Students looking to access the AMS website over the weekend were confronted with a page load error, the product of the website’s server being taken offline after being hacked.
Vice-President (Operations) Ken Wang said the entire website was taken down and replaced with “this website was hacked by LinuXploit_crew.” Once the hacked website was discovered, Wang said it was disabled immediately.
Wang said LinuXploit_crew are relatively well-known hackers who have an Internet reputation.
“They hack a lot of websites. I searched them on Google and it tells you activities of their attacks and stuff like that,” he said. “They’ve hacked government websites.”
Wang said all of the affected servers have been shut down and isolated so ITS can identify where the hackers found their entry point.
“We’re just taking precautionary measures to isolate our individual servers in order to assess the degree of the vulnerability that we have,” he said. “That involves shutting down the main controller, which on your end means you have no access to e-mail or the network.”
He said the AMS website isn’t necessarily an easy target for hackers, but is susceptible to hackers looking for any sort of vulnerability in the website’s security.
“We work with ITS to ensure everything is secure, but obviously they find vulnerability that we hadn’t realized,” he said. “When everything is offline it’s totally fine. People will not lose their data.”
Wang said the AMS’s service websites are run on different servers and ITS has cut off each server in order to pinpoint where the problem is within the servers.
The Journal’s website is hosted externally and has not been affected.
“We’re working with ITS security officer in order to asses the damage that’s been done,” Wang said. “It’s a matter of checking logs to see what had actually happened and recovering that.”
Wang said no confidential information about the AMS’s employees or its payroll has been compromised because it isn’t saved on public servers.
“All of our payroll is saved locally, so that’s safe,” he said. “We outsource payroll, so the company that does our payroll has all of the information, so we’re fine.”
Wang said the AMS internal e-mail, which is accessed through the AMS website, hasn’t been breached. To access the information stored on the servers of AMS services, Wang said, the hacker would have had to go through -protected connections, which are also secure.
“We have a primary domain controller, a secondary domain control, our exchange server, a server which houses all virtual machines and a development server,” he said. “They need to hack our s, and we haven’t seen any signs of that, so no information has been compromised.”
Wang said the AMS website has never been hacked before, and ITS is currently evaluating the website’s weaknesses to make it stronger against attacks.
“We’re working with the ITS security officer in order to make our system more robust and he said after this he’s examining where we improve.”
All final editorial decisions are made by the Editor(s) in Chief and/or the Managing Editor. Authors should not be ed, targeted, or harassed under any circumstances. If you have any grievances with this article, please direct your comments to [email protected].