21 ms·

“Appointment” as professor at Harvard was an elaborate phishing attack

214 points by LordAtlas 6y ago

vinni2 6y ago
Can’t believe how confident must be. Harvard headhunted her without even applying for the job? She must be so cocky to fall for it.
- feral 6y ago
  That is a bad sort of victim blaming. I hope you wouldn't apply that logic to victims of other non-online crimes. Anyway, separately, she addresses that in her article, convincingly I thought. Plus she's brave and helping others to write about this (which victim blaming doesn't encourage).
  - namanaggarwal 6y ago
    My only point is that she is a journalist working for a reputable news agency for 21 years. Her job was to fact check everything. This means that a lot of things she told in the media before should be taken with a pinch of salt.
    - minot 6y ago
      Not just her. All of journalism. http://www.paulgraham.com/submarine.html http://www.paulgraham.com/submarine.html
  - vinni2 6y ago
    I would expect my aunt who thinks everything on WhatsApp is true to fall for it. She is a professional journalist with lots of experience as a fact checker. I am sorry she fell for it but someone with her education level and awareness I expected more.
- cowpig 6y ago
  What a strange reaction to this story.
  - hfkldjsjfkdj 6y ago
    Can't anyone say anything negative even if it makes sense?
    - ryder9 6y ago
      ah yes the "my opinion is immune to criticism" response
- nip180 6y ago
  I had a similar thought: I would be more and more suspicious the longer I didn’t get an email from an @harvard.edu email.
  - FreakyT 6y ago
    The article states that all the emails appeared to be from official Harvard email addresses. At some universities, it’s possible to create email aliases at your .edu domain, so it’s possible that the scammer had access to one or more convincing email addresses.
    - nip180 6y ago
      That greatly increases the level of sophistication. The article doesn’t say that the emails received were “@harvard.edu” only that they appeared to be valid Harvard ids. That means she made a judgement call that the email were legitimate, but it doesn’t give very many technical details on what she judged that call on.
      - InitialLastName 6y ago
        This makes me assume that the bits she's most embarrassed about (a fact-checker should be able to find out what the valid Harvard email domains are) are the one she glossed over.
        nip180 6y ago
        I don’t think this article was written for a technical audience so it’s not surprising that it’s light on technical details.
- bob33212 6y ago
  Most phishing scams required the target to have an emotional reaction that clouds their judgement. For example, if you get an email saying that your credit card was charged in another state, if you are worried about your finances you may panic and click on the button to login and deny the charges.
- rm445 6y ago
  > I was invited to speak at an event (...) One of the apparent organisers of this event contacted me separately to say there was a vacancy for a teaching position and would I be interested (...) I submitted my CV (...) A few weeks later I was "interviewed" This sounds exactly like the kind of job opportunity that's meant to come about by networking, getting your name out there, public speaking and so on. We are often told that this is how the best jobs are found.
  - ghaff 6y ago
    Yes, up to that point it all seems very plausible whatever the victim-blamers on this thread think. Down the road, should alarm bells have started going off? Probably. But especially in the context of COVID-19, it's not hard to imagine those bells being suppressed in the excitement of a new opportunity etc.
cowpig 6y ago
This scam sounds frighteningly sophisticated. I really feel bad for people who get caught up in things like this. To get strung along for over a year, throwing away that much time and energy, must feel devastating.
- runawaybottle 6y ago
  It’s not sophisticated, it preys on very vulnerable and sheltered people. Like, you have to know Harvard is not going to just call you up one day and decide to fly you over to America lol. Really a problem with delusions amongst many of us.
  - ceejayoz 6y ago
    You really should consider reading the article.
    - runawaybottle 6y ago
      I did.
unanswered 6y ago
Whenever I'm changing jobs, I spend at least half my time worried sick that I'm being scammed somehow. Until now, the "rational" part of my mind thought this was very silly, but I think this goes to show that it's a legitimate concern. The fact of the matter is that when joining a new institution one lacks the contacts and the context to discern normal institutional behavior because it so often deviates from (seemingly) ordinary, sane human behavior even when nothing is wrong. Having autism, no part of my mind is naturally attempting to cover up this discrepancy: it remains jarring until I manage to "manually" reset expectations.
- djrogers 6y ago
  > The fact of the matter is that when joining a new institution one lacks the contacts and the context to discern normal institutional behavior That was the case for me at a couple of very early jobs in my career, but hasn’t been the case for the last couple of decades. New jobs come by way of old colleagues, friends, etc. in such a way that I’m basically never walking in to a completely unknown situation. If you’re not great at relationship maintenance, use something like LinkedIn. Reach out to former coworkers who you worked well with or got along with, and ask about jobs. Odds are very high that they’d like to work with you again, and will get a referral bonus if it happens!
  - ghaff 6y ago
    I've gotten out of the blue recruitment calls, but after my first job via on campus recruitment out of grad school, every job (just a few of them) have been directly through people I knew. Except for essentially pro-forma reasons, I've probably never really needed a resume.
- lagolinguini 6y ago
  It's been particularly hard interviewing during the pandemic. In usual times, at least you would visit the office and meet some real people in person. Not saying you can't get scammed in person, but it's definitely harder to impersonate reasonably large organisations like that.
crowf 6y ago
> In January 2020, I got an email from an alleged Harvard Human Resources person from what appeared to be an official Harvard email ID, it would have been interesting if she would have shared exactly what that email address was. Was it hr@harvard.com or maybe hr@harverd.com? I doubt that it was hr@<something>.edu since it is hard to register .edu domains. But if someone did, that would be news to me.
- alisonkisk 6y ago
  A clever person could hijack an alumni email account username@post.harvard.edu Note the bad pun Harvard uses: "post" Or you could get an address (deceptively or via hijack) on an subdomain run by a student group.
  - ghaff 6y ago
    Yeah. The alumni emails probably follow a pattern. Get a list of alumni and find one who hadn't set up an email forwarding address previously and set up an account.
  - pge 6y ago
    You can’t send from a post.harvard.edu email address - it is just a forwarding address for receiving mail.
- notahacker 6y ago
  A url containing 'harvard' and redirecting to an actual faculty website is going to convince most people if the communications are plausible. Many large organizations use multiple url forms for emails, especially for quasi-separate divisions like business schools or extension programmes. A particularly sneaky scammer without access to Harvard mailboxes might register a plausible-sounding domain with an .ac TLD (which resembles the .ac reserved for universities in many national domain systems including the author's, but is actually a freely purchasable domain supposedly associated with Ascension Island)
- netsharc 6y ago
  Maybe something like @harvard-school-of-journalism.com, although that's too wordy. The article mentions "Harvard Extension School", so, it could be some variation of that. Edit: I tried harvard-extension.school in the browser, it redirected me to http:harvard-education.edu (not https!), which seems to be a clone of extension.harvard.edu . The WHOIS records of harvard-extension.school/.education are pretty new (registered last year), and they're registered on GoDaddy and 1API GmbH respectively. A Germany-based registrar? Would Harvard use them?
nip180 6y ago
How do we establish trust in a virtual world? There are a lot of cues in an meatspace social interaction that can trigger a “gut reaction” one way or another on trust. In digital interactions it’s significantly easier to be social engineered.
- lagolinguini 6y ago
  Everybody gets a public key certificate, possibly since birth. There needs to be some way of establishing that which keys belong to which person, perhaps via some government registry, and a way to invalidate old/compromised keys. Overkill?
  - Aerroon 6y ago
    Kind of like ID cards in Estonia? You have a chip on the card that holds your private key and the government has a list of people and their public keys. Services and other people can check that. You can even sign and encrypt documents with it.
    - netsharc 6y ago
      China's ID cards also have chips, and they have to scan them to enter train stations or airports (or the center of the old town in Tibet)...
pomian 6y ago
That's an intense level of con. Timed with the pandemic, it could have been hard not to fall for. I hope there is a follow up on who pulled it off. Did the perpetrators know the victim, did they send more of these "letters"? The con seemed pretty specific for a certain target. A lot of work to pull off. Also wonder if, and hope, Nidhi got her old job back. With a great story.
- scotty79 6y ago
  It seems more specific to Harvard. I wonder if the documents she was given by scammers were just believable or accurate. If they mirrored actual Harvard recruitment process then it's possible that whoever did this wokred or applied there. Or maybe it wasn't about the money? Maybe she was targetted specifically for her previous roles and knowledge? Attack was very sophisticated.
  - alisonkisk 6y ago
    There is no "Harvard recruitment process" for adjunct lecturers at the Extension school. People beat down Harvard's door for jobs. Story is very fishy.
    - foolmeonce 6y ago
      I wouldn't find it suspicious if some professors preferably refer people who speak on the campus over the database of spontaneous CVs, and there is a process regardless of how it initiates. I think it is equally easy to imagine that she made it up (and pressured co-workers to lie?) to falsely claim harvard credentials with a good out as it is to imagine that a political organization wanted to discredit a journalist and get her to resign, probably expecting her to go quietly. Since politicians are being given special access to advanced phishing, I think it is prudent to treat the story as real. How can this not raise demand for similar attacks using software from the US/Israeli/Italian/etc firms that specialize in state sponsored crime?
- ghaff 6y ago
  >Timed with the pandemic, it could have been hard not to fall for. It didn't start there though. The offer letter supposedly came in January 2020 when things were perfectly normal in the vast majority of the world; I was traveling around Europe without a thought of pandemics at that time. It seems a little weird that there would be a job offer after just a 90 minute phone interview. And moving halfway around the world seems a pretty big deal and one would think someone in that situation would be looking for a bit more motion on the logistics. On the other hand, we're talking Harvard Extension School and she's in India so maybe not a complete red flag especially given she had some apparent prior contact with the school. But certainly the pandemic allowed them to string things out for whatever reason. It does seem as if there are different stories floating around though.
MaxBarraclough 6y ago
It sounds like the scammers did a lot of work, succeeded in their deception, but still didn't end up turning a profit. What was their plan here?
- lagolinguini 6y ago
  Nidhi Razdan gets a lot of hate, particularly from the right in India.
- z3t4 6y ago
  I was probably a really bad joke by someone who did not like her. I can't see how you could get any financial gain from it. Scammers are usually slick, but very lazy.
- mlang23 6y ago
  The one thing the attacker definitely achieved was to reveal that a particular journalist is not very good at an essential part of their job, fact checking.
  - mafuy 6y ago
    You may be interested in this: https://www.youtube.com/watch?v=vJG698U2Mvo https://www.youtube.com/watch?v=vJG698U2Mvo
    - mlang23 6y ago
      How is this related to a job offer from a department that doesn't exist at all? And no, it wasn't particularily interesting since I am incapable of falling for optical illusions.
      - mafuy 6y ago
        I'm confused. I don't know why you're incapable of falling for optical illusions, but that video did not have one. It explained the concept of attention blindness. If you look for something else, then you may miss the gorilla in the room, even though it is as obvious as can be. Same goes for job offers. You're primarily looking to get the great job, and involuntarily and unknowingly enter a kind of tunnel vision.
vinni2 6y ago
I once got an email from our dean that he needed to see me urgently in his office. I first believed this was true but then this was very unusual to the dean who never communicated with me before to urgently needing me in his office. Once I double checked I realized it was a scam and many of my colleagues also got the same email. I immediately alerted the dean to warn everyone.
- MeinBlutIstBlau 6y ago
  I figure if it's actually important, they'd personally meet me or call. You don't respond over email hoping an instant response. It's obvious from the start of the email.
  - ghaff 6y ago
    Maybe they have your email but not your mobile number? Or they want a written record of when and how they contacted you?
    - MeinBlutIstBlau 6y ago
      Depending on what rung you're on in the corporate ladder, if the head of the institution "needed me" immediately, I'm extraordinarily skeptical they do not have a means of contacting me directly. Especially if they have assistants and other immediate VP's. Hell a corporate directory to look up my number... If a CEO is gonna want me fired because I'm being skeptical of the veracity of an email, I wouldn't want to work at such a place.
      - ghaff 6y ago
        I guess it depends on the nature of the request. I got an email from our CEO a few weeks ago asking for my number to talk about something and I work for a 10K+ person company. (I also know him pretty well and I was pretty sure what this was in reference to.) A lot of execs don't have a problem with reaching out to people directly. Now, if he sent me an email asking me to go to some sketchy website or complete some financial transaction for him that would be something else.
setum 6y ago
this was all over Twitter in India yesterday when she first tweeted about it. People where making fun of her and NDTV (her previous employer) which I thought was somewhat deserved considering they (she and her NDTV colleagues) pretend to be righteous, above all others, calling others with names like ‘Fake Media’, graduate of WhatsApp University, etc. They claim themselves to be true journalists and guardians of truth. This must be a reality check and sobering moment. (fun-fact: NDTV also runs a program named ‘Reality Check’) edit: grammatical
- lagolinguini 6y ago
  They are certainly biased to the left. But they are definitely better than any of the alternatives in India... Have your seen what kind of garbage is reported by Indian news channels? There was the entire bullshit non issue about Rhea Chakroborty and the SSR suicide that was extremely disappointing to watch. And you can in no way defend the kind of nonsense that is spread on WhatsApp groups in India.
  - setum 6y ago
    You are all correct, It still doesn’t justify self certifying as righteous. One’s greatness is for others to evaluate, not they themselves.
    - mav3rick 6y ago
      You perceive them as righteous. They have never said it themselves.
- mav3rick 6y ago
  I don't get it ? So they call out other media channels. So their journalists deserve shit ? Twitter is filled with BJP IT Cell bots and miscreants. I wouldn't expect less. Can you say with a straight face that Republic TV is not biased ? Or India TV ?
  - LordAtlas 6y ago
abhishekjha 6y ago
Surpringly similar to the story a senior Journalist at NYT got scammed by a guy pretending to be a terrorist : https://www.npr.org/2020/12/18/944594193/new-york-times-retracts-hit-podcast-series-caliphate-on-isis-executioner https://www.npr.org/2020/12/18/944594193/new-york-times-retr... What a roller coaster of emotion that Podcast was!
LordAtlas 6y ago
While it's clear that this was a sophisticated and personally-targeted scam, I feel the blog post would have been more useful with information about which Harvard email addresses were used to communicate with her, and perhaps some screenshots. Were they actual harvard.edu email addresses, which means somebody had access to an official address for replying to mails from her? (That makes the scam deeper and involves US authorities.) Or was it something like harvardhr@gmail.com? Which means she should not have fallen for it. I just saw this tweet from someone senior at her former employer about how she uploaded a reference letter to an official-looking site but again, no screenshot or URL referenced. https://twitter.com/soniandtv/status/1350415332599480324 https://twitter.com/soniandtv/status/1350415332599480324
- deleted 6y ago
  [deleted]
- orange_tee 6y ago
  Email addresses can be spoofed. https://en.wikipedia.org/wiki/Email_spoofing https://en.wikipedia.org/wiki/Email_spoofing
  - LordAtlas 6y ago
    Well, of course, SMTP headers are trivial to spoof, but for this scam to work, the scammer would need actual POP/IMAP access to the harvard.edu account to receive her replies and respond to those, which is not as trivial.
  - noname120 6y ago
    No. [1][2][3] [1] https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework [2] https://en.wikipedia.org/wiki/DMARC https://en.wikipedia.org/wiki/DMARC [3] https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
    - lkurtz 6y ago
      Only if they’re used. There are no DMARC records in place for harvard.edu or subdomains, which is kinda shocking.
nullc 6y ago
What the heck is going on with the victim blaming -- both here and by Harvard staff on twitter? It's gross. I'm sure this was an opportunity of a life time-- not enough of one to come off as totally implausible, but enough to paper over some of the red flags. Most scams are obvious in hindsight and from an external view. Believing that you couldn't fall for a scam is probably one of the best ways to increase your vulnerability.
- ghaff 6y ago
  I agree. There are good reasons to be skeptical of the story at this point. But if, for purposes of argument, one ignores other claims and goes by the original post only, it falls into the category of vaguely plausible. Vaguely to be sure. But not quite so vaguely that I'm going to say that no experienced journalist could ever fall for it. (Although, the more I think about it, the harder it is for me to believe that she wouldn't have made one phone call or sent one email to the dean or whoever to ask "Hey, I seem to be being given the runaround" before quitting her job. Journalists aren't known for being shy about picking up the phone.)
- lern_too_spel 6y ago
  Indian journalists are notoriously gullible. Stories about them being tricked are a dime a dozen. http://www.gelfmagazine.com/archives/nasas_prodigy_takes_india_for_a_ride.php http://www.gelfmagazine.com/archives/nasas_prodigy_takes_ind...
LordAtlas 6y ago
Thread by a US-based tenured professor on how hiring works in academia: https://twitter.com/gauravsabnis/status/1350414118986121216 https://twitter.com/gauravsabnis/status/1350414118986121216
screye 6y ago
I do not have much sympathy for her, given my low opinion of English-speaking Indian Media and their faux-elite mannerisms. Certainly some level of Schadenfreude. But, I won't go into that here. This seems more like a targeted public embarrassment operation than an attempt at identity theft. Objectively, Nidhi made a ton of elementary mistakes that would be inexcusable for a journalist. This includes non-technological mistakes such as not contacting the Dean or prospective collaborators who presumably voted to have her on the faculty. There is an immense amount of hubris on display as well. That being said, the scammers were incredibly sophisticated and committed to the ruse. Either ways, this sets a bad precedent. The internet allows for sophisticated scams like never seen before. A public embarrassment in the world of twitter can easily end careers. I hope she finds some quiet in the midst of this public show where she has been made an unwilling jester. She should have handled this in private. Now that it is out on Twitter, trolls will make sure she never forgets what I presume has been incredibly traumatic.
- alisonkisk 6y ago
  She made it public because she had been doing PR telling people she was a Harvard professor. This "phishing" is suspected to be a cover up for her own fraud getting caught.
  - randycupertino 6y ago
    Is there a source on this?
  - silentguy 6y ago
    This is pure speculation. Why would she think she could pretend to be Harvard professor and not found out?
    - screye 6y ago
      Much more blatant lies have been told in India, so I would not be surprised in the least. Indian English Journalism is a farce. They are exceptions, but it is an exception proves the rule sort of thing (Old Indian Express, The Print, Caravan)
lkurtz 6y ago
Wow, very surprised to see no DMARC records in place for harvard.edu or their various subdomains. It may be possible that a single DNS record could have prevented this whole madness.
- londons_explore 6y ago
  A single DNS record and distributing the signing key to probably thousands of machines able to send mail, some of which are probably 30 years old and unable to do the dmarc crypto...
JackFr 6y ago
You get the feeling that this was not phishing scam with the ultimate goal of financial crime. This (to me) smells more like a specific, personal attack on this woman with the intent to humiliate and embarrass her professionally.
- jerome-jh 6y ago
  Definitely. Looks like the goal was to make her leave her position at NDTV.
- kshacker 6y ago
  I did not want to speculate, but when I think of someone wanting to humiliate and embarrass, the first name that came to mind was "IT cell". But one of my friends said, the "IT cell" usually sends rape threats, they are not so sophisticated. You either know about the "IT cell" or please google it ... all the links on it are non-authoritative.
- lagolinguini 6y ago
  > personal attack on this woman with the intent to humiliate and embarrass her professionally. This is exactly what it feels like to me.
- netsharc 6y ago
  Yeah, who would spend the 90 minutes doing a fake interview for a random phishing victim. Even one with questions that are convincing enough to her. Assuming the scammers are Indian, and the victim would be expecting some Americans interviewing her, I wonder how they scammers got some Americans to join in the scam. Hire some American actors and tell them it's for a prank TV show maybe?
  - meowster 6y ago
    They could have scammed someone else who was also looking for a job: "We want to hire you for an HR job, please show us your skills by practicing with this woman."
dissidents 6y ago
This is ridiculous. This journalist doesn't even have a PhD or any publications. To those who are downvoting this because of the misleading comment below, note that she claimed on Twitter to be joining the Harvard Faculty of Arts and Sciences, not the Harvard Extension School. Nobody becomes an Associate Professor at the Harvard FAS without a PhD. Source: https://twitter.com/Nidhi/status/1271705895437651968 https://twitter.com/Nidhi/status/1271705895437651968
- ghaff 6y ago
  This was Harvard Extension School. You're not talking a tenured Harvard professor position. One of my mentors undergrad was a former Newsweek editor who lectured a couple days a week and also didn't have a PhD or academic publications. (He had written books.)
  - dissidents 6y ago
    This is just misleading. Razdan claimed on Twitter that she was joining the Harvard Faculty of Arts, not the Harvard Extension School. Harvard FAS does not have any journalism professors or offer degrees in journalism, and if it did, you would certainly need a PhD.
    - ghaff 6y ago
      All I know is what she wrote in the post: "Contrary to what many are tweeting, Harvard has a school called the Extension School offering a Journalism Degree Programme. The actual programme is called the Master of Liberal Arts, Journalism degree. The Extension School lists 500 faculty of whom 17 are categorised as journalism faculty. A number of these people are working journalists. I believed I fit this profile." ADDED: It certainly seems as if the story has changed from something implausible to something vaguely understandable.
      - LordAtlas 6y ago
        I believe GP is referring to her original announcement here: https://twitter.com/Nidhi/status/1271705895437651968 https://twitter.com/Nidhi/status/1271705895437651968
3327 6y ago
TLDR: i was a suckered into quoting my job and as a journalist failed at the one job i am supposed to be good at- Getting the truth in a story. I quit my job, look like an idiot so I write this click bait piece to grab attention.
Cyclone_ 6y ago
It would be more helpful if she uploaded screenshots of the emails, including the sending address, and pictures of the letterhead. Assuming she's telling the truth about everything this would be by far the most elaborate phishing attack I've ever seen.
- patja 6y ago
  She is remarkably circumspect about these details. Lots of references to people being allegedly from Harvard or appearing to be from Harvard. It does feel disingenuous to put that out there and not provide a single example.
namanaggarwal 6y ago
If this is all true, This was a very personal attack. This doesn't seem to be for financial gains but personal vendetta. Putting that aside, she should be equally blamed for falling for it despite being a fact checker for 21 years and also attending seminars, advisory meetings, talks and interviews as "Harvard Professor" without even going to a lecture hall once.
- alisonkisk 6y ago
  No lecture halls in covid, but virtual lectures.
Cyclone_ 6y ago
She mentioned she was interviewed online. Was it a video interview or someone IMing questions? A non video interview would have been a red flag to me.
rileytg 6y ago
Unless harvard’s email severs were breached, this seems like a case of user error... Harvard.edu has SPF headers which should be enough to detect fake emails right away. If i’m not mistaken you’d have a really tough time spoofing those emails.
wtmt 6y ago
Regardless of which side of the political spectrum one is or what qualifications one has or what terrible deeds one has done (or alleged to have done), the fact is that phishing attacks aren’t very easy to avoid (you’d be fooling yourself if you believe you’d never fall for one). You can ace all the phishing email tests your company routinely sends you and still fall for a more sophisticated attack or fall for something that in retrospect seems stupid because you were preoccupied or stressed or had other serious things going on in life. Victim blaming and questioning how she could believe that she’s qualified for some position is the wrong thing to talk about, and is also disgusting in certain ways. What would be better, at least in a tech focused community, is to find out more details on how this happened and where the gaps (that are obvious in hindsight) are. I wish someone like Brian Krebs (of Krebs on Security) could get more information on this and do a detailed write up. That would be more insightful and useful to everyone than rants about the victim.
- ghaff 6y ago
  Thank you for posting that. There are obviously way too many people here (and elsewhere) who think they're way too smart to fall for phishing and other forms of scams unlike "stupid" grandmas, journalists, etc. The reality is that we all do things when we're distracted and not really paying attention. Or we get caught up in the excitement of something and we don't stand back and ask ourselves whether it really makes sense. And anyone who thinks otherwise is just arrogant and misguided.
  - dissidents 6y ago
    It may well be true that phishing scams can be easy to fall for, but it is not relevant to this story. Razdan tweeted that she was joining the Harvard's Faculty of Arts & Sciences as an Associate Professor. Regardless of how convincing the phishing attempt was, this is incredibly naive; Razdan does not have a PhD or any publications and Harvard's FAS does not have any professors in journalism. Edit: https://twitter.com/ruchirsharma_1/status/1350067266289856512 https://twitter.com/ruchirsharma_1/status/135006726628985651... It seems that this may not even have been a phishing attempt.
oefrha 6y ago
This episode makes me wonder: how many times an anonymous source “verified” by a journalist is just someone pretending to use an organization’s official email address.
- boomboomsubban 6y ago
  This is why journalists generally try to confirm information before publishing. I wouldn't say it never happens, but there is supposed to be some amount of verifying that wouldn't have been done on a personal job offer.
jccalhoun 6y ago
If this is legit, this is an insane amount of work to get someone's money. I add "if this is legit" because it does seem so unbelievable that someone would fake a 90 minute interview with someone. This leads me to believe it was personal because a scammer could have scammed a lot of other people in the amount of time and energy they put into scamming this one person.
- nullc 6y ago
  People make prank phone calls that require a lot more work than a 90 minute phone interview.
itg 6y ago
According the the founder of Nieman Lab at Harvard, Harvard has no school of journalism, no department of journalism, and no professors of journalism. See: https://twitter.com/jbenton/status/1350059632782356481 https://twitter.com/jbenton/status/1350059632782356481 I find it hard to believe a journalist with 21 years of experience wasn't aware of this. When someone reaches out to me regarding a new job opportunity, I always do some basic research.
- deleted 6y ago
  [deleted]
- aeoleonn 6y ago
  I agree. I also wonder what degree of ego played into this. Who does Harvard contact out of the blue? If they contacted me out of the blue by email my first thought would be "Why would they contact me-- who am I? What have I accomplished that I would be on the radar that people are talking about me at Harvard to the point where I am invited to interview?" To me, that would be phishy-- Unless I was some award winning, well-published, and/or well-credentialed journalist. - Looking on Amazon, I see 1 book by this author: "Left, Right and Centre: The Idea of India". I also see a blank LinkedIn page, which mentions she lives in India. - On Wikipedia, I see she has " done documentaries from Pakistan-administered Kashmir, Tibet and the United Kingdom after the train bombings." and "has been the diplomatic correspondent of NDTV 24x7, which is an English language television channel that carries news and current affairs in India, owned by New Delhi Television Ltd network.": https://en.wikipedia.org/wiki/Nidhi_Razdan https://en.wikipedia.org/wiki/Nidhi_Razdan Those aren't trivial accomplishments. But I don't know that they represent the pinnacle of journalistic achievement to the degree that Harvard would reach out, out of the blue.
  - kshacker 6y ago
    Sometimes it is connectedness. See https://www.youtube.com/watch?v=SzCcVGbO9rw https://www.youtube.com/watch?v=SzCcVGbO9rw - Interview with Raghuram Rajan, who was the Governor of Reserve bank of India, was chief economist of IMF, and now a professor in US https://www.youtube.com/watch?v=p1qS4gdutso https://www.youtube.com/watch?v=p1qS4gdutso - Interview with a maverick political consultant, kinda like Frank Luntz of India https://www.youtube.com/watch?v=n6lolKKm2LU https://www.youtube.com/watch?v=n6lolKKm2LU - Interview with Saudia Arabia foreign minister I am sure I can find more examples, but the point is that during a 21 year career, of which a few years as a prime time host, you build a lot of network, you get a lot of local awards, that when a US school comes fawning, it may be a small surprise, but you take it in the stride.
tinyhouse 6y ago
One suggestion to people is to not follow any links in emails and looking up things instead. For example, if you get an email to sign up for something, try to find that page yourself by googling it. If you get an email from someone at Harvard, try to find that person on the Harvard website to verify the email and everything else. But again, don't do it by following links in the email. Google/Bing/DDG is your friend.
aeoleonn 6y ago
TLDR: *It's not very useful to have an interpretation by a person who mis-interpreted a situation, without concrete real-world examples of what they actually interpreted: screenshots of conversations & email addresses/other contact info (at least domains such as @something.edu) , so I can at least say "Yeah, this was obviously phishing" or "wow, this phisher was really incognito".* I'm interested in seeing the email address domain of the person who phished this author. And other specific details about the conversation-- such as screenshots and other evidence. - "what appeared to be an official Harvard email ID" Did the phisher have a @harvard.edu sort of email address or not? I don't care about "what appeared to be" (i.e. insinuating the author interpreted the account to be official.) I want to know what the actual domain of the email address was -- not that in the author's opinion it seemed to not be fake. - I know some professors have their own websites & use their own custom domains-- still, I'd see this as phishy unless it specifically came from a @harvard.edu account. And even then, the phisher could still have somehow accessed an available account. But, then I'd simply try to find their faculty page. Also, I would expect other people or gorup-email-accounts in HR to be CCed on the emails, not just some individual contacting me. To be honest, I am surprised this author does not provide concrete details. She tells how things happened, and what steps she took. But provides no screenshots of her conversations, no specific details about the online personas of the phisher.
- JeremyNT 6y ago
  There's something about this story that feels... incomplete to me. As the victim here - and as a journalist no less - it's in her own interest to present the attack as being incredibly sophisticated so as not to appear naive for being deceived. In reality, perhaps the attack was not as sophisticated as her narrative suggests. Like you, I'd appreciate some more details.
  - lbblack 6y ago
    Wholeheartedly agreed...
- Debug_Overload 6y ago
  Also, the term "sophisticated" is almost meaningless here, and that's usually the case when talking about these kinds of issues. Pretty straightforward Nigerian prince style scam is now "sophisticated" phishing attack. We already had enough issues in infosec with companies claiming they're all attacked by "APT" and "state-sponsored actor". It just seems an easy way to dodge embarrassment and looking silly. Of course, there are real cases where the person/company may actually be a victim of a sophisticated phishing attack (or APT/state-sponsored attack, etc) but the terms lose their weight when they are being thrown around like this.
sulam 6y ago
This exact situation occurred a couple years ago to some people in the US. I don’t know their names, and I didn’t investigate the situation internally, so I don’t know just how smart the phishers were vs their victims. What I do know is that I got a call from the front desk people at our Boston office that said someone is here for their first day of work and we have no record of them being hired. Did I know anything about this? I didn’t. After some investigation it was revealed to be an identity theft scam, and within a week several other people were also found to be a victim of the same scam. Before you judge too harshly, keep in mind that often the people affected by this often aren’t very technical, don’t know what to look for when it comes to phishing, and are just doing what comes naturally in the situation. The scammers in this case are obviously at least somewhat technical and have a huge advantage in terms of being able to scattershot communicate with a very large group of people (potentially millions, although more likely 10’s of thousands in the case I describe). Also, while I’m sure no one reading this has ever been phished (cough), it has been _repeatedly_ found that phishing is effective, even for highly technical audiences. When it comes to recruiting, it is all too plausible that the person you’re interacting with doesn’t work for the company you’re “interviewing” with, and many recruiters start a conversation not even revealing who they recruit for. In fact, there are recruiting agencies that may as well be phishing organizations, because they will claim to have a role simply to get your resume and then, once they have your information, will start shopping it to companies in an attempt to get paid. In short, I have a ton of sympathy for people affected by this, and think the assholes who do this kind of thing are pretty much evil.
bawana 6y ago
so does mean that linked in is now a useful collection of targets?
scarmig 6y ago
Definitely a targeted, very personal attack, as you can scam an order of magnitude more funds by focusing on the masses instead of making fake interviews, offer packets, etc. I'd love more details, because there's not much to learn here. I walk away from the article with no idea about novel defensive strategies people need to take and no idea what we as technologists can do to help prevent this in the future.
neya 6y ago
The last line - "(Nidhi Razdan is former Executive Editor, NDTV.)" That's their classic way of burning her for burning them. Having said that, I learnt the same lesson as well a few years ago. Never quit your current unless you're 101% sure your next job is waiting for you and all the due process is taken care of.
wgriirwghawigi 6y ago
Is it possible she made this all up, for (temporary) media attention? Here she is hijacking an event for aspiring journalists to try and interview Barack Obama, who sees through this and publicly shames her: https://twitter.com/rose_k01/status/1350053978403291138 https://twitter.com/rose_k01/status/1350053978403291138 There are multiple interviews of her talking about her upcoming appointment, her class structures, here (non-existent) syllabus. It seems like another possible interpretation of the events is that she made this all up, then blamed it all on a vague "phishing attack" to defuse any responsibility. In the months prior, her career received a boost from all the media attention. Now, she also has some level of additional fame, that while not exactly positive, could help her launch into the next phase of her aspirations
mensetmanusman 6y ago
A few weeks ago I was in the next room washing dishes overhearing my dad say he just got an alert of missing funds from his bank account. I asked him about it 10 minutes later and was shocked he had submitted all his account information from a text alert. “You do realize you just gave all your account information to a scammer in a phishing attack I hope.” Thankfully he was able to change account information within minutes and no funds were lost. Moral: check in with your parents, people around the world are trying to scam them weekly.
mensetmanusman 6y ago
Imagine a future where an army of GTP-4 agents await mere mortals in cyberspace. If they are all programmed to extract funds through conversation, how will we prevent this?
pimlottc 6y ago
One thing I haven't seen mentioned is that there is a name for these kinds of advanced phishing attempts, which is "spear-phishing". Normal phishing is broadly targeted and fairly generic - "You just won a cruise", online parking ticket due, etc. It's usually easy to spot once you're aware of it. Spear-phishing, in contrast, targets a specific audience with a message that includes specific details that make it more convincing - your boss's name, company, job title, bank account number, mortgage loan start date, health provider name, etc. The more specific, the better. These can be very hard to detect. If I've just been to the doctor, I'm expecting to get an email about a hospital bill, and I'm pretty confident that the hospital's online payment site will look like it hasn't been updated from the 90s. TBH, half the time I'm paying a medical bill online, I'm crossing my fingers that it's actually going to the right place...
alisausaaaaaa 6y ago
Wanna have hot-lovin' conversations? You’re on the right way! - https://adultlove.life https://adultlove.life
garyfirestorm 6y ago
‘many emails were exchanged between me and these alleged Harvard email IDs where they sought my personal information for a "work visa".‘ ‘I had been told a work visa had been issued in the US for me which would be sent to me only when travel was required.‘ I think this should have been a major red flag. Work visas are not issued like that. I don’t understand why you wouldn’t interact with an embassy for visa issuance.
litefoot 6y ago
Hmmm...I guess I am one of those folks who practices trust but verify through independent sources and would have pick up the phone and called the Harvard HR Department using a known good number vice only relying on and communicating on email. Second, some posters have said that you can pass company phishing training and be still be victimized by this cyber criminals...true to some degree; however, a cursory check of the smtp email header and or embedded http links would probably have provided clear indication that something was amiss. But I agree victim blaming is not and will not ever be appropriate.
zxienin 6y ago
It is surprising me that this is international news. There are panel discussions running. And now post on HN? Anything unique about this that explains the blast radius of this news?

214 points by LordAtlas 6y ago

Can’t believe how confident must be. Harvard headhunted her without even applying for the job? She must be so cocky to fall for it.

feral 6y ago
That is a bad sort of victim blaming. I hope you wouldn't apply that logic to victims of other non-online crimes. Anyway, separately, she addresses that in her article, convincingly I thought. Plus she's brave and helping others to write about this (which victim blaming doesn't encourage).
- namanaggarwal 6y ago
  My only point is that she is a journalist working for a reputable news agency for 21 years. Her job was to fact check everything. This means that a lot of things she told in the media before should be taken with a pinch of salt.
  - minot 6y ago
    Not just her. All of journalism. http://www.paulgraham.com/submarine.html http://www.paulgraham.com/submarine.html
- vinni2 6y ago
  I would expect my aunt who thinks everything on WhatsApp is true to fall for it. She is a professional journalist with lots of experience as a fact checker. I am sorry she fell for it but someone with her education level and awareness I expected more.
cowpig 6y ago
What a strange reaction to this story.
- hfkldjsjfkdj 6y ago
  Can't anyone say anything negative even if it makes sense?
  - ryder9 6y ago
    ah yes the "my opinion is immune to criticism" response
nip180 6y ago
I had a similar thought: I would be more and more suspicious the longer I didn’t get an email from an @harvard.edu email.
- FreakyT 6y ago
  The article states that all the emails appeared to be from official Harvard email addresses. At some universities, it’s possible to create email aliases at your .edu domain, so it’s possible that the scammer had access to one or more convincing email addresses.
  - nip180 6y ago
    That greatly increases the level of sophistication. The article doesn’t say that the emails received were “@harvard.edu” only that they appeared to be valid Harvard ids. That means she made a judgement call that the email were legitimate, but it doesn’t give very many technical details on what she judged that call on.
    - InitialLastName 6y ago
      This makes me assume that the bits she's most embarrassed about (a fact-checker should be able to find out what the valid Harvard email domains are) are the one she glossed over.
      - nip180 6y ago
        I don’t think this article was written for a technical audience so it’s not surprising that it’s light on technical details.
bob33212 6y ago
Most phishing scams required the target to have an emotional reaction that clouds their judgement. For example, if you get an email saying that your credit card was charged in another state, if you are worried about your finances you may panic and click on the button to login and deny the charges.
rm445 6y ago
> I was invited to speak at an event (...) One of the apparent organisers of this event contacted me separately to say there was a vacancy for a teaching position and would I be interested (...) I submitted my CV (...) A few weeks later I was "interviewed" This sounds exactly like the kind of job opportunity that's meant to come about by networking, getting your name out there, public speaking and so on. We are often told that this is how the best jobs are found.
- ghaff 6y ago
  Yes, up to that point it all seems very plausible whatever the victim-blamers on this thread think. Down the road, should alarm bells have started going off? Probably. But especially in the context of COVID-19, it's not hard to imagine those bells being suppressed in the excitement of a new opportunity etc.

cowpig 6y ago

This scam sounds frighteningly sophisticated. I really feel bad for people who get caught up in things like this. To get strung along for over a year, throwing away that much time and energy, must feel devastating.

runawaybottle 6y ago
It’s not sophisticated, it preys on very vulnerable and sheltered people. Like, you have to know Harvard is not going to just call you up one day and decide to fly you over to America lol. Really a problem with delusions amongst many of us.
- ceejayoz 6y ago
  You really should consider reading the article.
  - runawaybottle 6y ago
    I did.

unanswered 6y ago

Whenever I'm changing jobs, I spend at least half my time worried sick that I'm being scammed somehow. Until now, the "rational" part of my mind thought this was very silly, but I think this goes to show that it's a legitimate concern. The fact of the matter is that when joining a new institution one lacks the contacts and the context to discern normal institutional behavior because it so often deviates from (seemingly) ordinary, sane human behavior even when nothing is wrong. Having autism, no part of my mind is naturally attempting to cover up this discrepancy: it remains jarring until I manage to "manually" reset expectations.

djrogers 6y ago
> The fact of the matter is that when joining a new institution one lacks the contacts and the context to discern normal institutional behavior That was the case for me at a couple of very early jobs in my career, but hasn’t been the case for the last couple of decades. New jobs come by way of old colleagues, friends, etc. in such a way that I’m basically never walking in to a completely unknown situation. If you’re not great at relationship maintenance, use something like LinkedIn. Reach out to former coworkers who you worked well with or got along with, and ask about jobs. Odds are very high that they’d like to work with you again, and will get a referral bonus if it happens!
- ghaff 6y ago
  I've gotten out of the blue recruitment calls, but after my first job via on campus recruitment out of grad school, every job (just a few of them) have been directly through people I knew. Except for essentially pro-forma reasons, I've probably never really needed a resume.
lagolinguini 6y ago
It's been particularly hard interviewing during the pandemic. In usual times, at least you would visit the office and meet some real people in person. Not saying you can't get scammed in person, but it's definitely harder to impersonate reasonably large organisations like that.

crowf 6y ago

> In January 2020, I got an email from an alleged Harvard Human Resources person from what appeared to be an official Harvard email ID, it would have been interesting if she would have shared exactly what that email address was. Was it hr@harvard.com or maybe hr@harverd.com? I doubt that it was hr@<something>.edu since it is hard to register .edu domains. But if someone did, that would be news to me.

alisonkisk 6y ago
A clever person could hijack an alumni email account username@post.harvard.edu Note the bad pun Harvard uses: "post" Or you could get an address (deceptively or via hijack) on an subdomain run by a student group.
- ghaff 6y ago
  Yeah. The alumni emails probably follow a pattern. Get a list of alumni and find one who hadn't set up an email forwarding address previously and set up an account.
- pge 6y ago
  You can’t send from a post.harvard.edu email address - it is just a forwarding address for receiving mail.
notahacker 6y ago
A url containing 'harvard' and redirecting to an actual faculty website is going to convince most people if the communications are plausible. Many large organizations use multiple url forms for emails, especially for quasi-separate divisions like business schools or extension programmes. A particularly sneaky scammer without access to Harvard mailboxes might register a plausible-sounding domain with an .ac TLD (which resembles the .ac reserved for universities in many national domain systems including the author's, but is actually a freely purchasable domain supposedly associated with Ascension Island)
netsharc 6y ago
Maybe something like @harvard-school-of-journalism.com, although that's too wordy. The article mentions "Harvard Extension School", so, it could be some variation of that. Edit: I tried harvard-extension.school in the browser, it redirected me to http:harvard-education.edu (not https!), which seems to be a clone of extension.harvard.edu . The WHOIS records of harvard-extension.school/.education are pretty new (registered last year), and they're registered on GoDaddy and 1API GmbH respectively. A Germany-based registrar? Would Harvard use them?

nip180 6y ago

How do we establish trust in a virtual world? There are a lot of cues in an meatspace social interaction that can trigger a “gut reaction” one way or another on trust. In digital interactions it’s significantly easier to be social engineered.

lagolinguini 6y ago
Everybody gets a public key certificate, possibly since birth. There needs to be some way of establishing that which keys belong to which person, perhaps via some government registry, and a way to invalidate old/compromised keys. Overkill?
- Aerroon 6y ago
  Kind of like ID cards in Estonia? You have a chip on the card that holds your private key and the government has a list of people and their public keys. Services and other people can check that. You can even sign and encrypt documents with it.
  - netsharc 6y ago
    China's ID cards also have chips, and they have to scan them to enter train stations or airports (or the center of the old town in Tibet)...

pomian 6y ago

That's an intense level of con. Timed with the pandemic, it could have been hard not to fall for. I hope there is a follow up on who pulled it off. Did the perpetrators know the victim, did they send more of these "letters"? The con seemed pretty specific for a certain target. A lot of work to pull off. Also wonder if, and hope, Nidhi got her old job back. With a great story.

scotty79 6y ago
It seems more specific to Harvard. I wonder if the documents she was given by scammers were just believable or accurate. If they mirrored actual Harvard recruitment process then it's possible that whoever did this wokred or applied there. Or maybe it wasn't about the money? Maybe she was targetted specifically for her previous roles and knowledge? Attack was very sophisticated.
- alisonkisk 6y ago
  There is no "Harvard recruitment process" for adjunct lecturers at the Extension school. People beat down Harvard's door for jobs. Story is very fishy.
  - foolmeonce 6y ago
    I wouldn't find it suspicious if some professors preferably refer people who speak on the campus over the database of spontaneous CVs, and there is a process regardless of how it initiates. I think it is equally easy to imagine that she made it up (and pressured co-workers to lie?) to falsely claim harvard credentials with a good out as it is to imagine that a political organization wanted to discredit a journalist and get her to resign, probably expecting her to go quietly. Since politicians are being given special access to advanced phishing, I think it is prudent to treat the story as real. How can this not raise demand for similar attacks using software from the US/Israeli/Italian/etc firms that specialize in state sponsored crime?
ghaff 6y ago
>Timed with the pandemic, it could have been hard not to fall for. It didn't start there though. The offer letter supposedly came in January 2020 when things were perfectly normal in the vast majority of the world; I was traveling around Europe without a thought of pandemics at that time. It seems a little weird that there would be a job offer after just a 90 minute phone interview. And moving halfway around the world seems a pretty big deal and one would think someone in that situation would be looking for a bit more motion on the logistics. On the other hand, we're talking Harvard Extension School and she's in India so maybe not a complete red flag especially given she had some apparent prior contact with the school. But certainly the pandemic allowed them to string things out for whatever reason. It does seem as if there are different stories floating around though.

MaxBarraclough 6y ago

It sounds like the scammers did a lot of work, succeeded in their deception, but still didn't end up turning a profit. What was their plan here?

lagolinguini 6y ago
Nidhi Razdan gets a lot of hate, particularly from the right in India.
z3t4 6y ago
I was probably a really bad joke by someone who did not like her. I can't see how you could get any financial gain from it. Scammers are usually slick, but very lazy.
mlang23 6y ago
The one thing the attacker definitely achieved was to reveal that a particular journalist is not very good at an essential part of their job, fact checking.
- mafuy 6y ago
  You may be interested in this: https://www.youtube.com/watch?v=vJG698U2Mvo https://www.youtube.com/watch?v=vJG698U2Mvo
  - mlang23 6y ago
    How is this related to a job offer from a department that doesn't exist at all? And no, it wasn't particularily interesting since I am incapable of falling for optical illusions.
    - mafuy 6y ago
      I'm confused. I don't know why you're incapable of falling for optical illusions, but that video did not have one. It explained the concept of attention blindness. If you look for something else, then you may miss the gorilla in the room, even though it is as obvious as can be. Same goes for job offers. You're primarily looking to get the great job, and involuntarily and unknowingly enter a kind of tunnel vision.

vinni2 6y ago

I once got an email from our dean that he needed to see me urgently in his office. I first believed this was true but then this was very unusual to the dean who never communicated with me before to urgently needing me in his office. Once I double checked I realized it was a scam and many of my colleagues also got the same email. I immediately alerted the dean to warn everyone.

MeinBlutIstBlau 6y ago
I figure if it's actually important, they'd personally meet me or call. You don't respond over email hoping an instant response. It's obvious from the start of the email.
- ghaff 6y ago
  Maybe they have your email but not your mobile number? Or they want a written record of when and how they contacted you?
  - MeinBlutIstBlau 6y ago
    Depending on what rung you're on in the corporate ladder, if the head of the institution "needed me" immediately, I'm extraordinarily skeptical they do not have a means of contacting me directly. Especially if they have assistants and other immediate VP's. Hell a corporate directory to look up my number... If a CEO is gonna want me fired because I'm being skeptical of the veracity of an email, I wouldn't want to work at such a place.
    - ghaff 6y ago
      I guess it depends on the nature of the request. I got an email from our CEO a few weeks ago asking for my number to talk about something and I work for a 10K+ person company. (I also know him pretty well and I was pretty sure what this was in reference to.) A lot of execs don't have a problem with reaching out to people directly. Now, if he sent me an email asking me to go to some sketchy website or complete some financial transaction for him that would be something else.

setum 6y ago

this was all over Twitter in India yesterday when she first tweeted about it. People where making fun of her and NDTV (her previous employer) which I thought was somewhat deserved considering they (she and her NDTV colleagues) pretend to be righteous, above all others, calling others with names like ‘Fake Media’, graduate of WhatsApp University, etc. They claim themselves to be true journalists and guardians of truth. This must be a reality check and sobering moment. (fun-fact: NDTV also runs a program named ‘Reality Check’) edit: grammatical

lagolinguini 6y ago
They are certainly biased to the left. But they are definitely better than any of the alternatives in India... Have your seen what kind of garbage is reported by Indian news channels? There was the entire bullshit non issue about Rhea Chakroborty and the SSR suicide that was extremely disappointing to watch. And you can in no way defend the kind of nonsense that is spread on WhatsApp groups in India.
- setum 6y ago
  You are all correct, It still doesn’t justify self certifying as righteous. One’s greatness is for others to evaluate, not they themselves.
  - mav3rick 6y ago
    You perceive them as righteous. They have never said it themselves.
mav3rick 6y ago
I don't get it ? So they call out other media channels. So their journalists deserve shit ? Twitter is filled with BJP IT Cell bots and miscreants. I wouldn't expect less. Can you say with a straight face that Republic TV is not biased ? Or India TV ?
- LordAtlas 6y ago

abhishekjha 6y ago

Surpringly similar to the story a senior Journalist at NYT got scammed by a guy pretending to be a terrorist : https://www.npr.org/2020/12/18/944594193/new-york-times-retracts-hit-podcast-series-caliphate-on-isis-executioner https://www.npr.org/2020/12/18/944594193/new-york-times-retr... What a roller coaster of emotion that Podcast was!

LordAtlas 6y ago

While it's clear that this was a sophisticated and personally-targeted scam, I feel the blog post would have been more useful with information about which Harvard email addresses were used to communicate with her, and perhaps some screenshots. Were they actual harvard.edu email addresses, which means somebody had access to an official address for replying to mails from her? (That makes the scam deeper and involves US authorities.) Or was it something like harvardhr@gmail.com? Which means she should not have fallen for it. I just saw this tweet from someone senior at her former employer about how she uploaded a reference letter to an official-looking site but again, no screenshot or URL referenced. https://twitter.com/soniandtv/status/1350415332599480324 https://twitter.com/soniandtv/status/1350415332599480324

deleted 6y ago
[deleted]
orange_tee 6y ago
Email addresses can be spoofed. https://en.wikipedia.org/wiki/Email_spoofing https://en.wikipedia.org/wiki/Email_spoofing
- LordAtlas 6y ago
  Well, of course, SMTP headers are trivial to spoof, but for this scam to work, the scammer would need actual POP/IMAP access to the harvard.edu account to receive her replies and respond to those, which is not as trivial.
- noname120 6y ago
  No. [1][2][3] [1] https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework [2] https://en.wikipedia.org/wiki/DMARC https://en.wikipedia.org/wiki/DMARC [3] https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
  - lkurtz 6y ago
    Only if they’re used. There are no DMARC records in place for harvard.edu or subdomains, which is kinda shocking.

nullc 6y ago

What the heck is going on with the victim blaming -- both here and by Harvard staff on twitter? It's gross. I'm sure this was an opportunity of a life time-- not enough of one to come off as totally implausible, but enough to paper over some of the red flags. Most scams are obvious in hindsight and from an external view. Believing that you couldn't fall for a scam is probably one of the best ways to increase your vulnerability.

ghaff 6y ago
I agree. There are good reasons to be skeptical of the story at this point. But if, for purposes of argument, one ignores other claims and goes by the original post only, it falls into the category of vaguely plausible. Vaguely to be sure. But not quite so vaguely that I'm going to say that no experienced journalist could ever fall for it. (Although, the more I think about it, the harder it is for me to believe that she wouldn't have made one phone call or sent one email to the dean or whoever to ask "Hey, I seem to be being given the runaround" before quitting her job. Journalists aren't known for being shy about picking up the phone.)
lern_too_spel 6y ago
Indian journalists are notoriously gullible. Stories about them being tricked are a dime a dozen. http://www.gelfmagazine.com/archives/nasas_prodigy_takes_india_for_a_ride.php http://www.gelfmagazine.com/archives/nasas_prodigy_takes_ind...

LordAtlas 6y ago

Thread by a US-based tenured professor on how hiring works in academia: https://twitter.com/gauravsabnis/status/1350414118986121216 https://twitter.com/gauravsabnis/status/1350414118986121216

screye 6y ago

I do not have much sympathy for her, given my low opinion of English-speaking Indian Media and their faux-elite mannerisms. Certainly some level of Schadenfreude. But, I won't go into that here. This seems more like a targeted public embarrassment operation than an attempt at identity theft. Objectively, Nidhi made a ton of elementary mistakes that would be inexcusable for a journalist. This includes non-technological mistakes such as not contacting the Dean or prospective collaborators who presumably voted to have her on the faculty. There is an immense amount of hubris on display as well. That being said, the scammers were incredibly sophisticated and committed to the ruse. Either ways, this sets a bad precedent. The internet allows for sophisticated scams like never seen before. A public embarrassment in the world of twitter can easily end careers. I hope she finds some quiet in the midst of this public show where she has been made an unwilling jester. She should have handled this in private. Now that it is out on Twitter, trolls will make sure she never forgets what I presume has been incredibly traumatic.

alisonkisk 6y ago
She made it public because she had been doing PR telling people she was a Harvard professor. This "phishing" is suspected to be a cover up for her own fraud getting caught.
- randycupertino 6y ago
  Is there a source on this?
- silentguy 6y ago
  This is pure speculation. Why would she think she could pretend to be Harvard professor and not found out?
  - screye 6y ago
    Much more blatant lies have been told in India, so I would not be surprised in the least. Indian English Journalism is a farce. They are exceptions, but it is an exception proves the rule sort of thing (Old Indian Express, The Print, Caravan)

lkurtz 6y ago

Wow, very surprised to see no DMARC records in place for harvard.edu or their various subdomains. It may be possible that a single DNS record could have prevented this whole madness.

londons_explore 6y ago
A single DNS record and distributing the signing key to probably thousands of machines able to send mail, some of which are probably 30 years old and unable to do the dmarc crypto...

JackFr 6y ago

You get the feeling that this was not phishing scam with the ultimate goal of financial crime. This (to me) smells more like a specific, personal attack on this woman with the intent to humiliate and embarrass her professionally.

jerome-jh 6y ago
Definitely. Looks like the goal was to make her leave her position at NDTV.
kshacker 6y ago
I did not want to speculate, but when I think of someone wanting to humiliate and embarrass, the first name that came to mind was "IT cell". But one of my friends said, the "IT cell" usually sends rape threats, they are not so sophisticated. You either know about the "IT cell" or please google it ... all the links on it are non-authoritative.
lagolinguini 6y ago
> personal attack on this woman with the intent to humiliate and embarrass her professionally. This is exactly what it feels like to me.
netsharc 6y ago
Yeah, who would spend the 90 minutes doing a fake interview for a random phishing victim. Even one with questions that are convincing enough to her. Assuming the scammers are Indian, and the victim would be expecting some Americans interviewing her, I wonder how they scammers got some Americans to join in the scam. Hire some American actors and tell them it's for a prank TV show maybe?
- meowster 6y ago
  They could have scammed someone else who was also looking for a job: "We want to hire you for an HR job, please show us your skills by practicing with this woman."

dissidents 6y ago

This is ridiculous. This journalist doesn't even have a PhD or any publications. To those who are downvoting this because of the misleading comment below, note that she claimed on Twitter to be joining the Harvard Faculty of Arts and Sciences, not the Harvard Extension School. Nobody becomes an Associate Professor at the Harvard FAS without a PhD. Source: https://twitter.com/Nidhi/status/1271705895437651968 https://twitter.com/Nidhi/status/1271705895437651968

ghaff 6y ago
This was Harvard Extension School. You're not talking a tenured Harvard professor position. One of my mentors undergrad was a former Newsweek editor who lectured a couple days a week and also didn't have a PhD or academic publications. (He had written books.)
- dissidents 6y ago
  This is just misleading. Razdan claimed on Twitter that she was joining the Harvard Faculty of Arts, not the Harvard Extension School. Harvard FAS does not have any journalism professors or offer degrees in journalism, and if it did, you would certainly need a PhD.
  - ghaff 6y ago
    All I know is what she wrote in the post: "Contrary to what many are tweeting, Harvard has a school called the Extension School offering a Journalism Degree Programme. The actual programme is called the Master of Liberal Arts, Journalism degree. The Extension School lists 500 faculty of whom 17 are categorised as journalism faculty. A number of these people are working journalists. I believed I fit this profile." ADDED: It certainly seems as if the story has changed from something implausible to something vaguely understandable.
    - LordAtlas 6y ago
      I believe GP is referring to her original announcement here: https://twitter.com/Nidhi/status/1271705895437651968 https://twitter.com/Nidhi/status/1271705895437651968

3327 6y ago

TLDR: i was a suckered into quoting my job and as a journalist failed at the one job i am supposed to be good at- Getting the truth in a story. I quit my job, look like an idiot so I write this click bait piece to grab attention.

Cyclone_ 6y ago

It would be more helpful if she uploaded screenshots of the emails, including the sending address, and pictures of the letterhead. Assuming she's telling the truth about everything this would be by far the most elaborate phishing attack I've ever seen.

patja 6y ago
She is remarkably circumspect about these details. Lots of references to people being allegedly from Harvard or appearing to be from Harvard. It does feel disingenuous to put that out there and not provide a single example.

namanaggarwal 6y ago

If this is all true, This was a very personal attack. This doesn't seem to be for financial gains but personal vendetta. Putting that aside, she should be equally blamed for falling for it despite being a fact checker for 21 years and also attending seminars, advisory meetings, talks and interviews as "Harvard Professor" without even going to a lecture hall once.

alisonkisk 6y ago
No lecture halls in covid, but virtual lectures.

Cyclone_ 6y ago

She mentioned she was interviewed online. Was it a video interview or someone IMing questions? A non video interview would have been a red flag to me.

rileytg 6y ago

Unless harvard’s email severs were breached, this seems like a case of user error... Harvard.edu has SPF headers which should be enough to detect fake emails right away. If i’m not mistaken you’d have a really tough time spoofing those emails.

wtmt 6y ago

Regardless of which side of the political spectrum one is or what qualifications one has or what terrible deeds one has done (or alleged to have done), the fact is that phishing attacks aren’t very easy to avoid (you’d be fooling yourself if you believe you’d never fall for one). You can ace all the phishing email tests your company routinely sends you and still fall for a more sophisticated attack or fall for something that in retrospect seems stupid because you were preoccupied or stressed or had other serious things going on in life. Victim blaming and questioning how she could believe that she’s qualified for some position is the wrong thing to talk about, and is also disgusting in certain ways. What would be better, at least in a tech focused community, is to find out more details on how this happened and where the gaps (that are obvious in hindsight) are. I wish someone like Brian Krebs (of Krebs on Security) could get more information on this and do a detailed write up. That would be more insightful and useful to everyone than rants about the victim.

ghaff 6y ago
Thank you for posting that. There are obviously way too many people here (and elsewhere) who think they're way too smart to fall for phishing and other forms of scams unlike "stupid" grandmas, journalists, etc. The reality is that we all do things when we're distracted and not really paying attention. Or we get caught up in the excitement of something and we don't stand back and ask ourselves whether it really makes sense. And anyone who thinks otherwise is just arrogant and misguided.
- dissidents 6y ago
  It may well be true that phishing scams can be easy to fall for, but it is not relevant to this story. Razdan tweeted that she was joining the Harvard's Faculty of Arts & Sciences as an Associate Professor. Regardless of how convincing the phishing attempt was, this is incredibly naive; Razdan does not have a PhD or any publications and Harvard's FAS does not have any professors in journalism. Edit: https://twitter.com/ruchirsharma_1/status/1350067266289856512 https://twitter.com/ruchirsharma_1/status/135006726628985651... It seems that this may not even have been a phishing attempt.

oefrha 6y ago

This episode makes me wonder: how many times an anonymous source “verified” by a journalist is just someone pretending to use an organization’s official email address.

boomboomsubban 6y ago
This is why journalists generally try to confirm information before publishing. I wouldn't say it never happens, but there is supposed to be some amount of verifying that wouldn't have been done on a personal job offer.

jccalhoun 6y ago

If this is legit, this is an insane amount of work to get someone's money. I add "if this is legit" because it does seem so unbelievable that someone would fake a 90 minute interview with someone. This leads me to believe it was personal because a scammer could have scammed a lot of other people in the amount of time and energy they put into scamming this one person.

nullc 6y ago
People make prank phone calls that require a lot more work than a 90 minute phone interview.

itg 6y ago

According the the founder of Nieman Lab at Harvard, Harvard has no school of journalism, no department of journalism, and no professors of journalism. See: https://twitter.com/jbenton/status/1350059632782356481 https://twitter.com/jbenton/status/1350059632782356481 I find it hard to believe a journalist with 21 years of experience wasn't aware of this. When someone reaches out to me regarding a new job opportunity, I always do some basic research.

deleted 6y ago
[deleted]
aeoleonn 6y ago
I agree. I also wonder what degree of ego played into this. Who does Harvard contact out of the blue? If they contacted me out of the blue by email my first thought would be "Why would they contact me-- who am I? What have I accomplished that I would be on the radar that people are talking about me at Harvard to the point where I am invited to interview?" To me, that would be phishy-- Unless I was some award winning, well-published, and/or well-credentialed journalist. - Looking on Amazon, I see 1 book by this author: "Left, Right and Centre: The Idea of India". I also see a blank LinkedIn page, which mentions she lives in India. - On Wikipedia, I see she has " done documentaries from Pakistan-administered Kashmir, Tibet and the United Kingdom after the train bombings." and "has been the diplomatic correspondent of NDTV 24x7, which is an English language television channel that carries news and current affairs in India, owned by New Delhi Television Ltd network.": https://en.wikipedia.org/wiki/Nidhi_Razdan https://en.wikipedia.org/wiki/Nidhi_Razdan Those aren't trivial accomplishments. But I don't know that they represent the pinnacle of journalistic achievement to the degree that Harvard would reach out, out of the blue.
- kshacker 6y ago
  Sometimes it is connectedness. See https://www.youtube.com/watch?v=SzCcVGbO9rw https://www.youtube.com/watch?v=SzCcVGbO9rw - Interview with Raghuram Rajan, who was the Governor of Reserve bank of India, was chief economist of IMF, and now a professor in US https://www.youtube.com/watch?v=p1qS4gdutso https://www.youtube.com/watch?v=p1qS4gdutso - Interview with a maverick political consultant, kinda like Frank Luntz of India https://www.youtube.com/watch?v=n6lolKKm2LU https://www.youtube.com/watch?v=n6lolKKm2LU - Interview with Saudia Arabia foreign minister I am sure I can find more examples, but the point is that during a 21 year career, of which a few years as a prime time host, you build a lot of network, you get a lot of local awards, that when a US school comes fawning, it may be a small surprise, but you take it in the stride.

tinyhouse 6y ago

One suggestion to people is to not follow any links in emails and looking up things instead. For example, if you get an email to sign up for something, try to find that page yourself by googling it. If you get an email from someone at Harvard, try to find that person on the Harvard website to verify the email and everything else. But again, don't do it by following links in the email. Google/Bing/DDG is your friend.

aeoleonn 6y ago

TLDR: *It's not very useful to have an interpretation by a person who mis-interpreted a situation, without concrete real-world examples of what they actually interpreted: screenshots of conversations & email addresses/other contact info (at least domains such as @something.edu) , so I can at least say "Yeah, this was obviously phishing" or "wow, this phisher was really incognito".* I'm interested in seeing the email address domain of the person who phished this author. And other specific details about the conversation-- such as screenshots and other evidence. - "what appeared to be an official Harvard email ID" Did the phisher have a @harvard.edu sort of email address or not? I don't care about "what appeared to be" (i.e. insinuating the author interpreted the account to be official.) I want to know what the actual domain of the email address was -- not that in the author's opinion it seemed to not be fake. - I know some professors have their own websites & use their own custom domains-- still, I'd see this as phishy unless it specifically came from a @harvard.edu account. And even then, the phisher could still have somehow accessed an available account. But, then I'd simply try to find their faculty page. Also, I would expect other people or gorup-email-accounts in HR to be CCed on the emails, not just some individual contacting me. To be honest, I am surprised this author does not provide concrete details. She tells how things happened, and what steps she took. But provides no screenshots of her conversations, no specific details about the online personas of the phisher.

JeremyNT 6y ago
There's something about this story that feels... incomplete to me. As the victim here - and as a journalist no less - it's in her own interest to present the attack as being incredibly sophisticated so as not to appear naive for being deceived. In reality, perhaps the attack was not as sophisticated as her narrative suggests. Like you, I'd appreciate some more details.
- lbblack 6y ago
  Wholeheartedly agreed...
Debug_Overload 6y ago
Also, the term "sophisticated" is almost meaningless here, and that's usually the case when talking about these kinds of issues. Pretty straightforward Nigerian prince style scam is now "sophisticated" phishing attack. We already had enough issues in infosec with companies claiming they're all attacked by "APT" and "state-sponsored actor". It just seems an easy way to dodge embarrassment and looking silly. Of course, there are real cases where the person/company may actually be a victim of a sophisticated phishing attack (or APT/state-sponsored attack, etc) but the terms lose their weight when they are being thrown around like this.

sulam 6y ago

This exact situation occurred a couple years ago to some people in the US. I don’t know their names, and I didn’t investigate the situation internally, so I don’t know just how smart the phishers were vs their victims. What I do know is that I got a call from the front desk people at our Boston office that said someone is here for their first day of work and we have no record of them being hired. Did I know anything about this? I didn’t. After some investigation it was revealed to be an identity theft scam, and within a week several other people were also found to be a victim of the same scam. Before you judge too harshly, keep in mind that often the people affected by this often aren’t very technical, don’t know what to look for when it comes to phishing, and are just doing what comes naturally in the situation. The scammers in this case are obviously at least somewhat technical and have a huge advantage in terms of being able to scattershot communicate with a very large group of people (potentially millions, although more likely 10’s of thousands in the case I describe). Also, while I’m sure no one reading this has ever been phished (cough), it has been _repeatedly_ found that phishing is effective, even for highly technical audiences. When it comes to recruiting, it is all too plausible that the person you’re interacting with doesn’t work for the company you’re “interviewing” with, and many recruiters start a conversation not even revealing who they recruit for. In fact, there are recruiting agencies that may as well be phishing organizations, because they will claim to have a role simply to get your resume and then, once they have your information, will start shopping it to companies in an attempt to get paid. In short, I have a ton of sympathy for people affected by this, and think the assholes who do this kind of thing are pretty much evil.

bawana 6y ago

so does mean that linked in is now a useful collection of targets?

scarmig 6y ago

Definitely a targeted, very personal attack, as you can scam an order of magnitude more funds by focusing on the masses instead of making fake interviews, offer packets, etc. I'd love more details, because there's not much to learn here. I walk away from the article with no idea about novel defensive strategies people need to take and no idea what we as technologists can do to help prevent this in the future.

neya 6y ago

The last line - "(Nidhi Razdan is former Executive Editor, NDTV.)" That's their classic way of burning her for burning them. Having said that, I learnt the same lesson as well a few years ago. Never quit your current unless you're 101% sure your next job is waiting for you and all the due process is taken care of.

wgriirwghawigi 6y ago

Is it possible she made this all up, for (temporary) media attention? Here she is hijacking an event for aspiring journalists to try and interview Barack Obama, who sees through this and publicly shames her: https://twitter.com/rose_k01/status/1350053978403291138 https://twitter.com/rose_k01/status/1350053978403291138 There are multiple interviews of her talking about her upcoming appointment, her class structures, here (non-existent) syllabus. It seems like another possible interpretation of the events is that she made this all up, then blamed it all on a vague "phishing attack" to defuse any responsibility. In the months prior, her career received a boost from all the media attention. Now, she also has some level of additional fame, that while not exactly positive, could help her launch into the next phase of her aspirations

mensetmanusman 6y ago

A few weeks ago I was in the next room washing dishes overhearing my dad say he just got an alert of missing funds from his bank account. I asked him about it 10 minutes later and was shocked he had submitted all his account information from a text alert. “You do realize you just gave all your account information to a scammer in a phishing attack I hope.” Thankfully he was able to change account information within minutes and no funds were lost. Moral: check in with your parents, people around the world are trying to scam them weekly.

mensetmanusman 6y ago

Imagine a future where an army of GTP-4 agents await mere mortals in cyberspace. If they are all programmed to extract funds through conversation, how will we prevent this?

pimlottc 6y ago

One thing I haven't seen mentioned is that there is a name for these kinds of advanced phishing attempts, which is "spear-phishing". Normal phishing is broadly targeted and fairly generic - "You just won a cruise", online parking ticket due, etc. It's usually easy to spot once you're aware of it. Spear-phishing, in contrast, targets a specific audience with a message that includes specific details that make it more convincing - your boss's name, company, job title, bank account number, mortgage loan start date, health provider name, etc. The more specific, the better. These can be very hard to detect. If I've just been to the doctor, I'm expecting to get an email about a hospital bill, and I'm pretty confident that the hospital's online payment site will look like it hasn't been updated from the 90s. TBH, half the time I'm paying a medical bill online, I'm crossing my fingers that it's actually going to the right place...

alisausaaaaaa 6y ago

Wanna have hot-lovin' conversations? You’re on the right way! - https://adultlove.life https://adultlove.life

garyfirestorm 6y ago

‘many emails were exchanged between me and these alleged Harvard email IDs where they sought my personal information for a "work visa".‘ ‘I had been told a work visa had been issued in the US for me which would be sent to me only when travel was required.‘ I think this should have been a major red flag. Work visas are not issued like that. I don’t understand why you wouldn’t interact with an embassy for visa issuance.

litefoot 6y ago

Hmmm...I guess I am one of those folks who practices trust but verify through independent sources and would have pick up the phone and called the Harvard HR Department using a known good number vice only relying on and communicating on email. Second, some posters have said that you can pass company phishing training and be still be victimized by this cyber criminals...true to some degree; however, a cursory check of the smtp email header and or embedded http links would probably have provided clear indication that something was amiss. But I agree victim blaming is not and will not ever be appropriate.

zxienin 6y ago

It is surprising me that this is international news. There are panel discussions running. And now post on HN? Anything unique about this that explains the blast radius of this news?