4 ms·

TLDR: *It's not very useful to have an interpretation by a person who mis-interpreted a situation, without concrete real-world examples of what they actually in

TLDR: *It's not very useful to have an interpretation by a person who mis-interpreted a situation, without concrete real-world examples of what they actually interpreted: screenshots of conversations & email addresses/other contact info (at least domains such as @something.edu) , so I can at least say "Yeah, this was obviously phishing" or "wow, this phisher was really incognito".* I'm interested in seeing the email address domain of the person who phished this author. And other specific details about the conversation-- such as screenshots and other evidence. - "what appeared to be an official Harvard email ID" Did the phisher have a @harvard.edu sort of email address or not? I don't care about "what appeared to be" (i.e. insinuating the author interpreted the account to be official.) I want to know what the actual domain of the email address was -- not that in the author's opinion it seemed to not be fake. - I know some professors have their own websites & use their own custom domains-- still, I'd see this as phishy unless it specifically came from a @harvard.edu account. And even then, the phisher could still have somehow accessed an available account. But, then I'd simply try to find their faculty page. Also, I would expect other people or gorup-email-accounts in HR to be CCed on the emails, not just some individual contacting me. To be honest, I am surprised this author does not provide concrete details. She tells how things happened, and what steps she took. But provides no screenshots of her conversations, no specific details about the online personas of the phisher.

JeremyNT 6y ago
There's something about this story that feels... incomplete to me. As the victim here - and as a journalist no less - it's in her own interest to present the attack as being incredibly sophisticated so as not to appear naive for being deceived. In reality, perhaps the attack was not as sophisticated as her narrative suggests. Like you, I'd appreciate some more details.
- lbblack 6y ago
  Wholeheartedly agreed...
Debug_Overload 6y ago
Also, the term "sophisticated" is almost meaningless here, and that's usually the case when talking about these kinds of issues. Pretty straightforward Nigerian prince style scam is now "sophisticated" phishing attack. We already had enough issues in infosec with companies claiming they're all attacked by "APT" and "state-sponsored actor". It just seems an easy way to dodge embarrassment and looking silly. Of course, there are real cases where the person/company may actually be a victim of a sophisticated phishing attack (or APT/state-sponsored attack, etc) but the terms lose their weight when they are being thrown around like this.
poplan 6y ago
harvard.edu doesn't have a dmarc policy so it can be spoofed. edit: nevermind I've read the other replies and it's not that easy
spoonjim 6y ago
It’s already an embarrassing situation to share. 99% of people would not share it. The screenshots might be even harder to share because the signs seem so obvious in retrospect. I agree that more would be valuable but understand why we may never get it.
- aeoleonn 6y ago
  I suspect that's exactly why they did not provide specific details. Which for me, negates the value of the article. In which case-- this article is more of a "Don't get phished. But I won't show you how not to get phished and what it looks like when you're getting phished."
  - spoonjim 6y ago
    The article has some value, which is to make people aware of the fact that this happens, and happens in highly bespoke ways to powerful/influential people. It’s in all of society’s interest that powerful people don’t get phished (imagine this journalist getting phished, compromising photographs being stolen, and then blackmailed to say “talk positively about this political candidate and ensure they win or we will leak these photos.” Not at all far fetched.
- durovo 6y ago
  I would expect a journalist to share this information. Many journalists don't shy away from sharing the details when they are reporting a story on someone else.
FlyingSnake 6y ago
> It's not very useful to have an interpretation by a person who mis-interpreted a situation, without concrete real-world examples of what they actually interpreted ... I second you. This being the Hacker news I'm really interested in how the phishing worked and the postmortem of the scam. This is a golden opportunity to learn about such high profile attempts, but no one's talking about it. It's sad to see that neither the author, nor her detractors are making any attempt to analyze the situation rationally.
jackson1442 6y ago
> I'd see this as phishy unless it specifically came from a @harvard.edu account This, 100%. Just about every university in the US has a policy that all official school business must be communicated through your institutional email address- be it a question about the class or setting up an appointment for office hours. Most of my instructors have explicitly told us they will ignore any emails not sent from an @uni.edu email. On a different note, how many schools set up a different email address structure for students versus faculty/staff? For my community college, students were first.last@g.communitycollege.edu and at my current uni students are FirstLast@my.university.edu. Is this standard practice?

JeremyNT 6y ago

There's something about this story that feels... incomplete to me. As the victim here - and as a journalist no less - it's in her own interest to present the attack as being incredibly sophisticated so as not to appear naive for being deceived. In reality, perhaps the attack was not as sophisticated as her narrative suggests. Like you, I'd appreciate some more details.

lbblack 6y ago
Wholeheartedly agreed...

Debug_Overload 6y ago

Also, the term "sophisticated" is almost meaningless here, and that's usually the case when talking about these kinds of issues. Pretty straightforward Nigerian prince style scam is now "sophisticated" phishing attack. We already had enough issues in infosec with companies claiming they're all attacked by "APT" and "state-sponsored actor". It just seems an easy way to dodge embarrassment and looking silly. Of course, there are real cases where the person/company may actually be a victim of a sophisticated phishing attack (or APT/state-sponsored attack, etc) but the terms lose their weight when they are being thrown around like this.

poplan 6y ago

harvard.edu doesn't have a dmarc policy so it can be spoofed. edit: nevermind I've read the other replies and it's not that easy

spoonjim 6y ago

It’s already an embarrassing situation to share. 99% of people would not share it. The screenshots might be even harder to share because the signs seem so obvious in retrospect. I agree that more would be valuable but understand why we may never get it.

aeoleonn 6y ago
I suspect that's exactly why they did not provide specific details. Which for me, negates the value of the article. In which case-- this article is more of a "Don't get phished. But I won't show you how not to get phished and what it looks like when you're getting phished."
- spoonjim 6y ago
  The article has some value, which is to make people aware of the fact that this happens, and happens in highly bespoke ways to powerful/influential people. It’s in all of society’s interest that powerful people don’t get phished (imagine this journalist getting phished, compromising photographs being stolen, and then blackmailed to say “talk positively about this political candidate and ensure they win or we will leak these photos.” Not at all far fetched.
durovo 6y ago
I would expect a journalist to share this information. Many journalists don't shy away from sharing the details when they are reporting a story on someone else.

FlyingSnake 6y ago

> It's not very useful to have an interpretation by a person who mis-interpreted a situation, without concrete real-world examples of what they actually interpreted ... I second you. This being the Hacker news I'm really interested in how the phishing worked and the postmortem of the scam. This is a golden opportunity to learn about such high profile attempts, but no one's talking about it. It's sad to see that neither the author, nor her detractors are making any attempt to analyze the situation rationally.

jackson1442 6y ago

> I'd see this as phishy unless it specifically came from a @harvard.edu account This, 100%. Just about every university in the US has a policy that all official school business must be communicated through your institutional email address- be it a question about the class or setting up an appointment for office hours. Most of my instructors have explicitly told us they will ignore any emails not sent from an @uni.edu email. On a different note, how many schools set up a different email address structure for students versus faculty/staff? For my community college, students were first.last@g.communitycollege.edu and at my current uni students are FirstLast@my.university.edu. Is this standard practice?