
Elsevier Hacked: Can we get some basic security for journal editorial systems?

17Dec12

Retraction Watch has a post on the Elsevier Editorial System (ESS) being hacked at some point in the last month, and generating some paper withdrawls because the reviews for it were faked. Sadly, I am not surprised – some of the security measures taken by journals are a touch out-of-date.

The text of one of the retractions reads as follows:

This article has been retracted: please see Elsevier Policy on Article Withdrawal (http://www.elsevier.com/locate/withdrawalpolicy).

This article has been retracted at the request of the Editor-in-Chief.

A referee’s report on which the editorial decision was made was found to be falsified. The referee’s report was submitted under the name of an established scientist who was not aware of the paper or the report, via a fictitious EES account. Because of the submission of a fake, but well-written and positive referee’s report, the Editor was misled into accepting the paper based upon the positive advice of what he assumed was a well-known expert in the field. This represents a clear violation of the fundamentals of the peer-review process, our publishing policies, and publishing ethics standards. The authors of this paper have been offered the option to re-submit their paper for legitimate peer review.

While we live in an age where all websites are vulnerable, I’ve found journal submission/editorial/review sites to have a uniquely lax approach to security. As just one example, I’ve had my password sent to me, in unencrypted plain text by more than one journal’s system.

Plain text. That’s…pretty basic security fail. Right up there with your administrator password being “password”.

I assume it hasn’t been a bigger problem because peer reviewed journals are kind of obscure targets. But apparently not obscure enough.

Advertisements


No Responses Yet to “Elsevier Hacked: Can we get some basic security for journal editorial systems?”

  1. Leave a Comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s


%d bloggers like this:
https://confounding.net/2012/12/17/elsevier-hacked-can-we-get-some-basic-security-for-journal-editorial-systems/
confounding.net
crawl=CC-MAIN-2019-30
60427
application/http; msgtype=response
sha1:MG6WMX2RURE7OXE5ILC7AUFMGW77NMUY
<urn:uuid:1c81e5b3-c361-41bb-9674-0fcc084ff796>
2019-07-17T17:26:55Z
192.0.78.24
application/xhtml+xml
sha1:3Q4VKMV7AUNP62SIZAWBR3MVCKQLMNMR
<urn:uuid:7827b4f3-80b4-4d9a-bafb-dc4c8c61914a>
https://confounding.net/2012/12/17/elsevier-hacked-can-we-get-some-basic-security-for-journal-editorial-systems/
response
<urn:uuid:1fb5c42d-f4ca-4600-846c-59695ba9b7ef>
isPartOf: CC-MAIN-2019-30
publisher: Common Crawl
description: Wide crawl of the web for July 2019
operator: Common Crawl Admin (info@commoncrawl.org)
hostname: ip-10-141-32-141.ec2.internal
software: Apache Nutch 1.15 (modified, https://github.com/commoncrawl/nutch/)
robots: checked via crawler-commons 1.1-SNAPSHOT (https://github.com/crawler-commons/crawler-commons)
format: WARC File Format 1.1
conformsTo: http://iipc.github.io/warc-specifications/specifications/warc-format/warc-1.1/