Hacker News Reader

Comment by LordAtlas | Hacker News Reader

While it's clear that this was a sophisticated and personally-targeted scam, I feel the blog post would have been more useful with information about which Harvard email addresses were used to communicate with her, and perhaps some screenshots. Were they actual harvard.edu email addresses, which means somebody had access to an official address for replying to mails from her? (That makes the scam deeper and involves US authorities.) Or was it something like harvardhr@gmail.com? Which means she should not have fallen for it.

I just saw this tweet from someone senior at her former employer about how she uploaded a reference letter to an official-looking site but again, no screenshot or URL referenced.

https://twitter.com/soniandtv/status/1350415332599480324

View on HN

She writes: "what appeared to be an official Harvard email ID". No further description is given.

This could be something as simple as "someone@harvard-faculty.org".

For the recipient, this is effectively indistinguishable from a legit address. Not just because people are unsophisticated, but because many orgs really do use this sort of ancillary domain for conducting real business.

I've seen Fortune 50 corps, hospitals, and banks make this mistake.

Even if Harvard does not, has not, and will not ever make this mistake, an outsider would not be surprised to see it.

No, anyone at Harvard uses a @*.harvard.edu address.

Yes, of course.

But the senders were not at Harvard, so it's very likely that they did not do so. And they would not need to do so, for their purpose.

Sure, but you wouldn't expect the average person who doesn't have a deep interest in tech and lives in a country where the .edu suffix isn't even a thing to know this. I doubt even most hackers here validate the ownership of the URLs every time a recruiter reaches out with a plausible-sounding personally-targeted opportunity (as opposed to a 'dear customer please sign in here' mass-mailing)

Exactly. No concrete details and examples so safe to assume the emails were not actual @harvard.edu ones. But I blame it on organizations and esp universities. Each school/lab get their own prefix which makes it harder for people to spot a fake address.

> to assume the emails were not actual @harvard.edu ones

If that is so... so what? Plenty of organizations use different domains. Fidelity staff uses "frm.com"-- as an example-- while most customers know them as fidelity.com.

Email addresses can be spoofed.

https://en.wikipedia.org/wiki/Email_spoofing

Well, of course, SMTP headers are trivial to spoof, but for this scam to work, the scammer would need actual POP/IMAP access to the harvard.edu account to receive her replies and respond to those, which is not as trivial.

No. [1][2][3]

[1] https://en.wikipedia.org/wiki/Sender_Policy_Framework

[2] https://en.wikipedia.org/wiki/DMARC

[3] https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail

Only if they’re used. There are no DMARC records in place for harvard.edu or subdomains, which is kinda shocking.

The lack of DMARC records, even if it could facilitate spoofing, won’t magically make reply emails addressed at a valid @harvard.edu address land in a spoofer’s inbox. A different Reply-To address is possible but then you can’t claim a lack of warning signal. There’s something else going on.

I'm guessing the scammers did something like person@hr.harvard.edu.obscuredomain.tld

They've gotten pretty good at crafting domains this way.

No idea on harvard, but alumni are often allowed to keep their addresses and for every alum that still takes full advantage of that, ten may not notice anything. Similarly, old group addresses may mostly go into the void.

I suspect it is quite easy to make it look like many people from an institution are in a thread and a passive participant is an email address from a 3rd party job portal.

I don’t know a single reputable U.S. institution that doesn’t replace your @university.edu address with @alum[ni].university.edu after you leave. I’ve been affiliated with two and have friends all over the place, including Harvard.

MIT is right next to Harvard..

*Might your own cultural expectations open you to attacks from a place with MIT's (recent if not current) network culture?

MIT uses @alum.mit.edu. I don’t think I know former employees there but at least former students I know lose mit.edu addresses, a fact also easily confirmed with a Google search. So, your point being?

Edit: You added

> *Might your own cultural expectations open you to attacks from a place with MIT's (recent if not current) network culture?

after my reply. I’m not sure how it is relevant to your claim that “alumni are often allowed to keep their addresses”. In fact the question doesn’t make any sense to me; I’m not gonna accept an MIT job offer from an alum.mit.edu address (or more relevant to me, alumni.stanford.edu/alumni.princeton.edu), regardless of network culture.

Edit 2: Reread your question and realized you were implying that MIT "recently" allowed alumni to keep @mit.edu addresses. Well, you'll need to show some proof.

Your expectations are very specific to what you know about US schools right now. MIT would let a machine receive email, many institutions would forward email to a users alum address, etc.

This approach to identifying phishing is ultimately insufficient.

For decades, Harvard issued alumni email addresses of *@post.harvard.edu. [1] Given that “post” could either refer to “after” or “postal”, I would imagine someone who didn’t know many people at Harvard might think that a post.harvard.edu email address is a normal thing for current employees.

1: https://alumni.harvard.edu/help/email-forwarding

My alma mater (one of the highest ranked state schools) grants your email for live and does not update it.

Berkeley doesn't.

Reply on news.ycombinator.com