Hack prompts CompSci department to perform extra maintenance

Tufts' computer science math computer system was shut down for several days last week in the wake of a hacker attack.

The hack, however, was "subtle" and did not affect operations, according to math Professor Bruce Boghosian.

A system administrator recognized the break-in two weekends ago while beginning an upgrade to the operating system and investigating a problem with the math cluster's network.

In a system of computers, a cluster is a group of servers and other resources that acts like a single system and enables high availability to users.

There was no important student or faculty information loss because math clusters are not usually used for saving information. "We encourage people not to use the math cluster for archival storage; it is really a computer engine," Boghosian said.

The cluster should be back up and running soon, according to Boghosian, and a clean installation will enable the department to implement a previously scheduled system upgrade.

"The fix is already in place," Unix Systems Administrator John Orthoefer said. "We've forced all users to change their passwords so that any additional passwords [are not usable by the hackers]."

The entire computer science system was down for a nearly a week, inconveniencing the work of both professors and students in the computer science department.

"Accounts on the math cluster have been disabled since last weekend. We have had to use computer accounts that we maintain at different sites in order to continue our work," Boghosian said. "It has slowed us down somewhat."

Projects and due dates for assignments were pushed back while the system was being fixed. General e-mail or other computer systems for Tufts students were not affected.

"My group, the post-docs, and several graduate students were affected by this," Boghosian said.

The attack is suspected to have originated from another university, and not from Tufts, according to computer science administrators.

Orthoefer said that some users' dual accounts in both the computer science and mathematics department clusters helped facilitate the hack.

"It appears insecure passwords for legitimate users were used to get into our system initially," Orthoefer said. Once inside, the perpetrators used a bug to gain administrative privileges.

No monetary damage resulted from the hack. "The costs are largely intangible -- people, time, loss of project time in classes, time to get class-specific software configured," Orthoefer said.

A computer science professor agreed that the loss of time was more than enough damage. "Managing the re-installation [of software] on many of our computers has given the department a great deal more work to do," said Margo Guertin, a lecturer in the computer science department.