Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ozarks Technical Community College robbed of nearly $900k

bransontrilakesnews.com

Post reply on HN
Print view View original

31–40 of 88 posts

Re: Ozarks Technical Community College robbed of nearly $900k

#31

Post by formerkrogemp »

ceejayoz wrote: post #14
solenoidalslide wrote: post #12

> The loss of the funds will not affect students, classes or operations, states the release. Are organizations liable when they make statements like this? Suppose operations actually are affected and the college intentionally misrepresented the consequences of the fraud—are there grounds for legal recourse by students and future students?

I would assume they can say this due to having insurance coverage.

It might just be a phrase to reassure stakeholders not to panic and rethink potential or existing relationships with the college of fears of incompetence.

Re: Ozarks Technical Community College robbed of nearly $900k

#32

Post by tyingq »

downrightmike wrote: post #8

Oof, if a $900,000 invoice doesn't trigger review from their accounting dept, kind of their fault for not having a process of the common sense to question that bill.

Google and Facebook got bilked out of $100M, and you would guess they had lots of processes and technology in place. https://www.npr.org/2019/03/25/706715377/man-pleads-guilty-t...

Re: Ozarks Technical Community College robbed of nearly $900k

#33

Post by ghaff »

Swizec wrote: post #21
civilized wrote: post #17

I feel like spammers and cyber criminals are getting better. Stuff is starting to get through Google spam filter by mashing up with elements that seem very real and urgent. Like yesterday I got this spam in my Gmail primary inbox with a subject line like "RE: Department of Education Case #295720186". It made me wonder if you could autogenerate filter-evading spam using GANs? Train a GAN to generate email that fools a…

On the other hand, I’m seeing more and more legitimate stuff land in Gmail’s spam filter. Like virtually of San Francisco Marathon’s newsletters. Sure they’re pushy and really really want you to sign up for more races and I definitely need to unsubscribe … but I did subscribe and that means it isn’t spam.

One of the things that I assume happens is that, even when people have explicitly signed up for something or at least not opted out of receiving updates etc., they'll just "report spam" rather than unsubscribe and when enough people do this it gets put in everyone's spam folder unless enough people reclassify it.

There's not much stuff that ends up in my spam folder that I really care about and a fair bit I don't know how I got on some list. But relatively little of it is spam in the usual meaning of the term.

Re: Ozarks Technical Community College robbed of nearly $900k

#34

Post by codetrotter »

Swizec wrote: post #21
civilized wrote: post #17

I feel like spammers and cyber criminals are getting better. Stuff is starting to get through Google spam filter by mashing up with elements that seem very real and urgent. Like yesterday I got this spam in my Gmail primary inbox with a subject line like "RE: Department of Education Case #295720186". It made me wonder if you could autogenerate filter-evading spam using GANs? Train a GAN to generate email that fools a…

On the other hand, I’m seeing more and more legitimate stuff land in Gmail’s spam filter. Like virtually of San Francisco Marathon’s newsletters. Sure they’re pushy and really really want you to sign up for more races and I definitely need to unsubscribe … but I did subscribe and that means it isn’t spam.

> I’m seeing more and more legitimate stuff land in […] spam filter.

I use iCloud Mail with a custom domain, after having self-hosted my mail for many years.

I had some job interviews recently and in a couple of cases iCloud Mail was spam filtering the meeting invitations. Whoopsie!

Fortunately in both cases we had communicated about when the meetings would take place outside of the invitations. So even though I didn’t see the invitation mails, I knew when the meetings would take place, and in the case of lacking a link to join one of the meetings I got them to send me another link for the meeting.

And on the whole I will say that iCloud Mail is much more comfortable and convenient for me to use than continuing to self-host my mail. Both in terms of keeping spam out of my inbox, and in terms of mail that I send getting to other peoples inboxes rather than ending up in their spam.

Re: Ozarks Technical Community College robbed of nearly $900k

#35

Post by cookie_monsta »

jeroenhd wrote: post #20
Fargoan wrote: post #2

“We can’t provide all of the specifics at this time,” Higdon said, “but it appears the criminals succeeded in impersonating one of our vendors online and directed payments from the college into a fraudulent account.” - so they sent a fake invoice and the college paid it?

There are more and more reports of serious phishing attempts that do not rely on mere fake emails, but involve criminals breaking into a business' infrastructure, observing mail (and sometimes even call) flow for a while (this can take months!) and waiting for an opportune moment to strike. They'll use the real company's infrastructure to send an invoice or email in the middle of an existing project that goes unnotic…

Here's another such example. The red flags are there, in hindsight:

https://ia.acs.org.au/article/2020/ice-rink-loses--77k-in-em...

Re: Ozarks Technical Community College robbed of nearly $900k

#36

Post by pphysch »

civilized wrote: post #17

I feel like spammers and cyber criminals are getting better. Stuff is starting to get through Google spam filter by mashing up with elements that seem very real and urgent. Like yesterday I got this spam in my Gmail primary inbox with a subject line like "RE: Department of Education Case #295720186". It made me wonder if you could autogenerate filter-evading spam using GANs? Train a GAN to generate email that fools a…

Like it or not, this is the price of "privacy". Being able to easily pretend to be anyone, in the absence of an overarching identity framework -- and leaving identity recognition to the end user -- makes cybercrime a lot easier than it has to be.

Re: Ozarks Technical Community College robbed of nearly $900k

#37

Post by duxup »

solenoidalslide wrote: post #12

> The loss of the funds will not affect students, classes or operations, states the release. Are organizations liable when they make statements like this? Suppose operations actually are affected and the college intentionally misrepresented the consequences of the fraud—are there grounds for legal recourse by students and future students?

Is there some reason to think that these things will be effected?

I read that as "yeah keep coming to class, everyone will get paid, the lights will be on".

I don't see why that wouldn't be true.

Re: Ozarks Technical Community College robbed of nearly $900k

#38

Post by [deleted] »

formerkrogemp wrote: post #23
downrightmike wrote: post #8

Oof, if a $900,000 invoice doesn't trigger review from their accounting dept, kind of their fault for not having a process of the common sense to question that bill.

I hate to say it but a lot of "accounting depts" these days are someone with no formal training who just took on the role as another hat on top of other hats as the more experienced folks retired or moved on to greener pastures. There's a shortage of accounting folks in general as well.

[deleted]

Re: Ozarks Technical Community College robbed of nearly $900k

#39

Post by PolygonSheep »

downrightmike wrote: post #8

Oof, if a $900,000 invoice doesn't trigger review from their accounting dept, kind of their fault for not having a process of the common sense to question that bill.

The article just says it was a "cyber fraud incident" which is pretty vague. It may not have been a bill at all.

Re: Ozarks Technical Community College robbed of nearly $900k

#40

Post by latchkey »

We just got a spear phishing email to one of our finance department people. It appeared "From" the CEO. Must have pulled the names from LinkedIn.

Had some legitimate company in the email. Turns out that company even has a fraud page on their website since so many people seem to get these emails. It must work enough that the scammers keep trying.

https://www.nortonrosefulbright.com/en/global-statement/frau...

Post reply on HN