Software executive exploits ATM loophole to steal $1M | Hacker News Reader

Software executive exploits ATM loophole to steal $1M

zdnet.com

35 pointsLinuxBender22 comments

Open articleView on HN

Sounds like a call-back to Office Space.... which also gives a clue as to what type of prison he's headed to.

Does it? Is prison rape as much of an issue in China as it is in the US?

No but organ harvisting is. Here’s a story from today.[1]

[1]https://www.theguardian.com/science/2019/feb/06/call-for-ret...

Is it really as common in the US as movies and shows would have us believe?

(The idea that we're still supposed to laugh at this like as though it's funny, rather than a tremendous travesty of justice, is pretty telling...)

It seems awfully strange that the employer he stole from defended him and believed his obvious lie. I wonder if there’s more to the story than what’s in this article.

They probably wanted to avoid the bad press showing their security was really flawed, and spin it as intentional testing.

However, society/police can decide they don't want criminals roaming free just because it helps a company cover up their mistakes.

Ten and a half years... Some murderers get away with less.

It says he held all the money in an account and the bank accepted his explanation that it was there for testing. It seems likely he was waiting to see if problems surfaced or he was just collecting interest, but it seems to me 10 1/2 years is pretty harsh for making transactions at a certain time of day to exploit what is actually a ridiculous problem on the bank's end, especially considering he was able to give the money back.

Not a lawyer, but from a moral perspective, for most justice systems, the punishment is determined after determining whether the person is guilty. On top of that, the prison time for the crime is independent of other crimes (usually). It is almost impossible to balance all the crimes to make it seem fair. How do you even gauge that? Thief < Rapist < Murderer?! Each crime should be taken for what it is rather than what it compares to.

Thief < Rapist < Murderer seems pretty logical to me.

Kind of silly that he got a lengthy sentence after arguing that he was "testing" the software, didn't spend any of the money, and returned it all when asked.

Given the level of automation and monitoring that's being built in The People's Republic I suspect this is more a message of "don't even think about 'innocently' probing systems for vulnerabilities"... imagine the potential chaos if someone figured out how to Blue Screen their version of Domain Awareness?

"Kind of silly that he got a lengthy sentence after arguing that he was "testing" the software, didn't spend any of the money, and returned it all when asked."

Everything about the story indicates that he was lying, and only returned it when he was caught.

I feel like it's the prosecutors job to prove that.

Especially if the bank account was with the same bank, then the argument that he was just testing looks quite strong. The money isn't 'stolen' till it leaves the bank.

A financial company I know regularly does test payments between employee and automated robot accounts, often on production systems, and they're either trivial amounts (under a dollar) or huge amounts (over a billion dollars). The goal is that the small payments are inconsiquential, and the huge ones are so big there is no way they won't get noticed.

Is this sarcasm? He had no intention of returning anything until he was caught. The only thing he was testing was whether he could get away with it.

That seems extremely likely, but to get 10 1/2 years in prison?

Don't fuck with banks or corporations. Who do you think laws are there to protect? Average people??

Bahahahaha

Well... In this case the bank did try to protect him:

> Huaxia Bank asked Chinese authorities to drop the case once the money was returned, of which all of the proceeds were recovered. This request was not accepted as "legitimate" by law enforcement, and therefore Qin must serve his sentence.

Now they were probably doing it for selfish reasons but still.

I don't think that invalidates what I said. I never said anything about the bank's actions. Unless banks write laws now?

I'm really not trying to argue but I can't help but saying..

See: Lobbying?

If that were the case, why steal 1 million dollars instead of just 1 dollar?

Many internal bank audit processes ignore small discrepancies but eventually notice large ones. As apparently this did get noticed. Once you know a single withdrawal works, it's not a meaningless test try a large amount or longer time period.

Reply on news.ycombinator.com