In which case-- this article is more of a "Don't get phished. But I won't show you how not to get phished and what it looks like when you're getting phished."
As the victim here - and as a journalist no less - it's in her own interest to present the attack as being incredibly sophisticated so as not to appear naive for being deceived. In reality, perhaps the attack was not as sophisticated as her narrative suggests.
Like you, I'd appreciate some more details.
I second you. This being the Hacker news I'm really interested in how the phishing worked and the postmortem of the scam. This is a golden opportunity to learn about such high profile attempts, but no one's talking about it. It's sad to see that neither the author, nor her detractors are making any attempt to analyze the situation rationally.
We already had enough issues in infosec with companies claiming they're all attacked by "APT" and "state-sponsored actor". It just seems an easy way to dodge embarrassment and looking silly.
Of course, there are real cases where the person/company may actually be a victim of a sophisticated phishing attack (or APT/state-sponsored attack, etc) but the terms lose their weight when they are being thrown around like this.
This, 100%. Just about every university in the US has a policy that all official school business must be communicated through your institutional email address- be it a question about the class or setting up an appointment for office hours. Most of my instructors have explicitly told us they will ignore any emails not sent from an @uni.edu email.
On a different note, how many schools set up a different email address structure for students versus faculty/staff? For my community college, students were [email protected] and at my current uni students are [email protected]. Is this standard practice?
I'm interested in seeing the email address domain of the person who phished this author. And other specific details about the conversation-- such as screenshots and other evidence.
- "what appeared to be an official Harvard email ID" Did the phisher have a @harvard.edu sort of email address or not? I don't care about "what appeared to be" (i.e. insinuating the author interpreted the account to be official.) I want to know what the actual domain of the email address was -- not that in the author's opinion it seemed to not be fake.
- I know some professors have their own websites & use their own custom domains-- still, I'd see this as phishy unless it specifically came from a @harvard.edu account. And even then, the phisher could still have somehow accessed an available account. But, then I'd simply try to find their faculty page. Also, I would expect other people or gorup-email-accounts in HR to be CCed on the emails, not just some individual contacting me.
To be honest, I am surprised this author does not provide concrete details. She tells how things happened, and what steps she took. But provides no screenshots of her conversations, no specific details about the online personas of the phisher.