Slide 9 of 21
Notes:
On Monday we were informed that other University systems had also been compromised, including Computer Science and the Computing Service.
Being unclear whether a Trojan Horse had been installed, we decided we had to leave our systems off the Internet until they had been secured.
Computing Service also applied strong filters to their external routers while assessing the problem, and during the first couple of days recovery,
Within the Dept, I split our network into two disjoint parts, and only moved systems (or clusters of systems) onto the outside part when they had been investigated and were felt to be reasonably secured.
This was of course a major inconvenience to everyone.
Some systems in research groups were loosely managed, e.g the person who had set them up had since departed and no-one understood them well - this made for extra difficulty. For one system, no-one knew the root password, and it had to be disconnected entirely, pending their making further investigations.
These few days went like a nightmare, and I can no longer tell you in detail what individual steps were taken, but we had finally re-connected the whole of our network to the outside world after several days.
[******] reported that the PC in question had been secured: although the installation of LINUX for a student project had been properly authorised, there had been no intention for it to be a hackers base of operations!