4 ms·
While it's clear that this was a sophisticated and personally-targeted scam, I feel the blog post would have been more useful with information about which Harva
by LordAtlas 6y ago
While it's clear that this was a sophisticated and personally-targeted scam, I feel the blog post would have been more useful with information about which Harvard email addresses were used to communicate with her, and perhaps some screenshots. Were they actual harvard.edu email addresses, which means somebody had access to an official address for replying to mails from her? (That makes the scam deeper and involves US authorities.) Or was it something like harvardhr@gmail.com? Which means she should not have fallen for it.
I just saw this tweet from someone senior at her former employer about how she uploaded a reference letter to an official-looking site but again, no screenshot or URL referenced.
https://twitter.com/soniandtv/status/1350415332599480324 https://twitter.com/soniandtv/status/1350415332599480324
- deleted 6y ago[deleted]
- orange_tee 6y agoEmail addresses can be spoofed. https://en.wikipedia.org/wiki/Email_spoofing https://en.wikipedia.org/wiki/Email_spoofing
- LordAtlas 6y agoWell, of course, SMTP headers are trivial to spoof, but for this scam to work, the scammer would need actual POP/IMAP access to the harvard.edu account to receive her replies and respond to those, which is not as trivial.
- noname120 6y agoNo. [1][2][3] [1] https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework [2] https://en.wikipedia.org/wiki/DMARC https://en.wikipedia.org/wiki/DMARC [3] https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
- lkurtz 6y agoOnly if they’re used. There are no DMARC records in place for harvard.edu or subdomains, which is kinda shocking.
- oefrha 6y agoThe lack of DMARC records, even if it could facilitate spoofing, won’t magically make reply emails addressed at a valid @harvard.edu address land in a spoofer’s inbox. A different Reply-To address is possible but then you can’t claim a lack of warning signal. There’s something else going on.
- willmeyers 6y agoI'm guessing the scammers did something like person@hr.harvard.edu.obscuredomain.tld They've gotten pretty good at crafting domains this way.
- foolmeonce 6y agoNo idea on harvard, but alumni are often allowed to keep their addresses and for every alum that still takes full advantage of that, ten may not notice anything. Similarly, old group addresses may mostly go into the void. I suspect it is quite easy to make it look like many people from an institution are in a thread and a passive participant is an email address from a 3rd party job portal.
- oefrha 6y agoI don’t know a single reputable U.S. institution that doesn’t replace your @university.edu address with @alum[ni].university.edu after you leave. I’ve been affiliated with two and have friends all over the place, including Harvard.
- foolmeonce 6y agoMIT is right next to Harvard.. *Might your own cultural expectations open you to attacks from a place with MIT's (recent if not current) network culture?
- oefrha 6y agoMIT uses @alum.mit.edu. I don’t think I know former employees there but at least former students I know lose mit.edu addresses, a fact also easily confirmed with a Google search. So, your point being? Edit: You added > *Might your own cultural expectations open you to attacks from a place with MIT's (recent if not current) network culture? after my reply. I’m not sure how it is relevant to your claim that “alumni are often allowed to keep their addresses”. In fact the question doesn’t make any sense to me; I’m not gonna accept an MIT job offer from an alum.mit.edu address (or more relevant to me, alumni.stanford.edu/alumni.princeton.edu), regardless of network culture. Edit 2: Reread your question and realized you were implying that MIT "recently" allowed alumni to keep @mit.edu addresses. Well, you'll need to show some proof.
- tinyhouse 6y agoExactly. No concrete details and examples so safe to assume the emails were not actual @harvard.edu ones. But I blame it on organizations and esp universities. Each school/lab get their own prefix which makes it harder for people to spot a fake address.
- nullc 6y ago> to assume the emails were not actual @harvard.edu ones If that is so... so what? Plenty of organizations use different domains. Fidelity staff uses "frm.com"-- as an example-- while most customers know them as fidelity.com.
- quesera 6y agoShe writes: "what appeared to be an official Harvard email ID". No further description is given. This could be something as simple as "someone@harvard-faculty.org". For the recipient, this is effectively indistinguishable from a legit address. Not just because people are unsophisticated, but because many orgs really do use this sort of ancillary domain for conducting real business. I've seen Fortune 50 corps, hospitals, and banks make this mistake. Even if Harvard does not, has not, and will not ever make this mistake, an outsider would not be surprised to see it.
- psychometry 6y agoNo, anyone at Harvard uses a @*.harvard.edu address.
- quesera 6y agoYes, of course. But the senders were not at Harvard, so it's very likely that they did not do so. And they would not need to do so, for their purpose.
- notahacker 6y agoSure, but you wouldn't expect the average person who doesn't have a deep interest in tech and lives in a country where the .edu suffix isn't even a thing to know this. I doubt even most hackers here validate the ownership of the URLs every time a recruiter reaches out with a plausible-sounding personally-targeted opportunity (as opposed to a 'dear customer please sign in here' mass-mailing)