[ARCHIVED] Secure Admin for Canvas

[kayser]

I have an issue with security. I am Admin on our School Canvas.

I have a DeanDerran account showing up consistently on our school People section in which Hacker has posted "students" who come through our school account via a back door? It comes via Chrome browser, only once did it come via FireFox. The Hackers, unknown to me came starting in January, I only just took over and I've seen evidence of them through Chrome attaching to School Canvas each night, in the middle of the night or early morning. The hackers are enrolled as teachers. Some of their activity include "posters" of Dumps Cert, IT Cert, and Other advertisements. They have trolled my ELA courses. I have implemented no sync on Chrome which ends up locking up my students Google Doc Collaboration. That no sync step held them somewhat at bay. How do I stop them from penetrating our Canvas account?

I've deleted 5 x 15 people per page accumulated since January; now I'm deleting at least 3-6 hackers each day. I really need some help.

[Steven_S]

I would check user permissions and look for someone with permission to add users.  https://community.canvaslms.com/t5/Admin-Guide/How-do-I-set-permissions-for-an-account-level-role/ta... If you have "teachers" who do not belong, that you delete and then they reappear, you likely also have someone with admin rights they should not have.

[kayser]

I have our IT assistant look into that, but we couldn't find anyone with Admin help.

We have determined that the hacker getting in has Admin capability and may have, or may used to have had Admin access to any and all Canvas sites via Canvas admin corporate.

[chriscas]

Hi @kayser ,

There are a lot of different ways this could be happening.  A lot of institutions had something similar happen a couple years ago with the ePortfolios feature (similar pages set up advertising dump, etc).  We used single sign-on, and had JIT provisioning enabled (so people with a valid login would get a Canvas account created).  Our SSO allowed people to create their own accounts though, which led "hackers" to do that and then gain access to our Canvas instance.  They were not listed in any courses as a teacher though, so your situation might be slightly different (but perhaps same group of offenders since the content sounds similar).

Just a few quick things to check out...

• Do you use SSO for Canvas authentication? If so, I'd closely check the config there.
• Do you have open registration enabled in your account settings?  If so, you might want to disable that.
• Check all of your accounts with admin access for any rogue API tokens attached to them, as those can be used to do all kinds of actions through the API without even logging in.

If you don't have an expert on your team to really dive into all the potential paths here, it might be a good idea to look into getting at least a consultant or something.  The community here is great, but all of us will really just be throwing out random things that *might* be happening without really seeing how your Canvas instance is configured

-Chris

[kayser]

Hi, I have two of us working through my account, since I'm teaching too, to hunt up how these folks get in. Each one is labeled "enrolled as teacher". When I open their Pages or Files, they aren't seeable by our students, only by me as Admin. Each hacker has IT Cert, Dump, Hero Plus, Gold posters in Pages.

I looked through my Google Drive, and they enter along that path to Canvas that is synced due to having Google Collaboration for all Online Students. 

How would anyone get in, if we delete past teacher users? Thank you for answering me that 45 page .pdf was pretty intimidating.

[Steven_S]

If you have narrowed down the point of access to your google collaboration, I would change the password on your google account, and look into the security options in google for securing your account.  How anyone could hack from your google account into canvas is beyond my limited knowledge.  However, since you have identified that as the path, I would remove the google collaboration from you admin account.  Then set up a faculty account for yourself to use in running the online course that needs the google collaboration.  If hackers actually come in through your collaboration, at least that way they will not have access to your admin privileges.

I am completely self-taught, and I know nothing about hacking, so I would also recommend contacting canvas support to talk to an expert about this issue.  Google collaborations should not allow a hacker in your google account to access canvas.

[kayser]

Thank you.

I have been trying to get with Canvas.  Apparently they are busy and have only assigned me a Number for my concern. The phone number says to go here.

I do appreciate the advice you do offer and will change my Google Drive connection to my schools gmail.

[Steven_S]

The 24/7 chat or phone support is the fastest response time available, but lately it does take hours waiting for your position in line to count down from 99+.  What you get here though is only a response from random other canvas users with varied skill levels

[kayser]

Two of us did try the phone number offered under security help, and it said If you are Canvas, go to online help and create a ticket. Bridge gets phone help, not Canvas unfortunately.

I did just get some info from Help Security to look into the our severe case of "hackers" invading our school's territory. Hopefully that will bring results.