Monthly Archives: August 2015

Hacked: A Case Study

Hacked

 

There’s no denying it: we got hacked. Here’s what we learned and what you can learn, too.

On Wednesday, August 12, at approximately 3:30am, a barrage of malicious postings found their way to three of the University of Michigan’s most popular Facebook pages: Michigan Football, Michigan Basketball, and Michigan Athletics. Our Department of Information Technology Services (ITS) was first alerted to the inappropriate content by our user community. Community members across many of our other social properties also reached out with comments and direct messages. By 5am ITS in turn had notified the University Director of Social Media, the Office of Public Affairs and Internal Communications, and the Department of Public Safety and Security. Likewise, members of Michigan Athletics’ external communications staff awoke to a multitude of notifications, voicemails, and text messages. By 6am the story of our hacking and a full array of screenshots were being discussed across the airwaves and on online news outlets.

Timeline

After quickly establishing that this was not the work of a disgruntled employee, and confirming that we had lost all administrative access to the accounts, we began furiously flagging content, pages, and any Facebook organizational contacts we could find. As the owners of the sixth-largest higher-ed Facebook audience in the nation and the largest pages in collegiate athletics for football and basketball, one might think we have Facebook on speed-dial; however, that was not the case. Further complicating the situation was the fact that many of the contacts we did have were in a variety of time zones, and many were still sleeping. In the end, it was actually Facebook’s London (UK) team that came to our rescue, thanks to a connection made through a former agency peer who then reached out to a Facebook client partner at one of Michigan’s robust auto industry social teams.

hack article

Simultaneously, the University of Michigan social leadership team was alerted by UMSocial to implement password changes on all official accounts and immediately assess any and all third-party applications that had been granted access to publish on the pages behalf. This team comprises one representative from each primary unit across the U-M’s three campuses. Each individual is tasked with regular communication with UMSocial, as well as with communicating best practices, strategy, and other pertinent information to all administrators of subsidiary social media accounts within their areas. Michigan Athletics’ associate athletic director for external communications and public relations also initiated a group distribution text message with key stakeholders and leadership throughout the university to keep them apprised of the developing situation.

At 7:42am, in collaboration with Public Affairs and Michigan Athletics, UMSocial issued the first acknowledgment of the hacking situation on the overarching University of Michigan social properties. Ensuring that our vast social communities were aware we were working diligently to rectify the situation in a timely manner was of utmost importance to us, and clear, transparent communications proved to be a valuable tool as the events of the day unfolded. The multi-phased communications approach included internal and external audiences and media relations while utilizing broad-based education about the day’s events and how it impacted various groups.

Screen Shot 2015-08-18 at 3.22.33 PM

At 8:38am Facebook took control of and unpublished the three compromised pages. Within 15 minutes, university page administrators had been re-credentialed and the process of cleaning the accounts began. By 10am the pages had gone live once again and we notified our audiences and key stakeholders that the situation had been contained…or so we thought.

Screen Shot 2015-08-18 at 3.22.50 PM

Just after the noon hour, a second wave of attacks was triggered on the previously affected pages as a result of our efforts to alter delegated privileges on the remaining page administrators. It was at this point that we were able to determine the actions were linked to a specific employee’s personal account, and we relayed information to ITS and Facebook which allowed us to determine the original source of the security breach. Following an extensive investigation, Facebook determined that the hack was part of a sophisticated phishing scheme found within Facebook Messenger that has affected many other brands.

Screen Shot 2015-08-18 at 3.27.48 PMOnce the hackers gained access to the personal account, they were then able to access any page to which the individual had administrative privileges. Internally, ITS focused their efforts on assessing potential risk to our data and systems. Their thorough evaluation revealed that the hack was contained to the social platforms, and did not affect confidential data or servers.

According to Facebook, the following two scripted messages reflect what the individual may have received:

Dear Nikki Sunstrum,
Data that you have filled do not match your fanpage, precisely the Security Question, and Answer do not match in your records.
Please fill the application again.
[Malicious link was here]

Sincerely,
Facebook Support Center

or 

Dear Nikki Sunstrum,
Data that you have filled do not match your fanpage please fill the application again
[Malicious link was here]

Sincerely,
Facebook Support Center

Upon clicking the links, users are directed to a form that looks like a page to validate Facebook credentials, but in fact is not an authorized Facebook site. Facebook provided the following tips for further future protection, which we have implemented as a standard of best practice and instructed all University of Michigan social properties to adopt as part of our use guidelines.

  • Facebook will never send official communication via Messenger.
  • Never enter your password anywhere but facebook.com. Scammers often set up fake pages to look like a FB login page so it’s important to always check that you’re really logging into www.facebook.com.
  • Watch out for fake pages/apps as well as “official” links using URL shorteners such as the gl links from the phishing messages.
  • Try to keep the number of admins to a minimum
  • Ensure that Admin and Editor roles have login approvals turned on. This will add an additional layer of security when someone attempts to login from an unrecognized device.

Before the close of business August 12, we had debrief and exploratory third-party application meetings on the books. Normal operations on social accounts were intentionally eased back into and prolonged until individual responses were issued to every single message Michigan Athletics had received. The next day we gathered to discuss what went well, and provided summary information on the status of all accounts to leadership. We also monitored and measured the reach and impact of the conversation repeatedly as it unfolded. Overall, our brand pages saw a nominal increase in followers, while our individual sport pages experienced a very minimal decrease. When compared to other topics surrounding the University of Michigan brand over the last seven days, the hack ranked fifth out of 10.

Screen Shot 2015-08-18 at 3.23.16 PM

 

Screen Shot 2015-08-14 at 10.19.42 AM

 

For us, the moral of the story was clear. Password security isn’t enough – even the most well-trained social media professionals are still subject to human error. The best we can do is take every necessary precaution to incorporate additional levels of security. Collectively, we have initiated the implementation of two-step authentication procedures, and are continuing to evaluate third-party security applications. Lastly, at Facebook’s recommendation, we are also researching Facebook Business Manager.

It is our hope that, by highlighting the steps taken and lessons learned, we might prevent future attacks and educate our peer institutions on how to safeguard themselves as well.

If you have experienced a similar event and are interested in sharing your case study, please feel free to contact us at umsocial@umich.edu. Additionally if you have questions please reach out to me on Twitter @NikkiSunstrum.

#StaySocial, #StayConnected, #StaySafe

 

Written by @NikkiSunstrum, University of Michigan Director of Social Media

Activism & Racial Education: A discussion of ‘Between the World and Me’

The objective behind #UMichChat is to stimulate meaningful dialogues around pertinent issues and highlight the expertise within the University of Michigan community. By combining our own social presence with those of our panelists, we hope to be able to significantly extend the impact of the conversation beyond the university, using social media to start and maintain far-reaching, purposeful conversations.

Last month, a group of U-M faculty reached out to UMSocial on Twitter and expressed interest in hosting a discussion surrounding the book Between the World and Me by journalist and blogger Ta-Nehisi Coates. This book has received attention and praise in the media recently -Toni Morrison hailed the book as ‘required reading.’-  because of the way it addresses race, physical wellbeing, struggle, and hope  Told as a series of letters from the author to his teenage son, Between the World and Me explores the realities of being black in the America of 2015. Themes include the long history of violence against black Americans, conflicts with police, and Coates’ personal feelings against the culture of optimism and uplift that traditionally exists in black, Christian communities.

Nearly a year ago, we hosted a chat on “Ferguson, Journalism, and Social Media.” The anniversary of  the Michael Brown shooting seemed to us to be the appropriate time to once again delve in to the nexus of scholarship, race, and activism. We were lucky enough to host five expert panelists from the U-M community: Martha Jones, professor of history, Afro-American and African studies, and law; Angela Dillard, LSA associate dean of undergraduate education; Robert Mickey, associate professor of political science; Hakeem Jefferson, PhD candidate in political science; and Austin McCoy, PhD candidate in history.

            Promotional

Our team provided the panelists with pre-scripted questions that provided structure for the conversation. The questions revolved around several broad themes, including: how Coates’ book fits into and illuminates the #blacklivesmatter movement, and how instructors can incorporate the book and its themes into the classroom. We also looked at Coates himself, and how he is situated among other prominent authors writing about black America.

We greatly valued the insights and expertise of our panelists as they shared their ideas and opinions on one of the most important issues facing our country:

Q8Angela 3 Austin 3 Martha 3Hakeem 3  Rob3

Q10
Martha8 2
  Rob 8 Austin 8 1 Austin 8 2 Hakeem 8 Martha 8 Angela 8

Q10 Angela 10 Austin 10 Hakeem 10 1 Hakeem 10 2 Martha 10

 

Rob 10

You can see a full recap of the chat on Storify

The impact of this chat was remarkable: the hashtag #UMichChat generated a total of 5,715, 802 impressions with a total social reach of nearly 700,000 people in the days leading up to the chat. During the hour itself, #UMichChat was the top trend for the Detroit area.

augustfollowthehashtag Trending

 

Many other community members joined the conversation (including a retired Residential College lecturer who opened a Twitter account explicitly to participate in this chat and was very complimentary after it concluded.) This is a clear indication that we met our goals of community engagement and extensive reach.

Additioanltweeters made a twitter

We would like to thank our panelists for their time and their insight. Next month, we’re honored to be hosting two chat events on September 11– the first an exclusive conversation with President Schlissel about the upcoming school year; and the second, a “back to school” panel focusing on academic advising, housing/dining, and student life resources for new students. Be sure to #StaySocial and join in next month!

HoME

This post was written by Sarah Barnitt, UMSocial intern and Bachelor of Science in Information student. #staysocial with her on Instagram and Twitter @sarahbarnitt.

 

Dormspiration

We are delighted to announce our 2nd annual Dormspiration Pinterest contest!

With our victors soon on their way to move-in and create their hoMe away from home, and, after the incredible entries last year, we’re excited to see what DIYs and dorm ideas you’ll create and share with us.

This contest is for everyone; crafting skills are not required. All you have to do is share your UMich decoration inspiration for your apartment, dorm, house or resources you’d recommend to our new #Victors2019 on your Pinterest account with a board titled “My UofMichigan #Dormspiration”! Last year we had over 80 participants create fantastic new boards, and we hope to have even more shared with us this time around!

 

Sounds easy? Good!

What do you get if you win? Huge rewards!

 

01_e (2)

FIVE lucky winners will receive a-maize-ing prizes! This year we’ve partnered with collage.com; a startup founded by two Wolverines that allows you to design and create customizable gifts. Prizes include one-of-a-kind University of Michigan decor, DIY projects, posters, and more!

Additionally, the team at collage has been generous enough to offer a deal for a free 11″ X 14″ poster. Follow this link to receive a voucher code good for one free matte archival poster that you can customize with photos from your phone, computer, Facebook, or Instagram. It’s a $14.99 value and all you pay is $5.99 for shipping. Don’t miss out on this deal!

Best of luck to all participating Wolverines – Go Blue!

 

Wolverines of Ann Arbor

I have always been fascinated by how, despite the interconnectedness of humanity, two people could go their entire lives ‘not existing’ to each other, simply because they never happened to cross paths. John Koenig, in The Dictionary of Obscure Sorrows, defines “sonder” as “the realization that each random passerby is living a life as vivid and complex as your own—populated with their own ambitions, friends, routines, worries and inherited craziness—an epic story that continues invisibly around you like an anthill sprawling deep underground, with elaborate passageways to thousands of other lives that you’ll never know existed, in which you might appear only once, as an extra sipping coffee in the background, as a blur of traffic passing on the highway, as a lighted window at dusk.”

At the University of Michigan, students, professors, and staff alike are interconnected, linked by the legacy of maize and blue. Although diverse in thought, background, and life experiences, we are all part of the 200-year legacy of the University of Michigan and we all contribute to the fabric of this institution.

With that in mind, and inspired by Brandon Stanton’s Humans of New York, I created Wolverines of Ann Arbor for a Writing 200 mini-course in the Winter 2015 semester. My goal was to bring to light the lives and stories of those who’ve been touched by the University of Michigan.

This summer, I had the opportunity to join #UMSocial as an intern, and I offered Wolverines of Ann Arbor to the team. I wanted to increase Wolverines’ reach, and featuring the photo-essay series on UMSocial’s social platforms would help it to reach its greatest potential, and share these amazing Michigan stories with a wider audience.

So I’m delighted to announce that Wolverines of Ann Arbor will be launching on UMSocial platforms this month. We’ll be posting stories twice a week: on Instagram every Monday and on Facebook every Wednesday. If you know someone who’s got a great story to share, please let us know by e-mailing UMSocial Umsocial@umich.edu. We’re looking for all sorts of stories: from that dining hall employee who always makes you smile, to the professor who tells hilarious jokes at 8am on Monday, to that friend of yours who inspires you every day.

Since the beginning of Wolverines of Ann Arbor, the goal was to capture the organic essence of the University of Michigan, by featuring real people talking about real emotions, real beliefs, and real thoughts. All statements made by individuals photographed belong to the individual and do not necessarily represent the beliefs and opinions of the University of Michigan. Wolverines of Ann Arbor launches in August 2015; we hope our posts about the people of #UMich whet your interest and encourage you to add your own story.

 

This post was written by Nadia Karizat, #UMSocial Intern and Communications Sophomore.

July 2015 Recap

July-  the ‘dog days of summer’ -traditionally a quiet time on college campuses. But social media never sleeps, and neither does the University of Michigan campus! Our team spent July exploring events on campus and around town, including the opening of a connected-vehicle “city” and the annual Ann Arbor Art Fairs. July also saw a presidential visit to China and a research project at an organic coffee farm in Central America.

Snapchat:

We use Snapchat to tell interesting stories and give the U-M community the opportunity to experience campus events in real-time. Our Snapchat following is currently of 8,299  and is expanding daily.

 We wanted to see where people were spending their #WolverineSummer, especially during Independence Day weekend! So we encouraged our Snapchat followers to snap us their geofilters over the holiday, and shared our favorites in a collage:

Geofilters 

For the dedication of the MCity driverless-vehicle site on North Campus, we created a Snapchat story featuring an inside look at some of the test vehicles, and included a mini interview with President Schlissel. This story received more than 4,500 views, enabling our followers to learn more about the groundbreaking research on autonomous vehicles taking place at Michigan.

 Snapchat is an incredibly useful platform for communicating with new and prospective students, and we use it frequently to reach out to the #Victors2019. This month, we focused on Orientation and went backstage with the cast of the Educational Theatre Company, who perform a student-life-focused theatrical show for all orientees. This story earned more than 4,700 views AND got us a shout-out for Snapchat best practices.

ETCSnap 

Other stories captured event that were going on around town, including Swing dance lessons at the cube, food tasting and stall-hopping at the Ann Arbor Art Fairs, and a very cool behind-the-scenes tour of the Kelsey Museum of Archaeology.

 We believe that Snapchat is an amazing resource for higher education social media, since it allows universities to personally connect with students in a way no other platform can.

 

Twitter

Our Twitter account serves two purposes, it provides information about the University of Michigan generally, but it also highlights the accomplishments of individual University departments, programs, and organizations. We have collaborated with both Michigan News, retweeting their content frequently, and the University Record–promoting Record articles with the hashtag #URecord– to drive traffic to their sites and more widely disseminate their stories.

 Twitter is a popular platform with both parents and students alike. Therefore, it is the perfect platform for the whole family to engage with the #Victors2019 .

victors2019twitter1 victors2019twitter2

We’re glad that the newest members of our community feel comfortable and inspired enough to publicly reach out on social media. Let us keep hearing from you!

 On July 7, we had the privilege of hosting a panel of alumni for our latest #UMichChat- “Forever Go Blue: Life After Michigan” in partnership with the Alumni Association of the University of Michigan (AAUM). We explored the transition from student to professional with some highly accomplished Michigan alumni: Mike Mikho, Chief Marketing Officer for 247 Laundry Service; Susan Orlean, best-selling author and staff writer for The New Yorker; Peter Vanderkaay, three-time Olympian and public speaker; and Dhani Jones, TV host, entrepreneur, and former NFL linebacker. The chat was an enormous success, generating over 14 million impressions. By the end of the one-hour event, the hashtag #UMichChat was trending regionally.

UMICHCHAT ad

Screen Shot 2015-08-05 at 10.27.22 AM trending! 2

Check out a full recap of the chat here, or follow the complete conversation on Storify.

YouTube

Videos are always popular, and we have made a conscious effort to increase the amount of video content on all our social media channels. We’ve worked especially hard to promote and build our presence on YouTube.

Our YouTube content comes primarily from two sources: videos aggregated from U-M school/college and department channels, and original content that we produce ourselves.

In July, we released the first episode of a new video series called “InsidetheM,” – which takes an in-depth look at student life. Our first feature focused on Michigan Dining, with footage of the beautiful new South Quad dining hall, interviews from a head chef, and important information including dining hall renovations, nutrition, and sustainability. Future episodes will look at University Housing and CSG student organizations. We hope this series will be useful to students and we’re excited to see how it grows.

 

Cars were all the rage on our Youtube channel this month, as we posted two automotive-related features: a video documenting the Mcity dedication: and coverage of the launch of the Solar Car team’s unveiling of their latest vehicle. Both videos speak to the breadth of engineering research and activity here at the University.

Our YouTube channel has immense potential to become a central resource for both information and entertainment, and we’re looking forward to further consolidating university content and focusing on the development of this space.

 

Facebook

Our Facebook page has the largest and most diverse fan base of any U-M social media channel, so we make sure to post a variety of content that will appeal to different segments of the community and which will showcase the breadth of activity–and the beauty– of our campus. Our weekly #MichiganMonday posts include stunning campus imagery along and an inspirational quote from an alum each week:

11817136_10153171006845753_8333003175789049351_n 

There are Wolverines covering every corner of the globe and this month, we used our Facebook page to share stories about what UM students and faculty are doing abroad. We uploaded a photo album chronicling President Schlissel’s trip to China- his first overseas trip as University President. President Schlissel visited Chinese partner institutions and also found time to meet with international alumni. Sharing snapshots of him was a great way to showcase his travels, which affirm Michigan’s commitment to global engagement:

Schlissel China

 

Professor David Turnley’s photography students  practiced their art in Paris and documented it on a Tumblr page. The blog, photographingparisdavidturnley.tumblr.com/, is filled with stunning images of Parisian life, and we strongly encourage you to check it out:

Turnley FB

Instagram

We were fortunate enough  Michigan Photography’s Eric Bronson take over our Instagram account for the first week in July. Bronson, who was named Photographer of the Year by the the UPAA (University Photographers’ Association of America) in 2013 and 2015, filled our feed with gorgeous shots of campus, with comments for context, and also included photography tips:

bronson1 bronson2 bronson3 bronson4

Toward the end of the month, we posted  “On Assignment,”- a week-long photo narrative from William Foreman,  the associate director of international communications at Michigan News. Foreman traveled to Mexico with a group of U-M ecology and evolutional biology students and faculty who are doing research at Finca Irlanda, the world’s first-certified-organic coffee farm. The colorful and compelling images show life and research on the plantation- which U-M faculty have been studying for the past 17 years, and provide some context for the morning “cup of joe” that many of us love.

OnAssignment1 OnAssignment2

 

 Finally, we began a feature entitled “Week In Review,”  in which we post a 15-second video of the week’s top headlines, curated by Michigan News. These videos are quick and attention-grabbing, and will inform our followers of important things that are going on in our community. We’re grateful for the opportunity to partner with Michigan News and bring our followers this content; we hope you find it valuable.

Pinterest

This month, we created two new Pinterest boards: Summer at  #UMich and Welcome to Mcity. Summer at #UMich is a board dedicated to showcasing the beauty of our campus, even during the dog days of heat and humidity. We’re also pinning events and information for students who may be spending their #WolverineSummer on campus.

Summer at UMich

Our Welcome to Mcity pinboard serves two purposes. On dedication day, it functioned as a digital photo album, hosting the images shot by Michigan Photography. Now, the photo album is a place where we can aggregate media related to Mcity and the technology it represents. As Mcity grows, the board will grow with it, highlighting the potential it provides for engineers, the automotive industry, and the community alike.

MCity Pin

 

A word of thanks

In a recent industry benchmark study, we were delighted to discover that UMich is the only university in the country to rank in the top 10 in all five major social media platforms. We currently have 687,830 fans on Facebook,123,694 followers on Twitter,18,790 followers on Pinterest, 65,514 followers on Instagram, and 8,299 followers on Snapchat:

top10 2

 

We hope that our content continues to be useful and interesting. And thank you to all who have shared their Michigan journey with us on social media; you are the reason #UMSocial is a success. As always, #GoBlue and #StaySocial.


This post was written by Sarah Barnitt, #UMSocial intern and Bachelor of Science in Information student. #StaySocial with her on Instagram and Twitter @sarahbarnitt