Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canvas online again as ShinyHunters threatens to leak schools’ data

theverge.com

Post reply on HN
Print view View original

11–20 of 690 posts

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#14

Post by mrsvanwinkle »

incomplete wrote: post #10

yep, i work for a major university and our canvas instance is down. this is really, really bad. edit: here's the list of impacted universities (unsure if they all have their canvas instances offline, but i'd be surprised if not): http://91.215.85.103/pay_or_leak/instructure_affected_school...

[dead]

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#16

Post by 12_throw_away »

incomplete wrote: post #10

yep, i work for a major university and our canvas instance is down. this is really, really bad. edit: here's the list of impacted universities (unsure if they all have their canvas instances offline, but i'd be surprised if not): http://91.215.85.103/pay_or_leak/instructure_affected_school...

tbh this has me wondering if canvas "instances" are actually as isolated and segregated from each other as they're supposed to be.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#17

Post by SoftTalker »

podiki wrote: post #11

And grades are due in the next week or so for many of these (usually a quick deadline at the end of the semester due to graduation happening)...

Graduation is just a ceremony. The actual credential award depends on whether you finished all your coursework and is not time-boxed by that event.

Of course if you can't complete your exams because of this, that's more of an issue!

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#18

Post by HDBaseT »

exprez135 wrote: post #3

The Canvas instance at the nearby university is now down (May 7, 4 PM Eastern), but was briefly displaying the message in this screenshot (1). The ransom message implies that today's problem is the second wave in an attack on Instructure after ignoring their first breach in recent days. 1: https://ibb.co/r29RjdnH

Yeah, this is ongoing.

We received communication that Canvas is down for "Under Maintenance" although it seems ShineyHunters have compromised Canvas again with that message you posted.

We do not see that message anymore, although all instrucuture.com URLs are down. The list of schools in the ShinyHunters publication can be found here: https://web.archive.org/web/20260507042014/http://91.215.85....

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#19

Post by wky »

12_throw_away wrote: post #16
incomplete wrote: post #10

yep, i work for a major university and our canvas instance is down. this is really, really bad. edit: here's the list of impacted universities (unsure if they all have their canvas instances offline, but i'd be surprised if not): http://91.215.85.103/pay_or_leak/instructure_affected_school...

tbh this has me wondering if canvas "instances" are actually as isolated and segregated from each other as they're supposed to be.

It's possible that Instructure's servers got compromised:

dig canvas.ucdavis.edu

    [...]
    
    ;; ANSWER SECTION:
    canvas.ucdavis.edu. 1974 IN CNAME ucdavis-vanity.instructure.com.
    ucdavis-vanity.instructure.com. 60 IN A 18.173.121.125
    ucdavis-vanity.instructure.com. 60 IN A 18.173.121.103
    ucdavis-vanity.instructure.com. 60 IN A 18.173.121.15
    ucdavis-vanity.instructure.com. 60 IN A 18.173.121.18
dig canvas.duke.edu

    ;; ANSWER SECTION:
    canvas.duke.edu. 300 IN CNAME duke-vanity.instructure.com.
    duke-vanity.instructure.com. 60 IN A 18.173.121.125
    duke-vanity.instructure.com. 60 IN A 18.173.121.18
    duke-vanity.instructure.com. 60 IN A 18.173.121.103
    duke-vanity.instructure.com. 60 IN A 18.173.121.15

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#20

Post by SoftTalker »

So many universities used to run homegrown or on-prem student systems. This is the downside of consolidating in the cloud. If the infrastructure is compromised, it affects everyone, not just isolated or single installations. I wonder how they are feeling about that decision now? I guess they can say "not our fault" so they might be feeling better than if it was a vulnerability in their own system.
Post reply on HN