the attackers use a password decoding application called "John the Ripper"
Since when was John the Ripper a password decoding application? I know this is picky, but it annoys me that that was put in a report from a university's IT department. If they had said a password cracker, that would have been alright, but by saying decoder they were implying that John decodes passwords which AFAIK it doesn't.

It's also possible to take something else from that comment: they were using some sort of reversible encryption (Incredibly unlikely...nay, impossible), so why say decoder? Argh!

ac