Slashdot Mirror
Software Executive Exploits ATM Loophole To Steal $1 Million (zdnet.com)
An anonymous reader quotes a report from ZDNet: A Chinese software manager has been sentenced after being found guilty of stealing approximately $1 million from Huaxia Bank ATMs containing security weaknesses. The 43-year-old former manager employed in Huaxia Bank's software and technology development center spotted a "loophole" in the bank's core operating system which offered an unrecorded timeframe in which to make withdrawals, as reported by the South China Morning Post. Qin Qisheng realized that cash withdrawals made close to midnight were not recorded by the bank's systems in 2016, and in the same year, began systematically abusing the glitch.
Qin wrote a number of scripts which, once implanted in the bank's software, allowed him to probe the loophole without raising suspicion. It appears these tests were successful as the software chief then made withdrawals for over a year of between $740 and $2,965, the publication says. The money had to come from somewhere, and so Qin used a "dummy account" established by the bank for testing purposes. In total, Chinese law enforcement says that the former manager was able to steal over seven million yuan, equivalent to roughly $1 million. Huaxia Bank eventually uncovered the scheme, which Qin attempted to explain away as "internal security tests." When it came to the money, the software manager said the funds were simply "resting" in his own account but were due to be returned to the bank. The financial institution accepted his explanation and fixed the problem, but law enforcement didn't and arrested him for theft in December 2018. Qin was given a jail term of ten and a half years, and on appeal, the sentence was upheld.
Qin wrote a number of scripts which, once implanted in the bank's software, allowed him to probe the loophole without raising suspicion. It appears these tests were successful as the software chief then made withdrawals for over a year of between $740 and $2,965, the publication says. The money had to come from somewhere, and so Qin used a "dummy account" established by the bank for testing purposes. In total, Chinese law enforcement says that the former manager was able to steal over seven million yuan, equivalent to roughly $1 million. Huaxia Bank eventually uncovered the scheme, which Qin attempted to explain away as "internal security tests." When it came to the money, the software manager said the funds were simply "resting" in his own account but were due to be returned to the bank. The financial institution accepted his explanation and fixed the problem, but law enforcement didn't and arrested him for theft in December 2018. Qin was given a jail term of ten and a half years, and on appeal, the sentence was upheld.
He stole from a bank. Who cares. They are insured and prolly are not going to miss that money all that much.
Maybe it was an executives bonus.
http://progressquest.com/spoltog.php?name=Son+Of+Son+Of+DarkRookie
We trained on the actual live production system; we could pull out any customer bank account
It's not the same fraud, it's totally different.
"Huaxia Bank eventually uncovered the scheme, which Qin attempted to explain away as "internal security tests." - What a brilliant defense. I no longer work here, I'm just resting your money for security purposes in my account.
Nice try Quiche.
. . . its total lack of movement was due to it bein' tired and shagged out following a prolonged squawk.
The funds are not quite dead yet.
They think they'll go for a walk.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
"...arrested him for theft in December 2018. Qin was given a jail term of ten and a half years, and on appeal, the sentence was upheld."
Arrested, tried, convicted, sentenced and appealed all in a little over two months?
The justice system works swiftly in China.
Yeeeah. All that pr0n in my home directory? I collected it all from websites and was going to turn it all over to the authorities, I just hadn't quiiiite gotten around to it yet.
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
You are called to defend China's good name with your rhetoric, comrade - remember, we have your mother in a cage above a large hot pot of soup. Make us proud, propagandist! The west can't know Huawei is a fraud tentacle! Distract!
Go forth and FUD or your family dies. Make the motherland proud, lie for the party!
I have a feeling a disgusting narcissist like this is going to be in never ending trouble in prison. I doubt the guards will be savvy enough to contain his criminal urges. I hope they hang him more than once.
If anyone had any doubts that their understanding of law and order is incompatible with ours, this is probably the last proof you need.
They arrested and convicted a banker. How can this be legal?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Just today I had a new co-worker try to make the same "at midnight" mistake in our code, at a security company.
Wrong:
Cron midnight SELECT where Date > 24 hours ago.
Another way to do it wrong:
Store update-ran (now())
Process new since update-ran
Right way:
Process where processed != true
You have to consider:
A) Records that occur *during* the processing
B) Yesterday's run wasn't *exactly* 24 hours ago. It was at least a few miliseconds more or less, long enough to insert a few transactions
Better but still unsafe, btw:
Cron midnight SELECT where Date > 48 hours ago AND processed != True ...
Handle where processed = pending
Embarrass the government, that's the only crime they pursue. Fake rice, soup made from abortions, no big deal. Anything goes in China except embarrassing them with their incompetence.
Nazi homosexual recruiter RAY MORRIS pushing debunked Nazi propaganda even after corrected, #ROPE
Plus, the "4 times" figure doesn't account for China's MILLIONS of disappeared in secret prisons throughout that criminal cabalist faggot country. Also - none of them got actual trials - not one.
Saunders claims he did nothing more than stumble across a loophole, a period of time when the ATM was offline from the bank's main systems.
Funny thing in China is that banks settle transactions with the central bank (People Bank of China) over QQ (a chat program) at the end of the day, and that account ballances of private individuals are stored in the central bank
Have no fear, CISA is here! The Cybersecurity and Infrastructure Security Agency will protect you, just give us tons of money and don't hold us to any real results. We're too busy traveling to exotic locations for speaking engagements and conferences, giving taxpayer money to our golf pals (especially Don B's friends since he's their bitch), and constantly reorganizing since that's a great way of avoiding work.
You have several errors in your code. Please fix them and repost.
Your ad here. Ask me how!
Honestly!
Lol - guy was obviously not just 'testing'. You find that kind of flaw, you only need to run the test once or twice, then escalate it quickly so it gets fixed. He didn't, and did this 'test' for a year. It's also very likely that flaw had been happening for a while for other people accidentally, so *quite* important to get fixed.
He got caught and punished for it. Probably self-justifying whilst he did it as 'testing', but really with the intention of only returning the funds if they were ever asked for - his 'get out of jail free card' (It's wonderful how the human mind works like this sometimes).
Law enforcement correctly didn't agree with his view on the matter, and gave him some new wrist jewellery and a new place to live.
The cash was just tired, it needed some rest.