Slashdot Mirror
Phishing for Credit
An anonymous reader writes "Two graduate students at Indiana University conducted a phishing study to
determine how readily students will give up personal information if
the phishing emails appear to come from close friends. Using only
publicly available
information, they sent out emails to students asking them to click a
link that required username/password information. Needless to say,
the study has generated lots of attention on campus. The student
newspaper has the story
and the researchers have created a blog where the participants can vent."
Dear Friend,
Can you please click on this link?
Yours Truly Friendly,
Close Friend
Rock that crushes, Paper & Scissors that don't matter.
They will be pressed with charges even though they had good intentions compared to hardly anyone getting caught with malicious intentions.
But some students are upset they were involved in the study without their consent or knowledge. Senior Rebecca Shakespeare did not even know she had been used as a sender until her friend notified her.
"I was frustrated that I was hearing from a friend that my e-mail account was sending her things," Shakespeare said. "I had no idea where it was coming from. I was irritated because I was concerned that my home system was being abused."
Shakespeare called University Information Technology Services, which said it could have been a virus and to not click on the link.
"I've spent a lot of time keeping my (computer) secured," Shakespeare said. "I feel kind of used that it was the University that was making my friends think I had opened up my system to viruses."
If that's really why they're concerned, well, maybe they'd be interested in knowing that the vast majority of virus/malware type things that send email in this fashion still don't originate from the computer of the person in question anyway...therefore, this whole rationale for worry is BS, since spoofed email can come from *anywhere*, and it's most often NOT your own computer.
And - make no mistake, I really do see their point - but the IT resources belong to the university, and neither the university nor the researchers uses the person's account or any password or other credentials belonging to the person. It was simply a spoofed "from" address; nothing more. And if it's strictly "legal" for any random person to spoof a from address, it's just as legal for the purposes of research, whose findings may provide some level of insight on *protecting* people from malicious phishing.
Now, I personally don't know whether any of this justifies doing the study in the way they did. That's a judgment call. If the university's IT organization proper is doing it, that's one thing, and I could see people being uncomfortable with the motivations. But grad students? I don't see any problem with that at all. In fact, they don't need anyone's permission to do what they did. However, in good faith, they did get the approval of the Human Subjects Committee.
please reply to this message with the following information:
Nickname:
Password:
"I was frustrated that I was hearing from a friend that my e-mail account was sending her things,"
Spam can come from anyone - its not too hard to forge the "FROM" line on an email. I'd hardly call it abuse of your account when spammers do it all the time.
The Doormat
If you're not outraged, then you're not paying attention.
This would make a nice change from the usual celebrity-in-trouble "apologies", where they go on the Tonight Show, bite their lips and look downcast and assure us "I'm very, deeply, truly sorry..."
Instead we can get, "Jay, I have created a blog where people can vent."
What I'm listening to now on Pandora...
Two graduate students at Indiana University conducted a phishing study to determine how readily students will give up personal information
After such a successful research on phishing, our two friends have decided to tackle a new study: test how much load e-commerce sites can handle, and how much money ATMs can usually deliver on any given day.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Graah! Why is the solution to everyone's problem with academia "fire the professor"? Your analogy to robbing a bank is a false one; nothing was actuallly stolen in this project. I think you, and a lot of other people, are overreacting.
Going back to school for entry-level jobs?
I think it's good to let students (future scientists, decicion makers etc...) feel what it means to be part of socially constructed fraud... Mainly because this will get worse and worse over time, you see how many database leaks with high profile personal data have taken place lately. People have to learn ways around all this identity theft, the only way is to confront them with the consequenses of this all.
A lot of the comments on the blog, complained that the study was unethical because the participants didnt know they were part of the study.
My two reasons why I think it couldnt have been done any other way.
1. This study focuses on deception and how people react when they are decived.
2. Telling the participants they were a part of a study or asking them to be part of it, would effect the behavior of the participants and therefore changing the study results.
As long as the information was not used in any illegal way. Then I don't find a problem with how this expirement was conducted. Yes it sucks to get phished, but its better to be fished by these guys than the hundreds of other phishers who are out there to turn phising into finacial gain.
In America we are imprisoned by our fear of them.
"I feel betrayed and offended"
Someone posted that on the blog. I think he/she should feel foolish rather than feel betrayed. Or that should be read as "I am so fucking dumb that i cannot believe i did what i did".
... to find that they did this experiment under the oversight of the university's Human Subjects Committee.
If that doesn't sound like some sort of ethical guidelines I don't know what does.
How does the Slashdot Effect happen given that no slashdotters ever RTFA?
Welcome to the internet; trust no one. I hope more people got the message.
So, they magically went back in time to get approval from the ethics committee after getting caught? Shit -- fuck the write-up on the phishing -- describe the time machine!
How does the Slashdot Effect happen given that no slashdotters ever RTFA?
That's precisely what they did. The whole thing was authorized from top to bottom. They even got the okay from campus IT to "abuse" the computer systems for their purposes. Try RTFA sometime.
Any college age person who is fooled by an email of the described type deserves a swift kick in the ass.
get a free laptop
and I object most strenuously to being associated with what sounds like the noisiest bunch of whining idiots in recent memory.
:)
Unethical? Possibly -- in the current "enlightened" academic environment where definition of terms is often left to whom screams loudest I suppose that one or more of these embarrassed campus inhabitants has enough functioning brain cells to come up with a completely irrelevant but intensely self-referrential definition which supports their childish outrage. It's highly delusional but they're obviously still children and I don't suppose we can expect actual coherent thought from them until they grow up.
Invasion of privacy"? Drugs must be a significant problem at IU. It always was known as a party school, and this is just more evidence that the description contains some accuracy. And to think that these students are often described as the "best and brightest" and the next generation of leaders. Kinda provides some background for current events, doesn't it?
Rb
It seems their primary complaint is that, GASP, "evil" email looked like it was coming from people they know. WAKE THE HELL UP PEOPLE!!! All the Slammer and Melissa viruses (and their mutated children) DO THE SAME THING: they scan through the address books of their victims, rewrite the "From" line to be one name in the address book, and then write the "To" line to be you (whose name is also in the address book) -- and then there's a good chance that you'll then know the person's name in the "From" line, which (it is hoped) makes you let your guard down and open the infected attachment.
I'll bet $1028 that 90% of the whiners there have been infected by these viruses in the past, and probably still are. And now they've been fooled a second time the same way. How does that old expression go again?
When I find some sympathy these whiners, I'll let them know...
I notice that a lot of the complainants have posted their e-mail addresses in the blog to try to get together to organize action...
Dear concerned student:
I am a close friend writing to you about your recent experience with a phishing study in which deception was used. I have met with an attorney on this issue who is interested in pursuing a class action lawsuit on behalf of the victims of this study. To participate, please click the link below and provide the following personal information...
Actually, they did phish a few tech-savvy people here, and we did attempt to point them to the authorities. The "authorities" ignored us because they were playing along with the scam the whole time. Thursday, one of my co-workers at the IU campus helpdesk got the email and dismissed it after telling us it might be a potential source of many irate callers later on in the day. And so it was. I got a caller to send us the full headers of the message that appeared to be from his girlfriend. What do you know? The headers clearly showed the message was originating from whuffo@iu.edu! So, with our limited helpdesk lookup tools, I found that whuffo@iu.edu was indeed a valid e-mail account, but it was registered as a departmental account and we could not see who personally created the account. I wanted to get to the bottom of this so I went ahead and looked at the link in the email that it wants users to click on. What do you know? It redirects to a site called www.whuffo.com before asking for the user's credentials! While my co-workers were bitching about it, I decided to do some detective work (Not sure why my co-workers, normally very competent at problem solving skills, didn't think of this). I looked up the whois info on whuffo.com and what do you know? The domain is registered to Professor Markus Jakobssen, of the IU Informatics Department! So who's this Markus guy? I found his IU websites. And one of his research interests is 'phishing.' Hmmm. I take a look at the upper level classes he teaches. What do you know? His powerpoint lecture for I400 for this week is all about HOW TO PULL OFF A PHISHING SCAM. Wow, what's the connection here? Meanwhile, the helpdesk had made this an escalated incident and turned it over to the IT security office. We get a message back (from Tom Jagatic of the IT policy office) saying they are "mitigating the effects of the issue." I had to go look up mitigating in the dictionary before I realized this wasn't a typical response from ITSO. Normally they'd jump on something like this and put a stop to the emails right away. Giving ITSO the benefit of the doubt, I decide to use my new clues on who might be doing this. With this information in hand, I shot off an e-mail to Tom J. and ITSO and the whole rest of the day, I get no response at all. We continue taking calls from confused users and ask them all to change their passwords as it's all we can really tell them to do at this point. I go home and check all fucking weekend, and believe me I was watching all our e-mail accounts like a hawk. No response from Tom Jagatic or the IT security office. So on Monday I'm back at work and I check my mail to find that the whole scam has been put out in the open. In our email there were copies of several mass-emailed apologies to the users who got the phishy message, the users whose identities were spoofed, and to the support center and helpdesk staff. All these messages contained was an explanation of the "experiment" (which you can read in any news story about it) and their "sincere apologies." The rest is history. The blog that Tom and Markus setup, where people are commenting, has got lots of angry people angry at themselves for being duped. That's not why I'm angry. All I want from Tom and ITSO is an actual sincere apology for all the work and extra detective skills I/we put into trying to find the perpetrator, since at the time we weren't in on their little plan. No one seems to understand that in any other circumstance, if this were a real security threat, we'd all be getting pats on the back and compliments for figuring out who was behind it before ITSO did (as that's their job, normally.) But, no, since Tom, Markus, ITPO, and ITSO were all in on it, we just get a mitigated effort at an apology from those guys.
I feel like fueling the fire.
Thursday, one of my co-workers at the IU campus helpdesk got the email and dismissed it after telling us it might be a potential source of many irate callers later on in the day.
And so it was. I got a caller to send us the full headers of the message that appeared to be from his girlfriend. What do you know? The headers clearly showed the message was originating from whuffo@iu.edu!
So, with our limited helpdesk lookup tools, I found that whuffo@iu.edu was indeed a valid e-mail account, but it was registered as a departmental account and we could not see who personally created the account.
I wanted to get to the bottom of this so I went ahead and looked at the link in the email that it wants users to click on. What do you know? It redirects to a site called www.whuffo.com before asking for the user's credentials!
While my co-workers were bitching about it, I decided to do some detective work (Not sure why my co-workers, normally very competent at problem solving skills, didn't think of this). I looked up the whois info on whuffo.com and what do you know? The domain is registered to Professor Markus Jakobssen, of the IU Informatics Department!
So who's this Markus guy? I found his IU websites. And one of his research interests is 'phishing.' Hmmm. I take a look at the upper level classes he teaches. What do you know? His powerpoint lecture for I400 for this week is all about HOW TO PULL OFF A PHISHING SCAM. Wow, what's the connection here?
Meanwhile, the helpdesk had made this an escalated incident and turned it over to the IT security office. We get a message back (from Tom Jagatic of the IT policy office) saying they are "mitigating the effects of the issue." I had to go look up mitigating in the dictionary before I realized this wasn't a typical response from ITSO. Normally they'd jump on something like this and put a stop to the emails right away.
Giving ITSO the benefit of the doubt, I decide to use my new clues on who might be doing this. With this information in hand, I shot off an e-mail to Tom J. and ITSO and the whole rest of the day, I get no response at all. We continue taking calls from confused users and ask them all to change their passwords as it's all we can really tell them to do at this point.
I go home and check all fucking weekend, and believe me I was watching all our e-mail accounts like a hawk. No response from Tom Jagatic or the IT security office.
So on Monday I'm back at work and I check my mail to find that the whole scam has been put out in the open. In our email there were copies of several mass-emailed apologies to the users who got the phishy message, the users whose identities were spoofed, and to the support center and helpdesk staff. All these messages contained was an explanation of the "experiment" (which you can read in any news story about it) and their "sincere apologies."
The rest is history. The blog that Tom and Markus setup, where people are commenting, has got lots of angry people angry at themselves for being duped. That's not why I'm angry.
All I want from Tom and ITSO is an actual sincere apology for all the work and extra detective skills I/we put into trying to find the perpetrator, since at the time we weren't in on their little plan. No one seems to understand that in any other circumstance, if this were a real security threat, we'd all be getting pats on the back and compliments for figuring out who was behind it before ITSO did (as that's their job, normally.) But, no, since Tom, Markus, ITPO, and ITSO were all in on it, we just get a 'mitigated' effort at an apology from those guys.