4 ms·

Email addresses can be spoofed. https://en.wikipedia.org/wiki/Email_spoofing https://en.wikipedia.org/wiki/Email_spoofing

LordAtlas 6y ago
Well, of course, SMTP headers are trivial to spoof, but for this scam to work, the scammer would need actual POP/IMAP access to the harvard.edu account to receive her replies and respond to those, which is not as trivial.
noname120 6y ago
No. [1][2][3] [1] https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework [2] https://en.wikipedia.org/wiki/DMARC https://en.wikipedia.org/wiki/DMARC [3] https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
- lkurtz 6y ago
  Only if they’re used. There are no DMARC records in place for harvard.edu or subdomains, which is kinda shocking.
  - oefrha 6y ago
    The lack of DMARC records, even if it could facilitate spoofing, won’t magically make reply emails addressed at a valid @harvard.edu address land in a spoofer’s inbox. A different Reply-To address is possible but then you can’t claim a lack of warning signal. There’s something else going on.
willmeyers 6y ago
I'm guessing the scammers did something like person@hr.harvard.edu.obscuredomain.tld They've gotten pretty good at crafting domains this way.
- foolmeonce 6y ago
  No idea on harvard, but alumni are often allowed to keep their addresses and for every alum that still takes full advantage of that, ten may not notice anything. Similarly, old group addresses may mostly go into the void. I suspect it is quite easy to make it look like many people from an institution are in a thread and a passive participant is an email address from a 3rd party job portal.
  - oefrha 6y ago
    I don’t know a single reputable U.S. institution that doesn’t replace your @university.edu address with @alum[ni].university.edu after you leave. I’ve been affiliated with two and have friends all over the place, including Harvard.
    - foolmeonce 6y ago
      MIT is right next to Harvard.. *Might your own cultural expectations open you to attacks from a place with MIT's (recent if not current) network culture?
      - oefrha 6y ago
        MIT uses @alum.mit.edu. I don’t think I know former employees there but at least former students I know lose mit.edu addresses, a fact also easily confirmed with a Google search. So, your point being? Edit: You added > *Might your own cultural expectations open you to attacks from a place with MIT's (recent if not current) network culture? after my reply. I’m not sure how it is relevant to your claim that “alumni are often allowed to keep their addresses”. In fact the question doesn’t make any sense to me; I’m not gonna accept an MIT job offer from an alum.mit.edu address (or more relevant to me, alumni.stanford.edu/alumni.princeton.edu), regardless of network culture. Edit 2: Reread your question and realized you were implying that MIT "recently" allowed alumni to keep @mit.edu addresses. Well, you'll need to show some proof.
        6y ago

LordAtlas 6y ago

Well, of course, SMTP headers are trivial to spoof, but for this scam to work, the scammer would need actual POP/IMAP access to the harvard.edu account to receive her replies and respond to those, which is not as trivial.

noname120 6y ago

No. [1][2][3] [1] https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework [2] https://en.wikipedia.org/wiki/DMARC https://en.wikipedia.org/wiki/DMARC [3] https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail

lkurtz 6y ago
Only if they’re used. There are no DMARC records in place for harvard.edu or subdomains, which is kinda shocking.
- oefrha 6y ago
  The lack of DMARC records, even if it could facilitate spoofing, won’t magically make reply emails addressed at a valid @harvard.edu address land in a spoofer’s inbox. A different Reply-To address is possible but then you can’t claim a lack of warning signal. There’s something else going on.

willmeyers 6y ago

I'm guessing the scammers did something like person@hr.harvard.edu.obscuredomain.tld They've gotten pretty good at crafting domains this way.

foolmeonce 6y ago
No idea on harvard, but alumni are often allowed to keep their addresses and for every alum that still takes full advantage of that, ten may not notice anything. Similarly, old group addresses may mostly go into the void. I suspect it is quite easy to make it look like many people from an institution are in a thread and a passive participant is an email address from a 3rd party job portal.
- oefrha 6y ago
  I don’t know a single reputable U.S. institution that doesn’t replace your @university.edu address with @alum[ni].university.edu after you leave. I’ve been affiliated with two and have friends all over the place, including Harvard.
  - foolmeonce 6y ago
    MIT is right next to Harvard.. *Might your own cultural expectations open you to attacks from a place with MIT's (recent if not current) network culture?
    - oefrha 6y ago
      MIT uses @alum.mit.edu. I don’t think I know former employees there but at least former students I know lose mit.edu addresses, a fact also easily confirmed with a Google search. So, your point being? Edit: You added > *Might your own cultural expectations open you to attacks from a place with MIT's (recent if not current) network culture? after my reply. I’m not sure how it is relevant to your claim that “alumni are often allowed to keep their addresses”. In fact the question doesn’t make any sense to me; I’m not gonna accept an MIT job offer from an alum.mit.edu address (or more relevant to me, alumni.stanford.edu/alumni.princeton.edu), regardless of network culture. Edit 2: Reread your question and realized you were implying that MIT "recently" allowed alumni to keep @mit.edu addresses. Well, you'll need to show some proof.
      - 6y ago