Posts

Programmer finds ridiculous ATM loophole that let him withdraw ₦377 million in cash

It sounds like something straight out of a movie: an unsatisfied bank programmer discovers the perfect scheme for making an ATM spit out free money.

But apparently, this story is true: The South China Morning Postand China’s Daily Economic News report that 43-year-old Qin Qisheng managed to withdraw over 7 million yuan (upwards of ₦377 million) from ATMs operated by his employer, Huaxia Bank — all by exploiting a crazy loophole.

According to the reports, the bank’s system didn’t properly record withdrawals made around midnight — effectively spitting out cash without removing the total from a user’s account. Normally, that might send up a red flag that a transaction had failed, but Qisheng allegedly inserted scripts into the system that suppressed those alerts.

Qisheng started pulling out money in November 2016, but it wasn’t until January 2018, some 1,358 withdrawals later, that the bank discovered the bad code in its system and brought him to the authorities.

Perhaps the most surprising part of this story: the bank didn’t want to keep pressing charges once he’d returned the money. Maybe fearing the bad publicity (apparently the loophole has already been fixed), Huaxia Bank reportedly asked police to drop the case — reportedly accepting Qisheng’s explanation that he was merely testing the bank’s security and was holding onto the money for the bank to reclaim. As one does.

The courts refused, though, and Qisheng is now looking at 10 and a half years in prison after losing his appeal. They didn’t buy the argument, considering that he’d moved the money to his personal bank account, instead of the bank’s dummy account, and had apparently been investing some in the stock market, too.

The Verge

Hackers can get rich using your computer — and you’d never know it

It’s getting hard to read the news without hearing about another cyber attack making its way around the global internet.

A growing trend among cybercriminals is the kind of malware attack that infiltrates your network and works quietly in the background to perform tasks such as mining a digital currency and sending the profits back to the author of the virus while the host remains unaware.

This type of threat has been highlighted by the Adylkuzz attack which exploits the same Microsoft vulnerability as the WannaCry attack. However, where WannaCry seized files and ransomed them, Adylkuzz installs a cryptocurrency miner on compromised machines.

“These are not particularly unusual, we see a lot of malware that does cryptocurrency mining,” Nick Savvides, a security specialist at Symantec told News.com.au. “There’s a very big business in it.”

Such malware can often go undetected but will likely degrade a computer’s performance and speed.

“If criminals get it right it doesn’t chew up too many resources, just enough that it can deliver something,” and the infection can go undetected for long periods of time.

Given the rising value of many cryptocurrencies in recent months, “it’s possible to make quite a bit of money out of it without it being noticed,” Savvides said.

After security firm Proofpoint published a blog this week describing how the attack turns infected users into unwitting financial supporters of cyber criminals, some reports claimed the Adylkuzz malware could end up being a bigger attack than WannaCry which infected as many as 200,000 Windows systems in more the 150 countries. But Savvides disagrees.

“I just don’t see it. The reason I don’t see it is that this has been active for some time now, the rates of infection have been pretty low, and there hasn’t been an associated e-mail campaign to infect hosts,” he said.

Proofpoint said it has detected a number of infected machines that have transferred several thousand dollars worth of the cryptocurrency Monero to the creators of the virus dating back to as early as April 24.

Interestingly, once the malware exploits the Microsoft vulnerability, it shuts it down, thus denying anyone else the chance to do the same. “One bad guy making sure no one else can steal his host.”

These types of attacks share certain characteristics with the commonly used distributed denial of service (DDoS) attacks which also take control of unwitting hosts to direct their computer’s traffic at a particular network.

“In fact as a cybercriminal, you could dual purpose that botnet. You could go and infect thousands of hosts and utilize them to not just mine bitcoins for you but to also launch a denial of service attack for you,” Savvides said.

These kind of attacks “aren’t going away.”

So if your computer is running a little slower than usual, how can you check if it might possibly be compromised?

According to Savvides the only thing the average person can do to ensure they’re not the unwitting victim of such malware is to run a security tool like Norton Power Eraser which is a free virus and malware removal tool that people can run to clean their device.

“I think that’s really the only way for a layman to determine this,” he said.

New York Post