“Appointment” as professor at Harvard was an elaborate phishing attack

Thank you for posting that. There are obviously way too many people here (and elsewhere) who think they're way too smart to fall for phishing and other forms of scams unlike "stupid" grandmas, journalists, etc.

The reality is that we all do things when we're distracted and not really paying attention. Or we get caught up in the excitement of something and we don't stand back and ask ourselves whether it really makes sense. And anyone who thinks otherwise is just arrogant and misguided.

I have yet to see a scam which would fool me. And I have seen many already.

All the scam and phishing mails I saw in my whole internet career were somewhere between totally obvious and embarrasingly blunt.

I can't agree with your assessment. If someone is naïve, they are at risk. Same applies for overconfidence. These are personality traits which are easily exploited. In real life as well as on the Internet. We cant protect everyone from everything. Neither in healthcare nor in VR.

A clever element of this is the cross-cultural nature: the Harvard name internationally known, yet someone not in that milieu would not be able to detect a number of "red flag" anomalies. In fact if the author was phished by someone in India (a likely case) then the perpetrator could make a cultural error that would be undetectable by the victim as they might share the same set of assumptions.

I say "cross cultural" but by that I also mean "cross domain" which is how financial scams can entrap victims who aren't familiar with the details of financial jargon.

It's also why people can believe conspiracy theories which are absurd to someone familiar with the domain.

It’s already an embarrassing situation to share. 99% of people would not share it. The screenshots might be even harder to share because the signs seem so obvious in retrospect. I agree that more would be valuable but understand why we may never get it.

There's something about this story that feels... incomplete to me.

As the victim here - and as a journalist no less - it's in her own interest to present the attack as being incredibly sophisticated so as not to appear naive for being deceived. In reality, perhaps the attack was not as sophisticated as her narrative suggests.

Like you, I'd appreciate some more details.

Also, the term "sophisticated" is almost meaningless here, and that's usually the case when talking about these kinds of issues. Pretty straightforward Nigerian prince style scam is now "sophisticated" phishing attack.

We already had enough issues in infosec with companies claiming they're all attacked by "APT" and "state-sponsored actor". It just seems an easy way to dodge embarrassment and looking silly.

Of course, there are real cases where the person/company may actually be a victim of a sophisticated phishing attack (or APT/state-sponsored attack, etc) but the terms lose their weight when they are being thrown around like this.

harvard.edu doesn't have a dmarc policy so it can be spoofed.

edit: nevermind I've read the other replies and it's not that easy

> It's not very useful to have an interpretation by a person who mis-interpreted a situation, without concrete real-world examples of what they actually interpreted ...

I second you. This being the Hacker news I'm really interested in how the phishing worked and the postmortem of the scam. This is a golden opportunity to learn about such high profile attempts, but no one's talking about it. It's sad to see that neither the author, nor her detractors are making any attempt to analyze the situation rationally.

> I'd see this as phishy unless it specifically came from a @harvard.edu account

This, 100%. Just about every university in the US has a policy that all official school business must be communicated through your institutional email address- be it a question about the class or setting up an appointment for office hours. Most of my instructors have explicitly told us they will ignore any emails not sent from an @uni.edu email.

On a different note, how many schools set up a different email address structure for students versus faculty/staff? For my community college, students were first.last@g.communitycollege.edu and at my current uni students are FirstLast@my.university.edu. Is this standard practice?

> The fact of the matter is that when joining a new institution one lacks the contacts and the context to discern normal institutional behavior

That was the case for me at a couple of very early jobs in my career, but hasn’t been the case for the last couple of decades. New jobs come by way of old colleagues, friends, etc. in such a way that I’m basically never walking in to a completely unknown situation.

If you’re not great at relationship maintenance, use something like LinkedIn. Reach out to former coworkers who you worked well with or got along with, and ask about jobs. Odds are very high that they’d like to work with you again, and will get a referral bonus if it happens!

It's been particularly hard interviewing during the pandemic. In usual times, at least you would visit the office and meet some real people in person. Not saying you can't get scammed in person, but it's definitely harder to impersonate reasonably large organisations like that.

I 100% agree. All the hoops you have to jump through and things you need to enter regarding personal information always makes them feel like a honeypot. Not one moment in initial onboarding process do I feel like I'm legitimitely giving my info to HR but some scammer in god knows where.

Email addresses can be spoofed.

https://en.wikipedia.org/wiki/Email_spoofing

Exactly. No concrete details and examples so safe to assume the emails were not actual @harvard.edu ones. But I blame it on organizations and esp universities. Each school/lab get their own prefix which makes it harder for people to spot a fake address.

She writes: "what appeared to be an official Harvard email ID". No further description is given.

This could be something as simple as "someone@harvard-faculty.org".

For the recipient, this is effectively indistinguishable from a legit address. Not just because people are unsophisticated, but because many orgs really do use this sort of ancillary domain for conducting real business.

I've seen Fortune 50 corps, hospitals, and banks make this mistake.

Even if Harvard does not, has not, and will not ever make this mistake, an outsider would not be surprised to see it.

She made it public because she had been doing PR telling people she was a Harvard professor.

This "phishing" is suspected to be a cover up for her own fraud getting caught.

I agree. There are good reasons to be skeptical of the story at this point. But if, for purposes of argument, one ignores other claims and goes by the original post only, it falls into the category of vaguely plausible. Vaguely to be sure. But not quite so vaguely that I'm going to say that no experienced journalist could ever fall for it. (Although, the more I think about it, the harder it is for me to believe that she wouldn't have made one phone call or sent one email to the dean or whoever to ask "Hey, I seem to be being given the runaround" before quitting her job. Journalists aren't known for being shy about picking up the phone.)

Indian journalists are notoriously gullible. Stories about them being tricked are a dime a dozen.

http://www.gelfmagazine.com/archives/nasas_prodigy_takes_ind...

> personal attack on this woman with the intent to humiliate and embarrass her professionally.

This is exactly what it feels like to me.

Definitely. Looks like the goal was to make her leave her position at NDTV.

I did not want to speculate, but when I think of someone wanting to humiliate and embarrass, the first name that came to mind was "IT cell". But one of my friends said, the "IT cell" usually sends rape threats, they are not so sophisticated.

You either know about the "IT cell" or please google it ... all the links on it are non-authoritative.

Yeah, who would spend the 90 minutes doing a fake interview for a random phishing victim. Even one with questions that are convincing enough to her.

Assuming the scammers are Indian, and the victim would be expecting some Americans interviewing her, I wonder how they scammers got some Americans to join in the scam. Hire some American actors and tell them it's for a prank TV show maybe?

No lecture halls in covid, but virtual lectures.

I agree.

I also wonder what degree of ego played into this.

Who does Harvard contact out of the blue? If they contacted me out of the blue by email my first thought would be "Why would they contact me-- who am I? What have I accomplished that I would be on the radar that people are talking about me at Harvard to the point where I am invited to interview?"

To me, that would be phishy-- Unless I was some award winning, well-published, and/or well-credentialed journalist.

- Looking on Amazon, I see 1 book by this author: "Left, Right and Centre: The Idea of India". I also see a blank LinkedIn page, which mentions she lives in India.

- On Wikipedia, I see she has " done documentaries from Pakistan-administered Kashmir, Tibet and the United Kingdom after the train bombings." and "has been the diplomatic correspondent of NDTV 24x7, which is an English language television channel that carries news and current affairs in India, owned by New Delhi Television Ltd network.": https://en.wikipedia.org/wiki/Nidhi_Razdan

Those aren't trivial accomplishments. But I don't know that they represent the pinnacle of journalistic achievement to the degree that Harvard would reach out, out of the blue.

From the article:

> Contrary to what many are tweeting, Harvard has a school called the Extension School offering a Journalism Degree Programme[1]. The actual programme is called the Master of Liberal Arts, Journalism degree.

1. https://www.extension.harvard.edu/academics/graduate-degrees...

It seems more specific to Harvard. I wonder if the documents she was given by scammers were just believable or accurate. If they mirrored actual Harvard recruitment process then it's possible that whoever did this wokred or applied there.

Or maybe it wasn't about the money? Maybe she was targetted specifically for her previous roles and knowledge?

Attack was very sophisticated.

>Timed with the pandemic, it could have been hard not to fall for.

It didn't start there though. The offer letter supposedly came in January 2020 when things were perfectly normal in the vast majority of the world; I was traveling around Europe without a thought of pandemics at that time.

It seems a little weird that there would be a job offer after just a 90 minute phone interview. And moving halfway around the world seems a pretty big deal and one would think someone in that situation would be looking for a bit more motion on the logistics. On the other hand, we're talking Harvard Extension School and she's in India so maybe not a complete red flag especially given she had some apparent prior contact with the school. But certainly the pandemic allowed them to string things out for whatever reason.

It does seem as if there are different stories floating around though.

People make prank phone calls that require a lot more work than a 90 minute phone interview.

She is remarkably circumspect about these details. Lots of references to people being allegedly from Harvard or appearing to be from Harvard. It does feel disingenuous to put that out there and not provide a single example.

A single DNS record and distributing the signing key to probably thousands of machines able to send mail, some of which are probably 30 years old and unable to do the dmarc crypto...

This is why journalists generally try to confirm information before publishing. I wouldn't say it never happens, but there is supposed to be some amount of verifying that wouldn't have been done on a personal job offer.

Everybody gets a public key certificate, possibly since birth. There needs to be some way of establishing that which keys belong to which person, perhaps via some government registry, and a way to invalidate old/compromised keys. Overkill?

Nidhi Razdan gets a lot of hate, particularly from the right in India.

I was probably a really bad joke by someone who did not like her. I can't see how you could get any financial gain from it. Scammers are usually slick, but very lazy.

The one thing the attacker definitely achieved was to reveal that a particular journalist is not very good at an essential part of their job, fact checking.

A clever person could hijack an alumni email account username@post.harvard.edu

Note the bad pun Harvard uses: "post"

Or you could get an address (deceptively or via hijack) on an subdomain run by a student group.

A url containing 'harvard' and redirecting to an actual faculty website is going to convince most people if the communications are plausible. Many large organizations use multiple url forms for emails, especially for quasi-separate divisions like business schools or extension programmes.

A particularly sneaky scammer without access to Harvard mailboxes might register a plausible-sounding domain with an .ac TLD (which resembles the .ac reserved for universities in many national domain systems including the author's, but is actually a freely purchasable domain supposedly associated with Ascension Island)

Maybe something like @harvard-school-of-journalism.com, although that's too wordy. The article mentions "Harvard Extension School", so, it could be some variation of that.

Edit: I tried harvard-extension.school in the browser, it redirected me to http:harvard-education.edu (not https!), which seems to be a clone of extension.harvard.edu . The WHOIS records of harvard-extension.school/.education are pretty new (registered last year), and they're registered on GoDaddy and 1API GmbH respectively. A Germany-based registrar? Would Harvard use them?

They are certainly biased to the left. But they are definitely better than any of the alternatives in India... Have your seen what kind of garbage is reported by Indian news channels? There was the entire bullshit non issue about Rhea Chakroborty and the SSR suicide that was extremely disappointing to watch. And you can in no way defend the kind of nonsense that is spread on WhatsApp groups in India.

I don't get it ? So they call out other media channels. So their journalists deserve shit ?

Twitter is filled with BJP IT Cell bots and miscreants. I wouldn't expect less.

Can you say with a straight face that Republic TV is not biased ? Or India TV ?

I figure if it's actually important, they'd personally meet me or call. You don't respond over email hoping an instant response. It's obvious from the start of the email.

Wait, what sort of attack requires everyone to be in the dean's office?

This was Harvard Extension School. You're not talking a tenured Harvard professor position. One of my mentors undergrad was a former Newsweek editor who lectured a couple days a week and also didn't have a PhD or academic publications. (He had written books.)

I realize this is uselessly pedantic, but Harvard's Division of Continuing Education (Extension School + Summer School) is technically under the FAS umbrella, alongside Harvard College (undergrad) and GSAS (graduate arts + sciences). ~15 years ago I worked for FAS as a web developer, and the software my org developed was used by all 3 of these schools. Wikipedia confirms FAS is still organized in this way: https://en.wikipedia.org/wiki/Harvard_Faculty_of_Arts_and_Sc...

That said, yes it's extremely misleading for a DCE instructor to call themselves an FAS professor. This sort of thing does happen at all top tier schools' extension programs, though far more often it's done by students rather than instructors.

Posted elsewhere, this is categorically false:

I’m not here to debate this specific claim of phishing, but this is just factually false, _especially_ for applied / practiced humanities. Here are two examples of well respected authors / journalists who are more senior than associate prof at Harvard’s FAS...and this was on just the first link in my first search:

Teju* Cole, Gore Vidal Professor of the Practice of Creative Writing (an endowed professorship, no less! With only an MA and mphil!) https://english.fas.harvard.edu/people/teju-cole

Michael Pollan, Lewis K. Chan Arts Lecturer and Professor of the Practice Non-Fiction (also a professor of journalism at Berkeley! With only an MA!) https://english.fas.harvard.edu/people/michael-pollan

HBS likewise has business practitioners without phds on faculty. Their expertise is of value regardless of on-paper credentials.

These are two very well respected writers. Often, in more research oriented disciplines, the “experts” have phds, by necessity. But especially for applied humanities like creative writing and journalism, the experts w the most experience quite often _do not_ have doctorates, and that does nothing to diminish their expertise or professional credentials.

That is a bad sort of victim blaming.

I hope you wouldn't apply that logic to victims of other non-online crimes.

Anyway, separately, she addresses that in her article, convincingly I thought. Plus she's brave and helping others to write about this (which victim blaming doesn't encourage).

What a strange reaction to this story.

I had a similar thought: I would be more and more suspicious the longer I didn’t get an email from an @harvard.edu email.

Most phishing scams required the target to have an emotional reaction that clouds their judgement. For example, if you get an email saying that your credit card was charged in another state, if you are worried about your finances you may panic and click on the button to login and deny the charges.

> I was invited to speak at an event (...) One of the apparent organisers of this event contacted me separately to say there was a vacancy for a teaching position and would I be interested (...) I submitted my CV (...) A few weeks later I was "interviewed"

This sounds exactly like the kind of job opportunity that's meant to come about by networking, getting your name out there, public speaking and so on. We are often told that this is how the best jobs are found.