Caution urged in City College of SF computer use ONLINE SECURITY

Line of computers in the computer room at City College of San Francisco in Batmale Hall in San Francisco, Calif., on Thursday, January 12, 2012. A computer virus which has been on the San Francisco City College servers for the past 10 years may have had the personal information of 40k to 100k students and faculty compromised. less Line of computers in the computer room at City College of San Francisco in Batmale Hall in San Francisco, Calif., on Thursday, January 12, 2012. A computer virus which has been on the San Francisco City ... more Photo: Liz Hafalia, The Chronicle Photo: Liz Hafalia, The Chronicle Image 1 of / 1 Caption Close Caution urged in City College of SF computer use 1 / 1 Back to Gallery

As thousands of students and employees return today to City College of San Francisco - where criminal hackers, it turns out, have been scanning computer data for years - campus officials are warning everyone to change computer passwords, avoid using school computers for banking or purchases, and to check home computers for viruses.

In an e-mail sent to students and employees Friday, Chancellor Don Griffin urged people who think their personal information may have been stolen to contact campus police.

"The College has hired a firm that specializes in computer system security, USDN Inc., to assist in a vigorous effort to determine how widespread the viruses are, and what if any information has been illegally transferred to third parties outside the College," Griffin wrote.

The college detected the problem in November, when its data security monitoring service saw an unusual pattern of computer traffic.

A closer look showed that data - including personal banking information from people who had used college computers to bank online - had been stolen over a decade. College officials don't yet know the extent of the problem.

Griffin said it could take up to three weeks to check the most critical servers. These might contain data from college finances or student data, Chief Technology Officer David Hotchkiss said at a facilities committee meeting Thursday.

He said servers and desktops have been infected across administrative, instructional and wireless networks. Personal computers belonging to anyone who used a flash drive to carry information home may also have been affected.

Origin of viruses

Seven viruses have been found to be combing through college computers for years, Hotchkiss told the committee of three college trustees. He said the viruses originated in criminal networks in Russia, China and other countries.

So far, the investigation has turned up one computer lab, typically used by international students, from which data has been transmitted outside of the college.

"In an effort to increase its network security, the College is now re-evaluating the settings for its two computer firewalls and is upgrading its antivirus software," Griffin said in his note.

The news has alarmed some on campus, while others simply yawned.

"Most of us don't believe it," said Pamela Kamatani, a music instructor. "I'd like to see more proof."

Others expressed concern.

"Jeez, I bought Giants tickets" from a college computer, said Nick Palm, who studied at City College for six years before transferring in the fall. "But nothing negative has happened."

Data security experts from Symantec in Mountain View warn that hackers frequently target college campuses.

"In some cases, thieves keep quiet for a long time," said Tim Matthews of the firm's data loss prevention team. "They wait for them to put money in the bank."

A word to students

Trustee John Rizzo, a technology writer who heard the presentation Thursday, said that until the problem is fixed, students should avoid using college computers for anything requiring a password - even Facebook.

"Infected computers have the ability to record keystrokes and passwords," he said.

Trustee Chris Jackson, also at the presentation, said he was concerned that City College has spent a lot of money on security over the years, but has gotten little in return.

"The most basic level of encryption for our computers was never put in place," he said. "That's unconscionable."

Peter Goldstein, the college's vice chancellor for finance, defended the college's past efforts at virus protection, saying the school had two firewalls.

"In spite of that, bad guys keep trying to get ahead of the good guys," he said. "And in this case they did."