by Information Technology Services
On Thursday, March 9, a critical exploit was executed around the world that enabled hackers to take control of web servers. At K-State, the software used to manage the Undergraduate Admissions and Scholarship Application and the Axio LMS (which is in limited use) was attacked. Within an hour of the exploit being known to the world, Information Technology Services (ITS) had an initial block of the attacks in place.
The quick response by ITS reduced the potential of server takeovers. Consequently, there is no evidence that any sensitive data was compromised and no personal data or secure data was compromised.
This exploit was directed toward a very specific version of Apaches Struts, an open-source web application framework for developing Java EE web applications. ITS has applied a patch that prevents future exploits, and filters to identify attack attempts are also in place. Server snapshots and logs were preserved for additional investigation, as needed.
ITS reached out to system administrators on campus and alerted them to this critical security exploit.
K-State ITS security is dedicated to protecting K-State data and members of the K-State community. It has applied lessons from this situation to proactively improve security at K-State.
