The Digital Citizens Alliance (DCA) has published new research showing there has been a massive rise in the theft of university email credentials and a massive rise in the sale of email credentials on darknet marketplaces.
This year’s study revealed the theft of university email credentials has grown significantly in the past 12 months. The report shows 13,930,176 stolen email credentials have been discovered to have been listed for sale. This time last year when the darknet was last scraped for stolen credentials there were around 2.8 million stolen credentials listed for sale. The year before that the figure stood at 2.2 million.
While the 13.9 million figure includes email credentials that were stolen over the past 8 years, 76% of those stolen credentials were discovered in the past 12 months.
When the researchers combined all types of credentials from multiple sectors they discovered there had been a 547% increase in credentials finding their way onto darknet marketplaces over the past three years.
The fivefold increase in the theft of university email credentials in a single year is a massive spike, which has been attributed to major data breaches at third party websites rather than cyberattacks on universities. The researchers say the massive 1-billion record data breach at Yahoo, the huge breach at LinkedIn and other large-scale cyberattacks on Dropbox, Weebly, MySpace and others are to blame.
The email credentials of university staff and students are being sold on underground marketplaces for between $3.50 to $10 each. While many actors had listed the email credentials for sale, some individuals were trading credentials and others were offering the stolen credentials for free.
The study only looked at theft of university email credentials at the top 300 higher education institutions. Smaller universities were excluded from the study. The stolen credentials were sorted into different higher education institutions to determine which were the worst affected. The universities with the highest numbers of stolen credentials were found to be:
- University of Michigan – 122,556
- Pennsylvania State University – 119,350
- University of Minnesota – 117,604
- Michigan State – 115,973
- Ohio State – 114,032
- University of Illinois (Urbana-Champaign) – 99,375
- New York University – 91,372
- University of Florida – 87,310
- Virginia Polytechnic Institute and State University – 82,359
- Harvard University – 80,100
The researchers were unable to determine why mid-west universities were the worst affected, although they hypothesized that it may be simply due to the size of the universities and the number of students, staff members, and alumni for those universities.
The researchers also looked at the size of the university and compared this to the number of stolen email credentials to gain a better understanding of demand for email addresses from specific universities and to ‘level the playing field’. Some universities appeared in the top ten of both lists, while smaller but more prestigious universities shot up the rankings. When ordered by the ratio of stolen email accounts to the total number of enrolled students and staff the top ten list changed to:
- Massachusetts Institute of Technology
- Carnegie-Mellon University
- Cornell University
- Baylor University
- Virginia Polytechnic Institute and State University
- Pennsylvania State University
- University of Michigan
- Kent State University
- Bowling Green State University
It is easy to see why the theft of university email credentials is such a problem. Edu email addresses are valuable to cybercriminals. They can be used in spear phishing and phishing campaigns but they also allow the users to obtain student discounts with retailers or when purchasing items such as software. Microsoft for instance offers a discount for students purchasing its Office products. The discounts can be considerable.
University email addresses are also highly valuable due to the data contained in those accounts. Information in the accounts can be mined and a huge amount of information can be gathered, from medical records to ID numbers and passwords to the weekends when students are likely to be away.
While email addresses and passwords were discovered, the researchers were unable to tell if the passwords were real and current and could be used to gain access to the accounts. The researchers also found that some of the email addresses appeared to have been spoofed or were incorrect accounts. While these posed less of a threat, the credentials were still of value to cybercriminals.
Phishing attacks do not need correct email addresses to be successfully used. Providing the correct format for emails is used, the email addresses can add credibility to phishing campaigns.
Adam Benson, Executive Director of the DCA said “Higher Education Institutions have deployed resources and talent to make university communities safer, but highly-skilled and opportunistic cyber criminals make it a challenge to protect large groups of highly-desirable digital targets.”
“We shared this information from cybersecurity researchers to create more awareness of just what kinds of things threat actors are capable of doing with an .edu account.” Said Benton.
While large scale third party data breaches were partly to blame, cyberattacks on universities still occur. To prevent theft of university email credentials the researchers suggest cybersecurity programs need to be conducted and awareness needs to be raised on the importance of using strong passwords.
Training should be provided to make sure staff and students are aware of the techniques used by criminals such as phishing. They should also be warned of the risk of clicking on links sent in emails. The researchers suggest tests should be conducted to see who clicks on malicious links. Conducting those tests is not a witch hunt, rather, it can give universities a better idea about how easy staff and students are being duped. Universities should also consider the use of multi-factor authentication to make accounts more secure.