Hackers Stealing High Grade Academic Research

Iranian hackers have reportedly breached top British universities, including Oxford and Cambridge, to steal what are “millions” of papers and academic research documents that they then put up for sale via WhatsApp and websites. 

Much of the subject matter is understood to be bland, but some of the papers covered topics including nuclear development and computer encryption.

Whoever stole the papers is reportedly selling them on Farsi language websites in addition to the end-to-end encrypted WhatsApp messaging app, where they’re going for as little as £2 (USD $2.63).

The intellectual property theft was initially reported last month by Secureworks researchers who discovered a URL spoofing a login page for a university: the tip of what turned out to be a credential-stealing iceberg. A deeper dive uncovered 16 domains containing over 300 spoofed websites and login pages for a global campaign targeting 76 universities located in 14 countries, including Australia, Canada, China, Israel, Japan, Switzerland, Turkey, the UK, and the US.
Secureworks tied the campaign to the Iranian government.

In February, the US indicted nine Iranian nationals for alleged computer intrusion, wire fraud, and aggravated identity theft. The indictment alleged that the men were involved in a scheme to obtain unauthorised access to computer systems, steal proprietary data from those systems, and sell the stolen data to Iranian customers, including the Iranian government and Iranian universities.

According to the FBI, each of the nine was affiliated with the Mabna Institute: a private government contractor based in Iran that worked for the Islamic Revolutionary Guard Corps. The FBI says that plundered organisations included about 144 US universities, 176 foreign universities in 21 countries, 5 federal and state government agencies in the US, 36 private companies in the US, 11 foreign private companies, and 2 international non-governmental organizations.

The hackers allegedly obtained access to university systems and research databases by phishing university staff and students, prompting them to reset their passwords at the spoofed domains that Secureworks uncovered last month.
Universities are, of course, a plum target for cyber-attackers, given the extremely valuable intellectual property that comes from research projects – particularly those concerned with national infrastructure, technology, and defense, be it cyber or on the battlefield.

After first discovering the spoofed sites, Secureworks’ Counter Threat Unit Research Team said that the threat underscored the importance of incorporating multi-factor authentication using secure protocols, plus implementation of complex password requirements on publicly accessible systems.

We don’t have much detail on how much of the stolen material was due to be published anyway, phishing campaign or no phishing campaign. How much cryptography research done at universities is top-secret, for example? Neither do we know how much of the material was stolen from behind some sort of paywall that has nothing to do with secrecy or national security, as was the case with the “thefts” allegedly pulled off by Aaron Swartz.

Schwartz allegedly used MIT’s network to download a mass of academic articles from non-for-profit academic journal archive JSTOR in contravention of his entitlement, with the aim of republishing them without restriction. Were some of the documents stolen from behind what were genuinely supposed to be closed doors with restricted access? Or classed as “stolen” because they weren’t officially released yet?

In short, we don’t know how much of the material being offered “for sale” was actually stolen. We do know, however, that thieves don’t necessarily discriminate: they just grab whatever they can get, then they, or their paying clientele, figure out what they got away with.

Better to keep them out to begin with, rather than assume that we shouldn’t break a sweat about any of the stolen documents, no matter how bland they might appear at first blush.

Naked Security

You Migh Also Read:

Iranian Malware Delivered Via Fake Oxford University Sites:

Iranian Hackers Target Universities For Secret Research:

 

« Hackers Are Fighting A Surrogate Cold War
Fancy Bear Have A Nasty New Weapon »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Outpost24

Outpost24

Outpost24 provides easy to deploy and intuitive solutions to continuously identify, remediate and mitigate vulnerabilities in your network.

Copper Horse Solutions

Copper Horse Solutions

Copper Horse specialises in mobile and IoT security, engineering solutions throughout the product lifecycle from requirements to product security investigations.

JLT Specialty

JLT Specialty

JLT Specialty is a leading specialist insurance broker. Services offered include Cyber Risks insurance.

My Data Recovery Lab

My Data Recovery Lab

We recover data from: HDDs, RAIDs, NAS, SSDs, USB Flash Devices, Desktop Computers, Mobile devices and other data storage media.

Texplained

Texplained

Texplained specializes in security audits of microchips to identify vulnerabilities and protect against invasive cyber attacks.

ClearBlade

ClearBlade

ClearBlade is the Edge Computing software company enabling enterprises to rapidly engineer and run secure, real-time, scalable IoT applications.

Ensurity Technologies

Ensurity Technologies

Ensurity is a deep-tech cybersecurity engineering company; designs and manufactures specialized secure hardware, software, and mobile application solutions.

About Cyber Security.

About Cyber Security.

About Cybersecurity provides a galaxy-wide knowledge base of cybersecurity tactics and techniques derived from actual experience.

StateRAMP

StateRAMP

StateRAMP reduces risk from unsecure cloud solutions and protects data by providing State and local governments a standardized approach for verifying and monitoring security postures.

OSI Security

OSI Security

OSI Security's primary services include penetration testing, security auditing, web application security testing and risk management.

IBM Security

IBM Security

IBM manufactures and markets computer hardware, middleware and software, and offers hosting and consulting services in areas ranging from mainframe computers to nanotechnology.

MiDO Technologies

MiDO Technologies

MiDO Technologies has a mission to change the narrative around digital enabling tools on the continent of Africa and prepare African youth.

Pacific Certifications

Pacific Certifications

Pacific Certifications provide accredited certification, training and support services to help you improve processes, performance and products and services.

Metrics that Matter (MTM)

Metrics that Matter (MTM)

Metrics that Matter redefines how organizations approach cybersecurity by offering unprecedented insight into the value of their assets to criminals and tailored action plans to protect.

Velaspan

Velaspan

Velaspan design, deploy, and manage enterprise wireless networks and cybersecurity solutions for leading businesses and brands.

Lithuanian Cyber Command (LTCYBERCOM)

Lithuanian Cyber Command (LTCYBERCOM)

The Lithuanian Cyber Command is responsible for planning and execution of operations in cyberspace and installation of strategic and operational communications and information systems.