UConn tells students – No official Spring Weekend this year

A tough message about Spring Weekend was sent to UConn students today in an open letter published by Vice President for Student Affairs John Saddlemire and UConn Chief of Police Robert Hudd.

It begins by stating that, “This year, the three-day period commonly known as ‘Spring Weekend’ at UConn will be significantly different from any recent, previous year.”

Actually, for the first time since Spring Weekend was celebrated in the 1960s, NO on-campus activities are being held.

Normally, there has been a major concert as well as a number of games and activities organized by the student organizations.

The university is calling for a moratorium on the event, and asking students to go home.

Spring Weekend – which has mutated into an unofficial four-day event – falls this year on Thursday, April 21 through Sunday, April 24.

Since April 24 is Easter Sunday, those involved in preparing for Spring Weekend – which includes police, fire and emergency medical workers – hope the unsanctioned, off-campus parties will fizzle sooner.

Student killed last year

The letter from Saddlemire and Hudd follows months of discussion resulting from the violence of last year’s events, which left one student dead. And it follows years of collaboration between the town of Storrs-Mansfield and the university to deal with an event that has racked up bills for the town and caused property damage to homes surrounding the largest parties.

Today’s letter reminds students that last year, UConn student Jafar Karzoun was assaulted off campus (by a nonstudent) during Spring Weekend and died from his injuries days later.

“The memory of this tragedy and the sense of its implications have not diminished in the year that has passed,” the letter states.

Canceling on-campus events is one thing. Getting off-campus students to forego their parties is another. The letter points out that massive drinking parties for which Spring Weekend has become notorious are off-campus and not condoned by the university.

“The University of Connecticut, as an institution, in no way organizes, supports, or condones Spring Weekend. Since its earliest incarnation in the 1960s, it has grown from a comparatively calm, student-based tradition to what it is today: unwieldy gatherings that have the potential to become destructive or dangerous and are poisoned, in large part, by individuals with no connection to UConn,” the letter states.

The letter then outlines the recommendations that were developed by a task force charged with coming up with ways to “deescalate” Spring Weekend that will be put into effect this year.

Many of them have to do with keeping off-campus party crashers out, since police reports indicate much of the violence is instigated by “outsiders.”

Some of the strategies to quell Spring Weekend mayhem:

• Blocking roadways

The UConn Police department, as well as Connecticut State Police, will block certain roads, parking lots and pathways on and around campus. Police will limit outside access to campus and its parking lots. Non-students should not travel to Storrs during this time.

• Parties at the apartment complexes

The University and Police are working closely with the management of the Carriage House and Celeron Square complexes – where the largest gatherings traditionally occur. Last year, according to a task force report, there were 10,000 to 15,000 per night at these parties.  And so, the letter states, “access to these areas may be restricted or regulated.”

• No guests in the residence halls

Guests are barred from residence halls from April 21 to April 24. Dining halls will not allow non-students to enter. RAs [residential assistants] and other Residential Life staff will enforce this. Students who violate this temporary restriction by having guests will be subject to disciplinary action.

The university requires students to register any visitors staying on campus and last year there were more than 6,000 on Spring Weekend.

• No on-campus events

No student-related University events are scheduled for this period. The University has called for a voluntary moratorium. Students are urged to return home for the weekend, as many will be doing anyway if they are celebrating Easter with their families.

This last decision has been supported by the Graduate Student Senate as well as the University Senate and UConn’s Undergraduate Student Government, the letter states.

What else can we do?

The letter points out that while UConn can cancel on-campus activities, it is not able to control what students decide to do off-campus… although there can be sanctions for criminal and other actions that violate the university’s code of conduct.

Quoting from the task force report, the letter states, “Many outside the University have asked why UConn doesn’t simply ‘cancel’ the event. The truth is that if it were possible for UConn to do this, we would have done so many, many years ago. In the past, the University organized dry on-campus events in an effort to compete with alcohol-fueled off-campus gatherings. This effort was never successful. Many students simply participated in both, and non-students came to Mansfield specifically to attend the off-campus gatherings.”

“Spring Weekend is a deeply unfortunate, unwanted tradition that increasingly attracts people with no connection to UConn – and little to lose. It puts students, our campus, and the town at risk and, as we have seen, can have tragic consequences. It needs to deescalate and eventually end for good,” the letter states.

The letter concludes by quoting remarks in the task force report that address the disappointment, or even resentment, some students may feel this year:

“We are aware that despite the risks and possible consequences, there are many UConn students who see Spring Weekend as an entitlement. There is undoubtedly a perception that the University’s efforts to significantly limit and curtail Spring Weekend represent an effort to unfairly erode the enjoyment some associate with it.

“All involved should understand that the University’s first and greatest concern is the safety of our students and the sanctity of our campus and the surrounding community. Spring Weekend has without question, become a magnet for toxic behavior and criminality that poses too great a risk to the UConn community for the University to tolerate it any longer in its current form. This is our sole motivation in seeking to diminish it.”

Whether or not the town and UConn will still provide a “triage” station on Hunting Lodge Road from which to address injuries or provide other services is not addressed in this letter.

Posted April 13, 2011

Have a news item or event you’d like posted on this news site? Simply send your information to editor@htnp.com and include your town in the subject line of your email. Please also include a phone number where you can be reached if there are questions.

FBI cracks international 'bot' network that has infected more than 2 million computers

Robot wallpaper image from blingcheese.com

Today, the Department of Justice and FBI announced it has cracked a network of hackers who have infected more than 2 million computers with a malicious “bot” program that hijacks sensitive personal and financial data from computers.

Known as a “bot” network – because the malware can be controlled remotely like a robot – it infects computers with a software program known as Coreflood, which installs itself by exploiting a vulnerability in computers running Windows operating systems.

The press release issued today by the FBI calls this sting “the most complete and comprehensive enforcement action ever taken by U.S authorities to disable an international botnet.”

Executive Assistant Director of the FBI’s Criminal, Cyber, Response and Services Branch Shawn Henry said, “These actions to mitigate the threat posed by the Coreflood botnet are the first of their kind in the United States and reflect our commitment to being creative and proactive in making the Internet more secure.”

Besides infecting personal computers, the network had accessed corporate and business computer networks and used information they contain to steal funds.

According to information contained in court filings, the group of all computers infected with Coreflood – known as the Coreflood botnet – is believed to have been operating for nearly a decade and to have infected approximately 2,336,542 computers around the world (About 1,853,005 are in the U.S.).

According to court documents, examples of illegal fund transfers allegedly conducted via Coreflood botnet include:

• $115,771 from a real estate company in Michigan,

• $78,421 from a law firm in South Carolina,

• $151,201 from an investment company in North Carolina,

• $934,528 in wire transfers that were attempted to be taken from a defense contractor in Tennessee, but was successful in stealing about $241,866.

Connecticut’s complaint filed against 13 “John Does” states, “The full extent of the financial loss caused by the Coreflood Botnet is not known, due in part to the large number of infected computers and the quantity of stolen data.”

In Connecticut

The U.S. Attorney’s Office for the District of Connecticut has filed a civil complaint against 13 “John Doe” defendants that accuses them of engaging in wire fraud, bank fraud and illegal interception of electronic communications.

Search warrants also were obtained for computer servers throughout the country, and a seizure warrant was obtained in U.S. District Court for the District of Connecticut for 29 domain names. (Click here for a PDF version of the warrant.)

“The seizure of the Coreflood servers and Internet domain names is expected to prevent criminals from using Coreflood or computers infected by Coreflood for their nefarious purposes,” said U.S. Attorney David B. Fein for the District of Connecticut. “I want to commend our industry partners for their collaboration with law enforcement to achieve this great result.”

Assistance was provided by Microsoft, the Internet Systems Consortium and other private industry partners, the release states.

Government will monitor infected computers

The government now has a temporary restraining order that authorizes it to respond to signals sent from infected computers in the United States, in order to stop the Coreflood software from running.

The Coreflood malware on a victim’s computer is programmed to request directions and commands from C & C [command-and-control] servers on a routine basis. A single C&C server can control millions of bots.

New versions of the malware are introduced using the C & C servers in an effort to stay ahead of security software and other virus protection updates.

If the C & C servers do not respond, the existing Coreflood malware continues to run on the victim’s computer, collecting personal and financial information.

The temporary restraining order authorizes the government to respond to these requests from infected computers in the United States using substitute servers with a command that temporarily stops the malware from running on the infected computer.

During that time, the hackers behind Coreflood will not be able to introduce different versions of the Coreflood malware onto the infected computers.

This will give computer security providers time to update their virus signatures and malicious software removal tools so their customers can use them to remove the Coreflood malware, the release states.

Is your computer infected?

The press release also states that, “The Department of Justice and FBI, working with Internet service providers around the country, are committed to identifying and notifying as many innocent victims as possible who have been infected with Coreflood, in order to avoid or minimize future fraud losses and identity theft resulting from Coreflood.”

If you are among those who are contacted, “at no time will law enforcement authorities access any information that may be stored on an infected computer.”

The FBI also stresses that this crackdown does not mean that Coreflood malware or similar forms of malware have been removed from the Internet entirely.

“Nor does it mean that criminals will not attempt to build another botnet using a different version of the Coreflood malware or other malware,” the release states. “The best defense against such malware, and botnets in general, is for users to ensure their computers are protected by regularly-updated anti-virus security software.”

The crackdown is the result of an ongoing criminal investigation by the FBI’s New Haven CT Division, in coordination with the U.S. Marshals Service.

The matter is being prosecuted by the U.S. Attorney’s Office for the District of Connecticut, led by Assistant U.S. Attorney Edward Chang, and attorneys from the Computer Crime and Intellectual Property Section in the Justice Department’s Criminal Division.

The targeted domain names

Besides the U.S. (many in Virginia and Washington), the hackers targeted by the FBI sting also originate from Australia, Canada, Germany, India and the UK.

They also employ misleading terms such as “spamblocker,” “taxadvice, “wiki,” “wellness,” “flu.medicalcare” “ticket,” “onlinebooking,” “licensevalidate,” “gamer,” “logon,” “unreadmsg,” “mediastream” and “google” in their domain names.

Some of the domain names (and their tertiary domain names) include:

SINKHOLE-00.SHADOWSERVER.ORG; adv-webhost.com; node1.adv-webhost.com; alex.adv-webhost.com; antrexhost.com; ads.antrexhost.com; cafe.antrexhost.com; coffeeshop.antrexhost.com; marker.antrexhost.com; old.antrexhost.com; spamblocker.antrexhost.com; bonuspages.net;

And… carl.bonuspages.net; diplodoger.com; ns1.diplodoger.com; ehostville.com; taxadvice.ehostville.com; fishbonetree.biz; brew.fishbonetree.biz; googlestat.net; hostfarmville.net; inews.hostfarmville.net; hostfields.net; wiki.hostfields.net; wellness.hostfields.net; hostnetline.com; ticket.hostnetline.com; joy4host.com; just-twin.com; celsius.just-twin.com; licensevalidate.net; acdsee.licensevalidate.net; savupdate.licensevalidate.net; medicalcarenews.org; flu.medicalcarenews.org; medinnovation.org; vaccina.medinnovation.org; nebuladay.net; gamer.nebuladay.net;

And… nethostplus.net; accounts.nethostplus.net; imap.nethostplus.net; logon.nethostplus.net; mediastream.nethostplus.net; onlinebooking.nethostplus.net; pop3.nethostplus.net; schedules.nethostplus.net; taxfree.nethostplus.net; netwebplus.net; ipadnews.netwebplus.net;

And… penlist.net; butik2000.penlist.net; realgoday.net; dru.realgoday.net; stafilocox.net; exchange.stafilocox.net; unreadmsg.net; jane.unreadmsg.net; vip-studions.net; a-gps.vip-studions.net; and virtukon.com; kelvin.virtukon.com.

What you should do

Make sure you have virus and malware protection, make sure it’s up to date (usually there are daily updates), keep the program running and schedule a daily full scan.

To learn more about what you can do to protect your computer, including how to download and receive updates on security issues, visit these sites operated by U.S. Computer Emergency Readiness Team (CERT) and the Federal Trade Commission: us-cert.gov/nav/nt01 and onguardonline.gov/topics/malware.aspx

Posted April 13, 2011