U.S. research universities have recently found themselves the target of millions of hacking attacks every week—many of which appear to have come from China.

With systems designed to be open to tens of thousands of different users, universities like N.C. State are especially susceptible to cyberattacks.

“We get 90,000 to 100,000 attempts per day, from China alone, to penetrate our system,” Bill Mellon, the associate dean for research policy for the University of Wisconsin, said in a recent interview with the New York Times.

Rumors of the Chinese instigating hacking attacks on the U.S. are not new—and The Times itself has been victimized.

According to a New York Times article published in January, Chinese hackers had broken into their system and stolen the passwords of every single employee of the newspaper. Hackers usually attempt to hide their location, and these hackers were no exception.  They attempted to cover up their trail by first hacking into U.S. universities and then sending their signals through those computers.  

The Chinese government denied any connection to the attacks, stating that their laws prohibit any action that would threaten Internet security.

Incidents like these have strained Chinese and U.S. relations.  The Obama administration and Chinese officials have accused each other of illegal Internet practices being used by the opposition.

Once a hacker is discovered, it can be very difficult to track his or her point of origin. It is similarly difficult to discover if the hackers are working with governments or they are on their own.  

Regardless of who the attackers are or where they are located, the challenge remains for university officials around the country to protect themselves.  

Kerry Digou, the information technology manager for the Office of Information Technology at N.C. State, said hackers are a major problem.

 “Yes, just like every other university, there are constant attacks—all the time,” Digou said.

Research universities rely on being able to share information and being open sources of data, but that can make them an easy target for hackers.  

Digou said OIT has had to work hard to place certain sectors of data, including student and financial data, into enclaves, or specific protected areas of memory. This allows OIT to protect that sensitive information even as the rest of the system remains free-flowing.  

Digou said most entities, like private businesses, just build a firewall around the whole company and control everything that goes in and out of the system.  Universities don’t have that luxury.   

 “This is typical to how universities do it, because we have a large population that we don’t control,” Digou said.  “I don’t have access to what goes on your machine that you bring on our network every day.  We have to use this enclave method.”

Digou said that in recent years, hackers have grown far more sophisticated, both in their methods and their goals.

“In the past, the attacks were mainly a fame thing,” said Digou.  “More recently, it’s more of a financial motive.”  

James Hitchens, a double-major in computer science and computer engineering at N.C. State, agreed that hackers are getting creative and very smart. 

 “Hackers are very good at making their attack look like it came from different places.” Hitchens said.  “Maybe the attack originated in China, but the hacker made it bounce through Ireland, to Britain, to Thailand, to all sorts of other places.”  

Hitchens said he believes that more needs to be done from an education standpoint to help prevent future attacks.  

 “Trying to protect against an attack that you don’t know how works, or only know theoretically, is much more difficult than if you actually know exactly what it is they’re trying to exploit to get into your system,” Hitchens said. “In the U.S., however, malicious software is so taboo, many institutions are unwilling to go into much detail about how the attacks actually work.  I guess they think that everyone would use their skills with malicious intent, I’m not exactly sure.”

Hitchens said he believed more hackers were coming from China and Russia because hacking isn’t as stigmatized in those countries as it is in the U.S.

One of the most common types of hacking at N.C. State is what is known as “phishing.”

Phishing generally occurs through emails.  It involves a hacker pretending to be someone else in order to gain personal information, like usernames or passwords, from a party.

“Phishing is a significant problem for us,” said Digou.

Mardecia Bell, director of security and compliance for OIT, said that phishers were some of the most difficult types of hackers to discover.

Bell suggested that individuals could actually do quite a bit to help protect themselves. First and foremost, she said, students should be extremely careful when responding to emails.

“Be aware of your data, [and] be careful about what you post on social media, websites, and things like that.  Make sure you keep your personal information private,” Bell said.

 A phishing email could appear to come directly from N.C. State itself.  This could make it especially dangerous to the untrained eye, but University officials said there was one good way to detect the false email.  

The University offers a comprehensive list of computer safety guidelines at http://oit.ncsu.edu/safe-computing.