The US Department of Education warned last week that 62 colleges were exposed to criminals who exploited an authentication vulnerability in a popular enterprise resource planning application.
ZDNet reports that the attackers are also compiling lists of potential targets by scanning for other institutions that are vulnerable to the flaw. The affected application, Ellucian Banner ERP, is implemented by more than 1,400 institutions. Ellucian released a fix for the flaw in May, but some customers presumably haven’t applied yet the patch.
After exploiting the vulnerability, the attackers began running scripts in the admissions and enrollment sections of the app to create thousands of fake student accounts, Department of Education officials said.
The officials said these fake accounts were then used for criminal activity, although they didn’t specify which type of crimes were involved. Whatever the crimes may have been, fraudulent account creation is never a good thing.
Ellucian disagrees with the Department of Education’s assessment, and believes the activity is unrelated to the flaw in its application. The company claims the attacks extend to institutions that don’t use its products, and it blames automated attacks against application portals.
“Attackers are utilizing bots to submit fraudulent admissions applications and obtain institution email addresses through admission application portals,” Ellucian said in a statement. “Ellucian recommends adding reCAPTCHA capabilities to the admission process to reduce the likelihood of experiencing fraudulent applications for admissions, even if institutions are not currently experiencing this issue.”
Regardless of whether the attacks involve Ellucian’s product, the company does agree with the Department of Education’s advice to apply patches and take proactive measures against fraudulent activity. New-school security awareness training can help students, faculty, and staff defend themselves against phishing attacks.
ZDNet has the story: https://www.zdnet.com/article/hackers-breach-62-us-colleges-by-exploiting-erp-vulnerability/