Canvas hack strands university students during finals week

This is a second attack. Last week Instructure (Canvas parent company) told them to kick rocks, so this time they made it public and are going after the individual schools for the ransom.

We were hacked on a small scale and advised to pay. I’m sure the rules are different if you’re bigger. We had to pay 2 BTC in 2019. If only we bought a few more…

Latest update is that Instructure has shut down Canvas and they're working on a fix for the disruption. They're not talking to the hackers; they're working to fix the issue because that's how you handle something like this.

Couple of things at play here. First, never negotiate ransom on your own - if it comes out later that the group you paid is on a sanctions list (Iranian for example), you've definitely committed some federal no-no's. Ransomware negotiators have international alliances so that (if you decide to pay) the money isn't sourced from a sanctions-list. Second, after Russia invaded Ukraine, a lot of the top RaaS (ransom as a service) shops disbanded and spread out around Europe. They would try and set up shop in their new neghborhood, but these are amateurs and they're not holding up their end of the bad-guy bargain. Ransomware only works if your group can be trusted to make good on the deal. The amateur chop-shop idiots keep re-infecting former victims, or just digging up something that was "settled" years ago and start trying to sell the data anyways. This is leading to more and more cyber insurance carriers recommending you just tell them to pound sand and rebuild your infrastructure. There's no good faith anymore that paying the ransom actually gets you what you need.

Then we open it and discover it is full of nothing but torn up bits of newspaper....like a lawyer's career's worth of regurgitated words....

>Having one company be the single point of failure for thousands of different organisations is stupid. Been saying this shit when I was in school over 10 years ago.

Funny enough, canvas itself is open source.

The problem with something like Moodle is that most schools don't fund their IT teams well enough to safely self host shit like that. Only the largest district have dedicated cybersecurity teams. It's a choice between putting all your eggs in one basket with a large company, but that company has a team of dedicated engineers, or self host using internal IT who are very often underpaid compared to industry standards and usually stick around more for the QOL Edu provides. School IT people are also usually generalists. Many smaller to medium sized districts have, at best, one person doing *all* of the high end technical stuff from servers, to networks, to accounts, to tier 2 troubleshooting, to keeping on top of cybersecurity, to often a variety of other tasks that make you wonder "why the f*** was this dumped on IT"? If they are lucky they may have one or a few tier 1 help desk people to help with the traditionally high user-to-tech ratio versus private companies. You also run into the issue of continuity if someone leaves. What if that one guy gets hit by a bus? Very real danger in a school district. IT has a very love/hate relationship with facilities/transportation. Good luck trying to hire someone who can come in and pick up the pieces. Most people in school districts don't even know enough to know what they don't know so they won't know what to even hire for. All the servers and shit that guy set up to run that stuff locally are just completely opaque to almost every user in the district and often the person who set it up has so much shit on their plate that they don't have time to write documentation. It's just not feasible for many districts when they can pay $10k to $20k per year for something hosted by the vendor in the cloud and let them worry about cybersecurity. Source: I am that guy in a public school district that works that magic. Our user to tech ratio is about 500:1. I don't make enough for what I do but, like I said, the QOL is nice. I try to document as much as I can but we sure as f*** don't have the budget to hire another person on my level if we could even find one who would do what I do for the pay. I have to balance what we can do locally versus what we offload to the cloud/vendor and the question we usually ask when determining that is what happens if I am gone. Nobody else on my team knows enough to pick up the pieces for a lot of that locally hosted shit. Nobody outside my team would even know anything needs to be picked up. Personally, I think I do a pretty good f****** job for what I have but I'm just one person. I see a lot of other schools across my state, even prestigious private schools, that have FAR worse IT practices than we do. F***, most private schools in my area don't even enforce 2FA. We get phishing emails almost weekly from accounts in their domains. I don't even think the community knows just how often their accounts get breached which means sensitive student data getting leaked.

I used moodle at my last job. I prefer it over canvas. Its got a learning curve but it did its job well. We had a Moodle expert on staff to answer all questions from faculty.

The CEO and CTO of Instructure / Canvas definitely just Moodled their pants with the handling of this situation

> Moodle is also from the 1990s, and it shows. Moodle is not a replacement for Canvas (and neither does it go the other way round).

Unaffected college teacher here. You often (usually?) don't have a lot of flexibility on what systems are used or where things have to go. I have to put everything on the LMS, I have to keep a gradebook in the LMS, I have to deliver/accept assignments via the LMS. Even if I am as platform agnostic as possible, most schools are still nearly totally dependant on an LMS, by choice. Also, maintaining a "course" in some other system or in a bunch of files in your hard drive may help against something like this, but it is massively more work. I'd have to maintain the LMS version, plus my system-agnostic backup, and keep each updated - in 99% of scenarios that is probably untenable.

Yeah adding to this. It’s been pushed. Since Covid not being on canvas is no longer allowed. It’s about the university scraping data and materials and syllabi since now apparently the state has to review them and make sure we aren’t teaching any DEI or anything they don’t like. It’s not a faculty choice. This is an admin choice.

My classes end tomorrow, I had one final left to take tomorrow and one assignment due tonight. All of my classes are entirely online. I had assignments that I submitted throughout the semester that have not been graded, most of the assignments are integrated entirely through canvas, so there isn't some word doc somewhere that I can email my teacher. Our finals were entirely through canvas as well, so again unless my teacher makes a word doc exam for us to take in the next 24 hours no one knows what's going to happen, and it wouldn't be a fair system to those students that have already taken the exams.

> That’s going to suck for a lot of students not being able to get their work done especially with the semester ending for most of them. All my finals are on Canvas. I have no idea what we are going to do for them now.

Yeah I saw it's impacting K-12 as well. I used canvas starting in middle school, and I graduated high school in 2019. It's been around for a while now. I'm a lot more concerned as a university student paying $12k a semester and 2 classes away from graduating though than I would be as a middle schooler about to go on summer break.

Lots of proprietary plugins + AGPL. Basically it's restrictive 'open-core'.