches. Causes vary. It’s rarely because of any hardware. Often software is at fault, containing security holes that have gone unpatched – it’s amazing how often people forget that you’re only as secure as your last update. But a lot of the time, it’s the wetware at fault: human beings. Passwords simple enough to fall to a dictionary attack, which every public server gets subjected to daily, or stuck on a post-it note somewhere; shortcuts that deliberately circumvent security provisions to speed up certain processes; security by obscurity being less obscure than hoped.
The release of a zip file from a server at the University of East Anglia was a security breach. What was the cause? There have been attempts to examine this, analyse email headers and so forth. I’ve never known how that was supposed to help – the mails had all been rolled up into a zip file before they were downloaded. So did someone gain unauthorised access to grab this file? I doubt it.
No explanation of how anyone gained access of some kind (telnet, ssh, ftp etc) has been released. If there had been a hole of this nature, I’d have expected it to have become known by now. But there’s a good reason to think there was no such access and that, from the point of view of the CRU, the problem lay with the wetware.
The proposition that there was a hack boils down to this: someone managed to gain access to a CRU server and lo! There was a fat zip file containing all these files. It’s wholly implausible.
The files were leaked.
