Athena Hacker Caught by IS&T
By Marissa VogtNEWS EDITOR
MIT has caught the perpetrator of last week’s Athena security breach, which compromised over 600 passwords.
According to a statement released by Jeffrey I. Schiller ’79, network manager for Information Services and Technology, the person was identified last Saturday and has admitted responsibility in the incident.
“We are not at liberty to disclose additional information about the incident or this person's identity, nor can we discuss whatever disciplinary action, if any, will be taken,” the statement said. The statement also said that the internal investigation is continuing.
Schiller declined to comment on the identity of the hacker and the means by which IS&T caught the perpetrator. “You don’t ask the CIA how they do their work,” Schiller said.
Schiller said that even the hacker is probably not certain how he or she was caught and was “probably surprised.”
An e-mail to the hacker’s Yahoo! account requesting comment received no reply.
Hacker facing disciplinary action
Though the individual was identified last weekend, the decision to release the information was not made until now because it had to be confirmed by several layers of management at MIT, not just within IS&T, Schiller said.
The case is now being handled through “MIT’s normal disciplinary matters,” Schiller said. He declined to comment on whether law enforcement was involved with the investigation or would be consulted in the disciplinary process.
Schiller said IS&T has not done anything to restrict the person’s access to Athena and would only do so in a case where they felt a person posed an “imminent threat.”
“I do not believe this person poses a risk to the community right now,” Schiller said.
Private information not abused
Schiller said that IS&T is confident but “not guaranteeing” that personal information was not accessed by the hacker or anyone else, since the compromised passwords were reset very quickly.
“At this point we are confident that no one's private information was compromised or abused in any way,” Schiller’s statement said.
“We have no reason to believe the individual compromised them,” Schiller said. “That’s not what this is about.”
An earlier statement by the hacker had criticized the current level of security on Athena, stating a purpose of convincing IS&T to change its security policy.
Though prevention of attacks is difficult because the root password is available, steps will be taken to make sure that IS&T will be notified if someone does something like this again, Schiller said.
“We are going to be taking steps to make this much harder to do,” Schiller said. He said that because IS&T will not publicize the methods for detecting future hackers, they will function as silent alarms, where “you don’t know what you did to set it off.”
View Archives