Somehow I have less distaste for ShinyHunters than I do for the companies who don't secure user data
Canvas online again as ShinyHunters threatens to leak schools’ data
81–90 of 690 posts
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#82Earlier quoted context omitted.
Seems like Canvas instances of schools not listed are also down (at least my alma mater is)
Yes, I work for an Australian online school. We’re down “for scheduled maintenance” (I question how “scheduled” it was given this is within school hours on a school day), but we’re not on the list published by ShinyHunters.
our instance went from [insert hacker leet text] to "down for scheduled maintenance" and myself and other faculty are just having the darkest humor about this.
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#83[flagged]
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#84I wonder when the public is going to start calling for corporate liability for malpractice in software development and corporate liability for malpractice in IT deployments. Even if the tech industry fights it, it probably won't be that much longer.
I do wonder if that won't just end up INCREASING ransom-type attacks, though?
If we increase the penalties for a company being hacked, you create even MORE incentive for hackers to try to break in, because if they succeed, they have a pretty big stick to threaten companies with when demanding a random payment - not only will the company have the negative effect of the data being leaked and the PR that accompanies it, they now know that if they don't pay and the attack becomes public knowledge, they face a big fine or other punishment.
A company is much more likely to pay a big ransom if they know they are just going to end up paying that much or more in fines if they refuse the ransom and report the hack instead.
If you take this route, and increase punishment for being hacked, you are making a pretty big bet that the main reason companies are hacked is because of poor security practices. I am not sure if that is true or not.
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#85It looks like Instructure has been removed from the ShinyHunters website. Both the entry and the list of schools has been removed.
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#86I remember circa 2010 a friend of mine at college was like “blackboard sucks, let’s build something new”. At the time I poo pood the idea and lo and behold canvas came out a year later. Outside looking in, they been crushing it.
One of my mentors created Blackboard. It used to be very very good, but he sold it to private equity, and they immediately fired all of the customer support and developers, 3xd prices overnight leading to the 'blackboard sucks' problem. This gave the opening for Canvas to eventually come on to the scene and dominate.
My wife and I each have to use it as we're both following an online master's at the same university... it's definitely gone downhill (compared to the days where I originally used it ~20 yrs ago in college; tracker-riddled, slow); surprisingly, a recent change made it so that you can only attend online lessons in Chrome (haven't had time to see if this is just a user-agent thing).
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#87I wonder when the public is going to start calling for corporate liability for malpractice in software development and corporate liability for malpractice in IT deployments. Even if the tech industry fights it, it probably won't be that much longer.
I'll never understand this point of view. If someone would please explain how to create perfectly secure software, I will gladly start writing perfectly secure software. Only after, if it's clear I ignored obviously correct advice, should there be malpractice penalties. Consider surgery instead of software development. There are general best practices, but the difference between a good surgeon and a poor one is a sma…
> Consider surgery instead of software development. There are general best practices, but the difference between a good surgeon and a poor one is a small number of deaths.
I like this analogy, but deaths shouldn't be the leading indicator just an indicator. Family member had a surgery with well known procedures, say removing a gall bladder. Unfortunately, this surgeon skipped a step in lieu of setting a record for fastest procedure. Because steps were skipped, the gall bladder was not scooped into a net to avoid spilled gall stones which resulted stones spilling into the abdominal cavity requiring numerous follow up surgeries to remove the spilled stones as they made themselves known. So clearly not following accepted procedures should be a clear win in a malpractice case, yeah? Wrong. No doctor would testify against the surgeon and the case was dismissed. I feel like this is exactly how it would work in software security incidents as well.
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#88What's in the files they've already released? Some of them are > 800GB.
Where are you getting that information from?
I'm under the impression files are getting released 12th May. I don't see any reporting on 800GB?
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#891. It should be illegal for any company to pay ransomware attacks. Period. No pay out ever.
2. The penalty for being the attacker should be linked to the system they violated. If you do this to a hospital and someone dies you are life in prison / chair. The minimum sentence should be so painful that it deters the attack.
No this will not stop this and companies need to be held accountable for their lack of security investment. Every attack should be investigate if the company met an agreed industry standards best practices and staffing, etc. The penalties for not meeting the requirements should be punitive.
Re: Canvas online again as ShinyHunters threatens to leak schools’ data
#90It is absolute chaos at my institution. This is the last day of finals and grades are due Monday morning. Most faculty are spending today, tomorrow, and through the weekend finalizing grades. What we don't have access to includes: * Already graded work * Ungraded work * overall adn assignment grades * lists of students and student emails from the course * messages from students that are often sent through gradescope…
What happens if the system isn't back up in time for grades to be submitted? Just a delay?