Re:Actually they did. (from an IU employee)
on
Phishing for Credit
·
· Score: 1
Welcome to my reply to your reply to my first ever post on slashdot. I have now learned about formatting options. I am not really an IT person. The end.
Thursday, one of my co-workers at the IU campus helpdesk got the email and dismissed it after telling us it might be a potential source of many irate callers later on in the day.
And so it was. I got a caller to send us the full headers of the message that appeared to be from his girlfriend. What do you know? The headers clearly showed the message was originating from whuffo@iu.edu!
So, with our limited helpdesk lookup tools, I found that whuffo@iu.edu was indeed a valid e-mail account, but it was registered as a departmental account and we could not see who personally created the account.
I wanted to get to the bottom of this so I went ahead and looked at the link in the email that it wants users to click on. What do you know? It redirects to a site called www.whuffo.com before asking for the user's credentials!
While my co-workers were bitching about it, I decided to do some detective work (Not sure why my co-workers, normally very competent at problem solving skills, didn't think of this). I looked up the whois info on whuffo.com and what do you know? The domain is registered to Professor Markus Jakobssen, of the IU Informatics Department!
So who's this Markus guy? I found his IU websites. And one of his research interests is 'phishing.' Hmmm. I take a look at the upper level classes he teaches. What do you know? His powerpoint lecture for I400 for this week is all about HOW TO PULL OFF A PHISHING SCAM. Wow, what's the connection here?
Meanwhile, the helpdesk had made this an escalated incident and turned it over to the IT security office. We get a message back (from Tom Jagatic of the IT policy office) saying they are "mitigating the effects of the issue." I had to go look up mitigating in the dictionary before I realized this wasn't a typical response from ITSO. Normally they'd jump on something like this and put a stop to the emails right away.
Giving ITSO the benefit of the doubt, I decide to use my new clues on who might be doing this. With this information in hand, I shot off an e-mail to Tom J. and ITSO and the whole rest of the day, I get no response at all. We continue taking calls from confused users and ask them all to change their passwords as it's all we can really tell them to do at this point.
I go home and check all fucking weekend, and believe me I was watching all our e-mail accounts like a hawk. No response from Tom Jagatic or the IT security office.
So on Monday I'm back at work and I check my mail to find that the whole scam has been put out in the open. In our email there were copies of several mass-emailed apologies to the users who got the phishy message, the users whose identities were spoofed, and to the support center and helpdesk staff. All these messages contained was an explanation of the "experiment" (which you can read in any news story about it) and their "sincere apologies."
The rest is history. The blog that Tom and Markus setup, where people are commenting, has got lots of angry people angry at themselves for being duped. That's not why I'm angry.
All I want from Tom and ITSO is an actual sincere apology for all the work and extra detective skills I/we put into trying to find the perpetrator, since at the time we weren't in on their little plan. No one seems to understand that in any other circumstance, if this were a real security threat, we'd all be getting pats on the back and compliments for figuring out who was behind it before ITSO did (as that's their job, normally.) But, no, since Tom, Markus, ITPO, and ITSO were all in on it, we just get a 'mitigated' effort at an apology from those guys.
Actually they did. (from an IU employee)
on
Phishing for Credit
·
· Score: 3, Interesting
Actually, they did phish a few tech-savvy people here, and we did attempt to point them to the authorities. The "authorities" ignored us because they were playing along with the scam the whole time.
Thursday, one of my co-workers at the IU campus helpdesk got the email and dismissed it after telling us it might be a potential source of many irate callers later on in the day.
And so it was. I got a caller to send us the full headers of the message that appeared to be from his girlfriend. What do you know? The headers clearly showed the message was originating from whuffo@iu.edu!
So, with our limited helpdesk lookup tools, I found that whuffo@iu.edu was indeed a valid e-mail account, but it was registered as a departmental account and we could not see who personally created the account.
I wanted to get to the bottom of this so I went ahead and looked at the link in the email that it wants users to click on. What do you know? It redirects to a site called www.whuffo.com before asking for the user's credentials!
While my co-workers were bitching about it, I decided to do some detective work (Not sure why my co-workers, normally very competent at problem solving skills, didn't think of this). I looked up the whois info on whuffo.com and what do you know? The domain is registered to Professor Markus Jakobssen, of the IU Informatics Department!
So who's this Markus guy? I found his IU websites. And one of his research interests is 'phishing.' Hmmm. I take a look at the upper level classes he teaches. What do you know? His powerpoint lecture for I400 for this week is all about HOW TO PULL OFF A PHISHING SCAM. Wow, what's the connection here?
Meanwhile, the helpdesk had made this an escalated incident and turned it over to the IT security office. We get a message back (from Tom Jagatic of the IT policy office) saying they are "mitigating the effects of the issue." I had to go look up mitigating in the dictionary before I realized this wasn't a typical response from ITSO. Normally they'd jump on something like this and put a stop to the emails right away.
Giving ITSO the benefit of the doubt, I decide to use my new clues on who might be doing this. With this information in hand, I shot off an e-mail to Tom J. and ITSO and the whole rest of the day, I get no response at all. We continue taking calls from confused users and ask them all to change their passwords as it's all we can really tell them to do at this point.
I go home and check all fucking weekend, and believe me I was watching all our e-mail accounts like a hawk. No response from Tom Jagatic or the IT security office.
So on Monday I'm back at work and I check my mail to find that the whole scam has been put out in the open. In our email there were copies of several mass-emailed apologies to the users who got the phishy message, the users whose identities were spoofed, and to the support center and helpdesk staff. All these messages contained was an explanation of the "experiment" (which you can read in any news story about it) and their "sincere apologies."
The rest is history. The blog that Tom and Markus setup, where people are commenting, has got lots of angry people angry at themselves for being duped. That's not why I'm angry.
All I want from Tom and ITSO is an actual sincere apology for all the work and extra detective skills I/we put into trying to find the perpetrator, since at the time we weren't in on their little plan. No one seems to understand that in any other circumstance, if this were a real security threat, we'd all be getting pats on the back and compliments for figuring out who was behind it before ITSO did (as that's their job, normally.) But, no, since Tom, Markus, ITPO, and ITSO were all in on it, we just get a mitigated effort at an apology from those guys.
Slashdot Mirror
Welcome to my reply to your reply to my first ever post on slashdot. I have now learned about formatting options. I am not really an IT person. The end.
I feel like fueling the fire.
Thursday, one of my co-workers at the IU campus helpdesk got the email and dismissed it after telling us it might be a potential source of many irate callers later on in the day.
And so it was. I got a caller to send us the full headers of the message that appeared to be from his girlfriend. What do you know? The headers clearly showed the message was originating from whuffo@iu.edu!
So, with our limited helpdesk lookup tools, I found that whuffo@iu.edu was indeed a valid e-mail account, but it was registered as a departmental account and we could not see who personally created the account.
I wanted to get to the bottom of this so I went ahead and looked at the link in the email that it wants users to click on. What do you know? It redirects to a site called www.whuffo.com before asking for the user's credentials!
While my co-workers were bitching about it, I decided to do some detective work (Not sure why my co-workers, normally very competent at problem solving skills, didn't think of this). I looked up the whois info on whuffo.com and what do you know? The domain is registered to Professor Markus Jakobssen, of the IU Informatics Department!
So who's this Markus guy? I found his IU websites. And one of his research interests is 'phishing.' Hmmm. I take a look at the upper level classes he teaches. What do you know? His powerpoint lecture for I400 for this week is all about HOW TO PULL OFF A PHISHING SCAM. Wow, what's the connection here?
Meanwhile, the helpdesk had made this an escalated incident and turned it over to the IT security office. We get a message back (from Tom Jagatic of the IT policy office) saying they are "mitigating the effects of the issue." I had to go look up mitigating in the dictionary before I realized this wasn't a typical response from ITSO. Normally they'd jump on something like this and put a stop to the emails right away.
Giving ITSO the benefit of the doubt, I decide to use my new clues on who might be doing this. With this information in hand, I shot off an e-mail to Tom J. and ITSO and the whole rest of the day, I get no response at all. We continue taking calls from confused users and ask them all to change their passwords as it's all we can really tell them to do at this point.
I go home and check all fucking weekend, and believe me I was watching all our e-mail accounts like a hawk. No response from Tom Jagatic or the IT security office.
So on Monday I'm back at work and I check my mail to find that the whole scam has been put out in the open. In our email there were copies of several mass-emailed apologies to the users who got the phishy message, the users whose identities were spoofed, and to the support center and helpdesk staff. All these messages contained was an explanation of the "experiment" (which you can read in any news story about it) and their "sincere apologies."
The rest is history. The blog that Tom and Markus setup, where people are commenting, has got lots of angry people angry at themselves for being duped. That's not why I'm angry.
All I want from Tom and ITSO is an actual sincere apology for all the work and extra detective skills I/we put into trying to find the perpetrator, since at the time we weren't in on their little plan. No one seems to understand that in any other circumstance, if this were a real security threat, we'd all be getting pats on the back and compliments for figuring out who was behind it before ITSO did (as that's their job, normally.) But, no, since Tom, Markus, ITPO, and ITSO were all in on it, we just get a 'mitigated' effort at an apology from those guys.
Actually, they did phish a few tech-savvy people here, and we did attempt to point them to the authorities. The "authorities" ignored us because they were playing along with the scam the whole time. Thursday, one of my co-workers at the IU campus helpdesk got the email and dismissed it after telling us it might be a potential source of many irate callers later on in the day. And so it was. I got a caller to send us the full headers of the message that appeared to be from his girlfriend. What do you know? The headers clearly showed the message was originating from whuffo@iu.edu! So, with our limited helpdesk lookup tools, I found that whuffo@iu.edu was indeed a valid e-mail account, but it was registered as a departmental account and we could not see who personally created the account. I wanted to get to the bottom of this so I went ahead and looked at the link in the email that it wants users to click on. What do you know? It redirects to a site called www.whuffo.com before asking for the user's credentials! While my co-workers were bitching about it, I decided to do some detective work (Not sure why my co-workers, normally very competent at problem solving skills, didn't think of this). I looked up the whois info on whuffo.com and what do you know? The domain is registered to Professor Markus Jakobssen, of the IU Informatics Department! So who's this Markus guy? I found his IU websites. And one of his research interests is 'phishing.' Hmmm. I take a look at the upper level classes he teaches. What do you know? His powerpoint lecture for I400 for this week is all about HOW TO PULL OFF A PHISHING SCAM. Wow, what's the connection here? Meanwhile, the helpdesk had made this an escalated incident and turned it over to the IT security office. We get a message back (from Tom Jagatic of the IT policy office) saying they are "mitigating the effects of the issue." I had to go look up mitigating in the dictionary before I realized this wasn't a typical response from ITSO. Normally they'd jump on something like this and put a stop to the emails right away. Giving ITSO the benefit of the doubt, I decide to use my new clues on who might be doing this. With this information in hand, I shot off an e-mail to Tom J. and ITSO and the whole rest of the day, I get no response at all. We continue taking calls from confused users and ask them all to change their passwords as it's all we can really tell them to do at this point. I go home and check all fucking weekend, and believe me I was watching all our e-mail accounts like a hawk. No response from Tom Jagatic or the IT security office. So on Monday I'm back at work and I check my mail to find that the whole scam has been put out in the open. In our email there were copies of several mass-emailed apologies to the users who got the phishy message, the users whose identities were spoofed, and to the support center and helpdesk staff. All these messages contained was an explanation of the "experiment" (which you can read in any news story about it) and their "sincere apologies." The rest is history. The blog that Tom and Markus setup, where people are commenting, has got lots of angry people angry at themselves for being duped. That's not why I'm angry. All I want from Tom and ITSO is an actual sincere apology for all the work and extra detective skills I/we put into trying to find the perpetrator, since at the time we weren't in on their little plan. No one seems to understand that in any other circumstance, if this were a real security threat, we'd all be getting pats on the back and compliments for figuring out who was behind it before ITSO did (as that's their job, normally.) But, no, since Tom, Markus, ITPO, and ITSO were all in on it, we just get a mitigated effort at an apology from those guys.