Student computers vulnerable to hackers

Student computer security is of rising importance to Duke following new legislation that requires universities to protect student information. 

Currently, expert systems administrators monitor some departmental and all ACPUB computing facilities, but for protection of dorm computers, responsibility lies with students.  

The Office of Information Technology's website advises students on ways to secure their computers, including the importance of choosing a good password and free downloads of anti-virus software. Combined with vigilance, such measures prevent external abuse that could otherwise go unnoticed. 

"We've seen some dorm computers used to distribute pornography without the student knowing," said Chris Cramer, Duke's information technology security officer. 

Some free software is designed specifically to give hackers a portal into a personal computer. Once a hacker is in, he can impersonate the victim, as in the case of the unwitting pornographer.  

While Cramer admitted that in that case the hacker's actions had little consequence on the student "aside from being unsettling," less benign hackers may manipulate data or use the host computer as a platform for attacking other systems. Such action complicates the back trail that investigators into a major break-in must successfully follow to reach the computer that originated the attack. 

Part of the difficulty in Duke's infotech security endeavors stems from the open nature of university networks, Cramer said. Some companies approach infotech security by building elaborate firewalls around their systems so that no uninvolved individual can access the information, but universities encourage an exchange of information and ideas impossible by such a closed model. Still, for certain features--such as ACES--NetIDs and passwords are required for use. 

"We want to make sure that while we are secure, we don't interfere with academic uses of the network," Cramer said. 

Wireless computing, which uses radio waves to transmit data through the air, raises different concerns. Anyone with a receiver can intercept the data, and current methods of encryption are easy to break on a wireless network the size of Duke's campus, he added. 

There are creative solutions and protections against hackers, including SITAR, a multi-layered protective computing defense, developed in part by Kishor Trivedi, Hudson professor of electrical and computer engineering. SITAR, which stands for scalable, intrusion-tolerant architecture for distributed services, functions by separating protected computer systems and the public domain with computers that screen incoming requests for access. 

"The idea is to try to continue system operation in the face of attacks that might be occurring," Trivedi explained. "It is very similar to fault-tolerant computing in that it tries to maintain the system, perhaps with degraded performance." 

Many other area universities are involved in cybersecurity research efforts as well. North Carolina State University has a Cyber Defense Lab, and the University of North Carolina at Charlotte attracts students seeking to study cybersecurity through the Federal Cyber Corps scholarship program. 

Even with advances, none involved in the research is willing to describe current cybersecurity measures as invulnerable to attack. 

"Programs can always make it hard for the attacker to cause damage, but you can never have a particularly secure system, particularly because new threats keep developing," Trivedi said.