Ellucian Banner Data Breach Draws Federal Concern

guest · Jul 19, 2019

Ellucian Banner Data Breach Draws Federal Concern
Hackers may have accessed sensitive student data from over 60 colleges as the result of a security flaw in Ellucian’s widely used enterprise resource planning software
July 19, 2019
https://www.insidehighered.com/news...ecurity-flaw-highlighted-education-department

The U.S. Department of Education has warned of “active and ongoing exploitation” of a security flaw in Ellucian’s Banner system that may have given hackers access to student data such as grades, financial information and Social Security numbers.

A security alert, published Wednesday by the department’s Office of Federal Student Aid, said 62 colleges and universities using Banner had already been targeted. The alert indicates that criminals have been “scanning the internet looking for institutions to victimize” and drawing up lists of colleges to target.

According to Ellucian’s website, more than 1,400 institutions worldwide use Banner to manage student grades, staff payrolls, course schedules, admissions and student financial aid, among other tasks.
The National Institute of Standards and Technology described the Banner security flaw as an “improper authentication vulnerability” that enabled attackers to take over users' sessions when they attempted to log in.
Click to expand...

Why the FSA office is reporting on the Banner security flaw two months after it was patched by Ellucian is unclear. It is also not clear how the flaw was discovered, though the NIST advisory links to a document suggesting that it may have been identified as early as December 2018 by Joshua Mulliken, a member of IT staff at the University of South Carolina.

In a GitHub post, Mulliken outlines a “disclosure timeline” indicating that Ellucian took several months to address his concerns. Mulliken said via email that he was the first person to identify the security flaw.
"Ellucian has not been proactive in ensuring that its customers understand the seriousness of CVE-2019-8978," said Mulliken.
Click to expand...

guest · Aug 10, 2019

Ellucian vulnerability was not behind recent university cyberattacks
August 7, 2019
https://edscoop.com/ellucian-software-vulnerability-not-behind-attacks-against-universities/

No university information systems have been compromised as a result of a security flaw in Ellucian software, the Department of Education said in a notice Tuesday — going back on its claim last month that hackers had infiltrated 62 institutions by exploiting the flaw.

Instead, the notice says, the Department is investigating whether universities had fallen victim to “automation attacks,” which, instead of targeting a particular software vulnerability, send a barrage of registration attempts at front-end portals of university systems in the hopes of generating fraudulent accounts.

“We strongly encourage every institution to review these third-party front-end applications to ensure that they are not introducing vulnerabilities,” the notice reads.
The department still advised universities to make sure their Ellucian Banner software was up-to-date.

“Ellucian has conducted its own research and monitoring that has produced no evidence of any attempt to attack the known Banner vulnerability,” Ali Robinson, Ellucian’s director of media relations, wrote in an statement to EdScoop.
While the Education Department agreed that it had found no evidence for a link between the reported automation attacks and the Ellucian flaw, it said its investigation is ongoing.
Click to expand...

Notice: TECHNOLOGY SECURITY ALERT – Exploitation of Ellucian Banner System Vulnerability – Update #1

Log in or Sign up

Ellucian Banner Data Breach Draws Federal Concern

guest Guest

guest Guest

Log in or Sign up

Ellucian Banner Data Breach Draws Federal Concern

guest Guest

guest Guest

Useful Searches