aaaazzzz

Hello, a friend who lives in India was the target of an online fraud recently. I've been trying to think of ways the attack might have been orchestrated. I was hoping that some the security experts on HN might chime in on what may have happened.

Before going into the details of what happened, for those that aren't familiar, online transactions in India use OTPs (for One-Time Password). When a user makes an online transaction, they receive a unique, temporary code that is valid for a short period of time. The user must enter this code to complete the transaction. OTPs are typically sent to the user's registered mobile number via SMS. The message that contains the OTP also has information re. the transaction - the amount, etc.

DETAILS OF THE FRAUD

1. My friend was using a iPad with up-to-date security updates. He uses Safari as his browser.

2. My friend wanted to purchase tickets to an exhibition so he googled the exhibition's website.

3. On the website, there was a link (this is no longer available since the exhibition ended) to purchase tickets. https://indiaartfestival.com/

4. Clicking on the link opened a page on a very popular ticketing website (similar to Ticketmaster in the U.S.). https://in.bookmyshow.com/explore/home/national-capital-region-ncr

5. My friend entered his credit cards details and clicked on 'Purchase'. I'm guessing this was via a payment gateway the ticketing website uses.

6. He received an OTP via text message and entered it on the site.

7. The site displayed an error message saying that there was some problem with the transaction and that a new OTP was being sent. Note that he did not do anything to get the new OTP, it was sent automatically.

8. My friend recd. the 2nd OTP and entered that. His mistake was that he did not check the rest of the text message which contained the amount of the transaction, etc.

9. The site displayed an error message again and sent another OTP.

10. My friend entered the OTP for the 3rd time. He made the same mistake and did not check the rest of the message.

11. He doesn't remember what exactly happened after this but there were no more OTPs sent to his phone.

12. Instead of 1 transaction, his credit card had been charged 3 times:

  a) A valid transaction for the tickets he was trying to purchase.

  b) 2 fraudulent transactions, each for about 50 times the price of the tickets.

He's opened a dispute with his credit card company but I'm curious how was this done.

The ticketing website (and I'm guessing the payment gateways they use) are pretty big in India and if it was compromised and a lot of people were defrauded, I would've expected to hear something in the news. Haven't heard anything.

I got him to check his browser history and there were only 3 sites he opened when this happened:

1. Google when he searched for the exhibition's website.

2. The exhibition website.

3. The ticketing website.

We confirmed that 2 & 3 above were legit sites and not something set up for a phishing attack.

I've discussed this with a couple of my tech friends (no one specializing in security though) and none of us have been able to come up with a reasonable explanation of what may have happened. Any security gurus on HN have any thoughts? Thank you!

I recently had an on site at Google for a Systems SRE position. I did not get the job and the feedback that my recruiter gave me was that the hiring committee found my performance in the 'troubleshooting' interview to be lacking. I guess nothing can beat the experience of actually dealing with outages but I was wondering if anyone has suggestions on additional resources for this kind of interview.

The one's that I'm aware of:

* The troubleshooting chapter in the Google SRE book * https://jvns.ca/zines/ * http://www.brendangregg.com/linuxperf.html * Reading about past outages: https://github.com/danluu/post-mortems

Thank you very much!

Hi, I'm looking for some advice w.r.t CS courses in NYC.

I'm in my early 30s with a masters in EE. I work in the network/security space in NYC where I write some code - basic Python scripts to automate, monitor infra., etc. The most complicated thing I've written is a multi-threaded script that interacts with a REST API. I didn't take CS courses at school.

I've been thinking about learning some CS fundamentals. It sounds challenging, some of it may be fun and going forward, it's going to be tough to survive in the networks/security space without programming skills since everything is moving in the direction of software. I'm not interested in frontend web dev/JS. I'd like to concentrate on backend stuff, preferably using Python but am open to other options.

Based on my research, there seem to be at least 3 paths:

1. MOOCs/Online degrees: The most recommended option. However, I'm not motivated enough to effectively complete these. This goes against the HN ethos but I prefer a classroom setting (took a certificate course in Python at NYU and it was useful).

2. Boot Camps: The only part-time, non Ruby centric, bootcamp I found is Byte Academy. From their information session, they seemed disorganized with the message "you'll build a web application, here are some examples". This doesn't seem useful for someone looking to learn CS fundamentals. Does anyone here have experience with Byte Academy?

3. Courses at Columbia/NYU/etc.: I don't need a degree but I'm unsure if taking individual courses is an option. * Couldn't find information on Columbia's website that suggested that it is. * Found http://ptgrad.poly.edu/ at NYU which seems to allow attending some courses but I'm not certain.

I was hoping to get some advice on the options mentioned above and in case there are other avenues that I should explore. For people familiar with the NYC area, any in-person classes/courses that you would recommend?

Thank you very much!