<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Consolas",serif;}
span.xcye-lm-tag
{mso-style-name:x_cye-lm-tag;}
span.EmailStyle24
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Melissa,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We also use self-hosted EZProxy and have blocked IP ranges at the beginning of our config file using the RejectIP directive. This is a little bit of a blunt instrument, but has been working for us.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Margo Duncan, MLS<o:p></o:p></p>
<p class="MsoNormal">Electronic Resources & Collection Development Librarian<o:p></o:p></p>
<p class="MsoNormal">Robert R. Muntz Library | The University of Texas at Tyler<o:p></o:p></p>
<p class="MsoNormal">903.566.7174 | <a href="mailto:mduncan@uttyler.edu">mduncan@uttyler.edu</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Eril-l <eril-l-bounces@lists.eril-l.org> <b>On Behalf Of
</b>Melissa Belvadi<br>
<b>Sent:</b> Friday, August 27, 2021 7:39 AM<br>
<b>To:</b> Nikki DeMoville <ndemovil@calpoly.edu>; eril-l@lists.eril-l.org<br>
<b>Subject:</b> Re: [Eril-l] hackers, messed up COUNTER data, and ezproxy vs openathens<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Yes, we think we've done what we can within ezproxy's options, but every time we lower the usage limits further than what we have, we interfere with a legitimate use by one or other unhappy faculty.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">And usage limits also don't impact the hackers' effect on our turnaway data (TR_J2 in COP5), which is also being rendered useless by these incidents for those months.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">And thanks, Paul Butler, for the blacklist work you do - we most definitely take advantage of your updates for that!<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div id="Signature">
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124;background:white">Melissa Belvadi</span><span style="font-size:12.0pt;color:black">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124">Collections Librarian<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124">University of Prince Edward Island<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124"><a href="mailto:mbelvadi@upei.ca" target="_blank">mbelvadi@upei.ca</a> 9</span><span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#202124">02-566-0581</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#202124">ORCID iD: 0000-0002-4433-0189</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124">my <a href="https://urldefense.com/v3/__https:/outlook.office365.com/owa/calendar/0fbab27c909e4493be65313bd66d66b6@upei.ca/5fa60af92c6d451c9ddf90c0bb11e00f15552192987609852692/calendar.html__;!!E8kiGCC_!mF8qSTgYd0ZiUJ14XVpBZ9yRb2olIJRorHRHXx-5VJ82hCntaFSTp1Z4emZ9C6TtmQ$" title="https://outlook.office365.com/owa/calendar/0fbab27c909e4493be65313bd66d66b6@upei.ca/5fa60af92c6d451c9ddf90c0bb11e00f15552192987609852692/calendar.html">public calendar</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124"><a href="https://urldefense.com/v3/__https:/mbelvadi.youcanbook.me/__;!!E8kiGCC_!mF8qSTgYd0ZiUJ14XVpBZ9yRb2olIJRorHRHXx-5VJ82hCntaFSTp1Z4emYvDc1zJQ$" target="_blank">Make
an appointment</a> via YouCanBookMe<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> Eril-l <<a href="mailto:eril-l-bounces@lists.eril-l.org">eril-l-bounces@lists.eril-l.org</a>> on behalf of Nikki DeMoville <<a href="mailto:ndemovil@calpoly.edu">ndemovil@calpoly.edu</a>><br>
<b>Sent:</b> Thursday, August 26, 2021 4:36 PM<br>
<b>To:</b> <a href="mailto:eril-l@lists.eril-l.org">eril-l@lists.eril-l.org</a> <<a href="mailto:eril-l@lists.eril-l.org">eril-l@lists.eril-l.org</a>><br>
<b>Subject:</b> Re: [Eril-l] hackers, messed up COUNTER data, and ezproxy vs openathens</span>
<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="line-height:10.0pt;background:#FF9999"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#17202A">WARNING:</span></b><span style="color:black">
</span><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#17202A">The sender of this email could not be verified and may not match the person in the 'FROM' field. Do not click links or open attachments unless you recognize the sender and know
the content is safe. If you are uncertain, please forward to <a href="mailto:phishing@upei.ca">
phishing@upei.ca</a> and delete this email. <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="line-height:10.0pt;background:#FFE599"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#17202A">CAUTION:</span></b><span style="color:black">
</span><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#17202A">This email originated from outside of UPEI. Do not click links or open attachments unless you recognize the sender and know the content is safe. If you are uncertain, please forward
to <a href="mailto:phishing@upei.ca">phishing@upei.ca</a> and delete this email.
<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Hi Melissa,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">I'm sure you've already explored this, but just to make sure, have you tried adjusting your UsageLimit in EZproxy to make it harder for the bad actors using stolen credentials to mass download?
I'm sure they can find ways around it, but it might slow them down.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><a href="https://urldefense.com/v3/__https:/help.oclc.org/Library_Management/EZproxy/Configure_resources/UsageLimit?sl=en__;!!E8kiGCC_!mF8qSTgYd0ZiUJ14XVpBZ9yRb2olIJRorHRHXx-5VJ82hCntaFSTp1Z4emZggdqtOQ$">https://help.oclc.org/Library_Management/EZproxy/Configure_resources/UsageLimit?sl=en</a><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div id="x_Signature">
<div>
<div id="x_divtagdefaultwrapper">
<pre><span class="xcye-lm-tag"><b><span style="font-size:11.5pt;font-family:"Calibri",sans-serif;color:#201F1E;background:white">Nikki DeMoville</span></b></span><span class="xcye-lm-tag"><span style="font-size:11.5pt;font-family:"Calibri",sans-serif;color:#201F1E;background:white"> <i>(she/her/hers)</i></span></span><span style="font-size:11.5pt;color:#201F1E"><br></span><span class="xcye-lm-tag"><span style="font-size:11.5pt;font-family:"Calibri",sans-serif;color:#201F1E;background:white">Coordinator - Electronic Resources, Acquisitions, and Resource Sharing</span></span><span style="font-size:11.5pt;color:#201F1E"><br></span><span class="xcye-lm-tag"><span style="font-size:11.5pt;font-family:"Calibri",sans-serif;color:#201F1E;background:white">Robert E. Kennedy Library</span></span><span style="font-size:11.5pt;color:#201F1E"><br></span><span class="xcye-lm-tag"><span style="font-size:11.5pt;font-family:"Calibri",sans-serif;color:#201F1E;background:white">California Polytechnic State University</span></span><span style="font-size:11.5pt;color:#201F1E"><br></span><span class="xcye-lm-tag"><span style="font-size:11.5pt;font-family:"Calibri",sans-serif;color:#201F1E;background:white">San Luis Obispo, California</span></span><span style="font-size:11.5pt;color:#201F1E"><br><br></span><span class="xcye-lm-tag"><span style="font-size:11.5pt;font-family:"Calibri",sans-serif;color:#201F1E;background:white">Direct 805-756-5780</span></span><span style="font-size:11.5pt;color:#201F1E"><br></span><span class="xcye-lm-tag"><span style="font-size:11.5pt;font-family:"Calibri",sans-serif;color:#201F1E;background:white">Fax 805-756-1415</span></span><span style="font-size:11.5pt;color:#201F1E"><br></span><span class="xcye-lm-tag"><span style="font-size:11.5pt;font-family:"Calibri",sans-serif;color:black;background:white"><a href="mailto:ndemovil@calpoly.edu" target="_blank">ndemovil@calpoly.edu</a></span></span><o:p></o:p></pre>
<pre><i><span style="font-family:"Calibri",sans-serif">Due to the COVID-19 situation, I am working remotely. Please use email for all communications.</span></i><o:p></o:p></pre>
</div>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> Eril-l <<a href="mailto:eril-l-bounces@lists.eril-l.org">eril-l-bounces@lists.eril-l.org</a>> on behalf of Melissa Belvadi <<a href="mailto:mbelvadi@upei.ca">mbelvadi@upei.ca</a>><br>
<b>Sent:</b> Thursday, August 26, 2021 9:59 AM<br>
<b>To:</b> <a href="mailto:eril-l@lists.eril-l.org">eril-l@lists.eril-l.org</a> <<a href="mailto:eril-l@lists.eril-l.org">eril-l@lists.eril-l.org</a>><br>
<b>Subject:</b> [Eril-l] hackers, messed up COUNTER data, and ezproxy vs openathens</span>
<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Hi, all.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><br>
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">We've had two more "rounds", for a couple months late last year and then again in May-June of this year, where our COUNTER data for some major journal publishers is worthless because breached-password
events caused absurd spikes across every journal in the package (both ft uses and turnaways). We have self-hosted ezproxy, with a Shibboleth/LDAP server doing the authentication.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Knowing that there's just no way for us to enforce password security so that leaks never happen, I was wondering if anyone could speak to whether it would make any significant difference to this
problem if we were to switch from ezproxy to open athens. I know open athens would rely on that same underlying authentication, but I was given the impression that it had additional ways to prevent such hacking, especially if it is coming from overseas (we
all know which countries' IPs these incidents originate from).<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Could anyone who has switched from ezproxy to open athens and had previously experienced these kinds of problems share with us whether you've seen such breaches that are big enough to impact COUNTER
data cease after you switched?<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div id="x_x_Signature">
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124;background:white">Melissa Belvadi</span><span style="font-size:12.0pt;color:black">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124">Collections Librarian<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124">University of Prince Edward Island<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124"><a href="mailto:mbelvadi@upei.ca" target="_blank">mbelvadi@upei.ca</a> 9</span><span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#202124">02-566-0581</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#202124">ORCID iD: 0000-0002-4433-0189</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124">my <a href="https://urldefense.com/v3/__https:/outlook.office365.com/owa/calendar/0fbab27c909e4493be65313bd66d66b6@upei.ca/5fa60af92c6d451c9ddf90c0bb11e00f15552192987609852692/calendar.html__;!!E8kiGCC_!mF8qSTgYd0ZiUJ14XVpBZ9yRb2olIJRorHRHXx-5VJ82hCntaFSTp1Z4emZ9C6TtmQ$" title="https://outlook.office365.com/owa/calendar/0fbab27c909e4493be65313bd66d66b6@upei.ca/5fa60af92c6d451c9ddf90c0bb11e00f15552192987609852692/calendar.html">public calendar</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124"><a href="https://urldefense.com/v3/__https:/mbelvadi.youcanbook.me/__;!!E8kiGCC_!mF8qSTgYd0ZiUJ14XVpBZ9yRb2olIJRorHRHXx-5VJ82hCntaFSTp1Z4emYvDc1zJQ$" target="_blank">Make
an appointment</a> via YouCanBookMe<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#202124"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>