14 ms·

Ex-Microsoft dev used test account to swipe $10M in store credits

311 points by prostoalex 7y ago

rit 7y ago
Supporting test credit cards in production with no fraud or risk assessment. Do you want fraud? This is how you get fraud.
drawkbox 7y ago
Kvashuk, the complaint suggests, was undone by Microsoft's UST Fraud Investigation Strike Team (FIST), which noticed a suspicious increase in the use of CSV to buy subscriptions to Microsoft's Xbox gaming system in February 2018. The investigators traced the digital funds, which had been resold on two different websites, to two whitelisted test accounts. From there, FIST proceeded to trace the accounts and transactions involved. With the assistance of the US Secret Service and the Internal Revenue Service, investigators concluded that Kvashuk had defrauded Microsoft, despite efforts to conceal his identity with fake accounts and to hide public blockchain transactions using a Bitcoin mixing service. In addition to service provider records that point to Kvashuk, the complaint notes that Microsoft's online store uses a form of device fingerprinting called a Fuzzy Device ID. Investigators, it's claimed, linked a specific device identifier to accounts associated with Kvashuk. Pretty involved dissection, went all the way down to digital fingerprinting to catch it. The thief was smart about the hiding it, but not smart enough, but he had to know after $10m they would catch on. Reminds me of the McDonalds Monopoly game that the extended family of one of the people that worked at the printing place kept winning which was improbable, then expanded further where everyone would give them a cut of the winnings up to $24m [1]. > Jerome Jacobson and his network of mobsters, psychics, strip-club owners, and drug traffickers won almost every prize for 12 years, until the FBI launched Operation ‘Final Answer.’ Take $10m or $24m from a large corporation, someone is going to notice. [1] https://www.thedailybeast.com/how-an-ex-cop-rigged-mcdonalds-monopoly-game-and-stole-millions https://www.thedailybeast.com/how-an-ex-cop-rigged-mcdonalds...
- iamnotacrook 7y ago
  "he had to know after $10m they would catch on...Take $10m, someone is going to notice" You don't know that for every person caught after taking $10m there aren't 5 who took $100m then stopped and got away with it. It's just pure speculation.
  - drawkbox 7y ago
    Possibly, in the McDonald Monopoly scam eventually the mob got involved, so maybe some are able to get away with it somewhere. But like in Office Space, when the account gets big enough it has to eventually be investigated and people aren't smart to run up a big amount but get greedy, whether they find the money or not who knows but someone will know.
  - onion2k 7y ago
    You don't know that for every person caught after taking $10m there aren't 5 who took $100m then stopped and got away with it. It's just pure speculation. I'd assume a $100m hole in a company balance sheets when they get audited would make the news.
    - sverige 7y ago
      But if you're really smart, you might get away with over $10MM (in 1978 dollars!) without the bank noticing for eight days -- when the FBI told them. https://www.social-engineer.org/wiki/archives/Hackers/hackers-Mark-Rifkin-Social-Engineer-furtherInfo.htm https://www.social-engineer.org/wiki/archives/Hackers/hacker... https://en.m.wikipedia.org/wiki/Stanley_Mark_Rifkin https://en.m.wikipedia.org/wiki/Stanley_Mark_Rifkin https://coolinterestingstuff.com/worlds-biggest-heists-stanley-rifkins-10-million https://coolinterestingstuff.com/worlds-biggest-heists-stanl...
      - captn3m0 7y ago
        Punjab National Bank, a state-owned bank in India ~lost $1.4B, without knowing about it for more than a year. ~lost is somehwhat vague because all it involved was a Letter of Undertaking that was a "promise" by the bank to return that money. They did honor it, losing billions of dollars. [0]: https://en.wikipedia.org/wiki/Punjab_National_Bank_Scam https://en.wikipedia.org/wiki/Punjab_National_Bank_Scam [1]: https://economictimes.indiatimes.com/news/international/obama-says-new-budget-rules-will-rein-in-spending/an-evergreen-lou-story-how-shetty-co-pulled-the-pnb-con/articleshow/63163744.cms https://economictimes.indiatimes.com/news/international/obam...
- gingabriska 7y ago
  >The thief was smart about the hiding it, but not smart enough I am interested in knowing in what ways he could have never been caught? What did he miss?
  - ars 7y ago
    He should have slowed down maybe. Also got greedy - he could have had 1 million and live on the interest, but he had to keep going.
    - tuananh 7y ago
      he sold it for much cheaper value. 10m could have been sold for 1 or 2m
    - brianwawok 7y ago
      Most people over-estimate the long term life of a million dollars in 2019. Standard wisdom gives you the 4% rule.. i.e. you can spend 4% of a balance to have a principle last forever (Based on historic stock market data, no guarantee it will actually work in the future). 4% of a million is only 40k. Can you live on 40k a year? Yes, billions of people make less than or equal to 40k a year. However most software devs like this guy who was making over 100k a year would be "content" to retire on 40k a year. He would need at least 3 million to live on the 120k a year ;)
      - bduerst 7y ago
        This is also handy napkin math for retirement.
        justsid 7y ago
        More like handy napkin math to figure out that my retirement plan is going to involve me dying young.
        brianwawok 7y ago
- anonymous5133 7y ago
  Using a bitcoin washing service and then sending the proceeds from the bitcoin transactions to your bank account is not exactly trying to conceal the activity.
  - darkpuma 7y ago
    Trying ineptly is still trying.
  - blaser-waffle 7y ago
    So then what is the play? Send it to someone else's bank account?
    - magashna 7y ago
      Monero laundering, or holding it for a while. Get too greedy and move too quickly, likely to stumble
      - bduerst 7y ago
        Are there any reliable and trustworthy Monero exchanges that allow anonymity? Not even Coinbase supports Monero, and Kraken requires identification.
      - darkpuma 7y ago
        > "or holding it for a while." I wonder if the FBI has an automated system for monitoring bitcoin addresses that are associated with investigations that went cold possibly years ago, and as such no longer have the active attention of any [human] agents. Probably, right? It seems like it would be a good idea anyway.
- mtgx 7y ago
  > Take $10m or $24m from a large corporation, someone is going to notice. This is the problem with stealing "easy money." It's hard to stop, especially if you don't spend the first portion of money wisely. It's why card skimmers always get caught, too, eventually. They can't just steal $100,000 and be done with it. That's barely enough for a fully loaded Tesla Model S. They have to keep on stealing, and after a few years of this, are you really going to go back to a 9-5 job paying you $30,000 or less a year for hard work? So it's not really about criminals "being dumb" about continuing to steal the money, unless you define being dumb the moment they first did it. It's more about them feeling like they have no choice but to keep doing it.
  - zulln 7y ago
    > It's why card skimmers always get caught, too, eventually. Given how much money actually is estimated to be skimmed and how few that actually get caught I doubt this.
  - gwd 7y ago
    > This is the problem with stealing "easy money." It's hard to stop, especially if you don't spend the first portion of money wisely. Plus there's a weird psychological effect in some people where they feel guilty and actually want to get caught. A few years ago I dropped my wallet somewhere, and someone picked it up and used the contactless cards a couple times. They caught him when, the next day, he was shouting and threatening people and generally acting obnoxious, and was arrested with my wallet (complete with my photo ID) still on him. Why did the guy suddenly get himself arrested? Why didn't he at least get rid of the wallet first? Maybe there's no connection between the two, but people are complicated.
    - IG_Semmelweiss 7y ago
      No. Has nothing to do with psychology. The name for this in statistics is ergodicity. Nassim Taleb, an expert on this subject, as well as many other authors in risk management have established that even professionals in statistics fare very poorly in understanding ergodicity in real life. In short , its not psych, its human nature
- sametmax 7y ago
  There are two technical interesting take aways in this: 1 - Microsoft, and probably most big companies, have persistent tracking ID on most stuff that are hard to get rid of and can be used to identify you and devices linked to you in a fuzzy way. I mean, we know about super cookies, fingerprinting and such, but it's another to hear it being used to track somebody that was careful and using multiple anonymous accounts. 2 - BTC mixers will not protect you. Correlating one single wallet with you will make it possible to them retrace the entire history.
  - homero 7y ago
    Well Microsoft has access to full hardware IDs on PC and Xbox.
  - samdoidge 7y ago
    As for 2, I would have thought one of the privacy coins could have been utilised: Buy Monero with Biticoin -> Transfer Monero to another wallet -> Buy Bitcoin with Monero. But I guess it isn't that easy.
    - sametmax 7y ago
      Most exhanges ask for KYC, so the BTC wallet would still be attached to your ID. You need to do that with individuals, which is much harder, especially for a high amount of money. Not saying this is impossible, but it's no as simple as it used to be.
      - deleted 7y ago
        [deleted]
    - magnamerc 7y ago
      Apparently this also breaks Moneros privacy by identifying a BTC address associated it (even without KYC). You need to buy Monero from LocalMonero if you want to be truly private.
  - buildzr 7y ago
    > BTC mixers will not protect you. Correlating one single wallet with you will make it possible to them retrace the entire history. It's also possible they both knew the address which was paid out to buy the stolen merchandise and they saw he had withdrawals from a bitcoin exchange in bank records. Given these two facts, it's pretty easy to draw a line between them even when mixers are used. But if you don't already know who to suspect this is much harder to do.
- duxup 7y ago
  From a technical standpoint I wonder what the developer who is stealing is thinking. I've worked lots of places with access to lots of things. I have technical know how and presumably so does he. Even if I was inclined to do something like this I know that many of my coworkers / people at the company ... are more than capable of tracking down most anything if given enough attention. The first and best protection I could think of is simply the volume of what is stolen to keep from being noticed. Once noticed with sufficient motivation it's just a matter of time.
  - pbhjpbhj 7y ago
    There's lots of things that could impair his reasoning (drink, gambling, other emotional stress, illness), or it could be motivated by revenge, or ...
  - fragmede 7y ago
    Reading between the lines, the article says they got away with it for months, and were only caught because they got greedy - to the tune of a luxury car and a mansion! This smells like a crime of opportunity; most crimes aren't throughly-planned, well-executed Hollywood-grade bank heists - or their digital equivalent, so there also isn't a thoroughly planned exit strategy to a non-extradition country, just a vague notion that something will happen, eventually. Possibly getting caught.
    - toyg 7y ago
      > most crimes aren't throughly-planned, well-executed Hollywood-grade bank heists And this is why Crime and Punishment is an ageless masterpiece of literature.
- johnbrodie 7y ago
  The explanation in the article is fairly well done. One thing I can't help but think whenever there are more involved processes for catching someone though, is that we'll never know if that was the actual method used. For a large enough case, they could utilize some other, more secretive method, and then parallel construct this (believable) one, with the benefit of already knowing the final answer. Not something I'm saying _happened_ here, but certainly something I think everyone should keep in mind when they read these types of cases.
- dd36 7y ago
  We only know about the times it is noticed.
0n34n7 7y ago
Silly billy
martin_ 7y ago
> If convicted of mail fraud, the former Microsoft software engineer could face as much as 20 years in prison and a $250,000 fine. It doesn't mention returning what he took... So he steals over 10m and buys a 1.6m house and can only be fined up to $250k? With 20 years in prison, and let's say out in 10 years of good behavior wouldn't that raise his annual income (which is taxed) from $116,000 to north of $1m?
- brianwawok 7y ago
  He won’t get to keep it
- rahimnathwani 7y ago
  Fines are punishment. Restitution/compensation is separate.
  - pkilgore 7y ago
    This. Also, as an attorney, I view all descriptions of possible sentences with extreme skepticism. A hyperbolic explanation [1] so I don't have to retype something similar: > Federal sentences are calculated using the United States Sentencing Guidelines. The guidelines are a very complex set of rules used to calculate a federal sentence based upon the crime charged, the circumstances of the case, and the criminal record of the defendant. Calculating a very simple sentence is like completing a very simple tax return under, say, 1040-EZ; a complex sentence is like completing a tax return for a troubled entity engaged in questionable tax practices. Or, for you old-school geeks, like creating a Runequest character for a friend who is an argumentative rules-lawyer. From the enactment of the guidelines in the 1980s until United States v. Booker in 2005, the guidelines were binding upon federal judges — they had to follow the guidelines unless there were grounds for a "departure," meaning the rare circumstance not contemplated by the guidelines. Guidelines-application litigation was time-consuming, tedious, and generally despised by trial and appellate judges. In 2005, the Supreme Court decided to construe the guidelines as mere recommendations which federal judges must consider, thus avoiding the Constitutional dilemma of the sentencing judge making findings of fact driving the sentence without a jury's input. Now, federal judges calculate and consider guidelines sentences, but make their own determination, taking into account the factors required by federal statute. Appellate courts review trial judges' sentences for "reasonableness," in which adherence to the guidelines is one factor. Sentences within the guidelines are presumed reasonable. Most federal judges tend to issue sentences close to the guidelines; some impose sentences below, but it's rarer to see one impose a sentence above. [1] excerpted from the much longer and funnier https://www.popehat.com/2013/02/05/crime-whale-sushi-sentence-eleventy-million-years/ https://www.popehat.com/2013/02/05/crime-whale-sushi-sentenc...
kobiton 7y ago
Dhdjdi
mevile 7y ago
I'm glad he was caught. Kudos to Microsoft's security team for their help catching him. If he was arrested in July 2019 after being dismissed in 2018 after the investigation began, I wonder why he didn't run then?
- londons_explore 7y ago
  Perhaps he was dismissed for some other unrelated reason? Or perhaps he was very confident in hiding the fact he was behind the scam? Ie. He might have just claimed someone else must have guessed his test account credentials because the password was "1234".
- duxup 7y ago
  I wonder what % of people would real put a serious effort into running and staying hidden long term. That's not a sure deal, and leaving the familiar for a life on the run / looking over your shoulder is a pretty big thing to consider.
TheLuddite 7y ago
Too bad that he was not from a serious country like Russia or China. He could've taken the money and went home and the US cannot deport him.
- AndriyKunitsyn 7y ago
  Ukraine also doesn't give up its citizens, just like Russia. Ukrainian and Russian hackers are often caught in their holiday trips abroad, when they relax from their money stealing activities. But that's the point of luxury life - it's easier to live it in US than in Ukraine. And why is that "bad"?
  - gdy 7y ago
    You need to change your constitution!
  - Bartweiss 7y ago
    It is interesting that he decided to stick around in Washington after ripping off Microsoft. He bought a $1.6M house there, so he presumably liked the area, but it seems like one hell of a risk. Even if he kept coming to the US or had his banked funds seized, locating hard assets like the house in Ukraine would do quite a bit to improve his odds of a good outcome. Among other things, a potential $250k fine on a $10M theft doesn't sound like much, but it's got to be tough to pay off with your assets seized and your career prospects crippled. Having some seizure-proof goods in another country would have made that a lot more manageable. Of course, the risk/reward on this sort of thing is usually crummy regardless, so maybe we shouldn't be surprised (much less disappointed) that the people involved tend to make some other risky choices.
zerr 7y ago
> initially worked for Microsoft as a contractor How do you find such contract work? (at BigCo's I mean)
- kiallmacinnes 7y ago
  Microsoft employs many contractors, we tend to call them "vendor staff" internally. More often than not these people will come from external companies who supply the staff, but they will be based on-site and embedded onto a team for the duration of their contract. Pretty sure I can't name any of our vendor companies, but you can take a guess at some of the bigger ones I'm sure.
  - deaddrop 7y ago
    >...we tend to call them "vendor staff" internally... There was a time when MSFT called them "dash trash". Good times. /s
    - Scuds 7y ago
      They still tend to get worked pretty hard, have no job security and don't get paid anywhere near as well.
  - juskrey 7y ago
    Not a big secret - just google largest Ukrainian IT companies (they are all outsourcing)
  - magashna 7y ago
    getting an auditing threat from a @v-microsoft.com accounts are pretty common
- deaddrop 7y ago
  >How do you find such contract work? It's a misnomer[0]. You usually find this work through vendor companies that actually hold the contracts with BigCo's. To the BigCo, you're a contractor but you're "technically" an FTE with the vendor company, who holds the actual contract (head count x duration) to work at the BigCo. [0] - https://en.wikipedia.org/wiki/Misnomer https://en.wikipedia.org/wiki/Misnomer
darkwater 7y ago
TBH the article looks a bit sensationalist. The $10m worth in CSV were sold obviously at a lower price, so it couldn't possibly make him 10 million US dollars; plus, they went through other black market resellers who I guess would take their cut.
- withinrafael 7y ago
  He net roughly 3 million USD dollars [1] after a bunch of resale activity, per complaint (case 2:19-mj-00321-PLM). [1] https://regmedia.co.uk/2019/07/17/us_v_kvashuk.pdf https://regmedia.co.uk/2019/07/17/us_v_kvashuk.pdf page 25
  - newyankee 7y ago
    Won't the IRS find sudden jumps in balance ? He must have had to pay taxes on this i guess. How else can he explain the source ?
    - pbhjpbhj 7y ago
      Bought Bitcoin and held it (offline wallet) for ~15 years?
      - newyankee 7y ago
        but then they will ask for blockchain transaction history to prove it ?
        pbhjpbhj 7y ago
        If you washed it, surely you can't do that?
    - withinrafael 7y ago
      Page 25 of the complaint (see parent post) also details how he didn't report the new income to the IRS and filed false returns. (Ouch.)
nobrains 7y ago
"... despite efforts to conceal his identity ... to hide public blockchain transactions using a Bitcoin mixing service." Does someone have details on what he was trying to do here and why did he have to use bitcoin mixing in the first place?
- candiodari 7y ago
  I imagine that if you do this, you'd sell gift cards for store currency in Bitcoin, and presumably also in cash. You'd probably want to avoid using bank transactions.
fareesh 7y ago
When he buys the stored-value stuff off the store using his test account and then the stored-value card is redeemed by like 100 other Xbox accounts, isn't that all the evidence you need? 1) Sale Transaction of stored-value currency linked to Dev 2) Stored-value currency redeemed and deposited into accounts linked to spaceninja888 on X-Box Live (100 other transactions like this) Isn't this sufficient evidence to prove he stole the money? Even if he gave it away for free, isn't it still fraud?
- homero 7y ago
  It was A test account, it wasn't exactly linked to him.
  - fareesh 7y ago
    did multiple users have access to it?
  - techslave 7y ago
    it was directly and uniquely linked to him.
- techslave 7y ago
  yes. that’s how they got him.
astura 7y ago
I think this is an example of "pigs get fat, hogs get slaughtered." Edit: if someone looks at a jail sentence and a $250,000 fine and decides stealing millions is still "worth it" even if you are caught, it's actually not. Judges order restitution to the defrauded, even if you can't realistically pay it. That means your assets will be seized (bye bye Tesla and house) and you'll never be able to build wealth ever again because any of your future wages will be garnished, forever, because you'll never be able to pay back that debt, which will be the amount you stole plus interest plus legal fees.
- ev0lv 7y ago
  He will likely just go to Ukraine after he gets released.
chiefalchemist 7y ago
> "In addition to service provider records that point to Kvashuk, the complaint notes that Microsoft's online store uses a form of device fingerprinting called a Fuzzy Device ID. Investigators, it's claimed, linked a specific device identifier to accounts associated with Kvashuk." 1) I guess he wasn't aware of this ID'ing. That's odd. 2) Fake accnts aside, I'd presume he used a VPN as well as other means to mitigate his trackability. But the FD ID can still work? Ouch. 3) If this is what MS can do, imagine what the NSA is dabbling in.
qaq 7y ago
They always forget the last step move to a country with no extradition to US
- koheripbal 7y ago
  How would he have convinced his wife and kids that that was necessary?
anonymous5133 7y ago
I've read the indictment and here are my comments on it: 1. Stop using google and related services. They log all your data forever (keyword searches). The FBI/governments are now going to google to get this data to use for investigation purposes. This is probably the same for any major internet company that records data (they all do). The only exception is for companies that pride themselves in having a "no logging" policy...maybe like duckduckgo. 2. Your computer can be tracked by its device characteristics. This is almost the same as your IP address or physical address to a certain extent. This was a significant part of the prosecution's evidence. You can use a USB bootable device like TAILs to potentially mitigate this risk. 3. The guy filed tax returns for something like 50-150k/year in taxable income. In certain years he had deposits into his bank account totaling $2.8 million.....I mean come on now...how do you think that's not going to raise a red flag...at least for the IRS? 4. BTC mixing services will not necessarily guarantee your privacy, especially if you are using KYC exchanges. Even if you are not doing anything illegal with your BTC...you'll still have to be able to explain where the money came from. This guy was going to use the excuse that his father gave him the BTC for free....and paid for all the BTC with cash. 5. If you're doing anything shady, for the love of god don't use a bank. Also if you are doing anything shady, don't use a KYC exchange. You're probably just better off staying entirely in crypto or selling the crypto for physical cash and just staying in cash. My overall impression is for the amount this guy stole, he planned it out very sloppily and made very little effort to EFFECTIVELY conceal his activity.
- smogcutter 7y ago
  At this point, basically your plan needs to end with "and then move to a non-extradition country" or you're fucked, sooner or later.

311 points by prostoalex 7y ago

rit 7y ago

Supporting test credit cards in production with no fraud or risk assessment. Do you want fraud? This is how you get fraud.

drawkbox 7y ago

Kvashuk, the complaint suggests, was undone by Microsoft's UST Fraud Investigation Strike Team (FIST), which noticed a suspicious increase in the use of CSV to buy subscriptions to Microsoft's Xbox gaming system in February 2018. The investigators traced the digital funds, which had been resold on two different websites, to two whitelisted test accounts. From there, FIST proceeded to trace the accounts and transactions involved. With the assistance of the US Secret Service and the Internal Revenue Service, investigators concluded that Kvashuk had defrauded Microsoft, despite efforts to conceal his identity with fake accounts and to hide public blockchain transactions using a Bitcoin mixing service. In addition to service provider records that point to Kvashuk, the complaint notes that Microsoft's online store uses a form of device fingerprinting called a Fuzzy Device ID. Investigators, it's claimed, linked a specific device identifier to accounts associated with Kvashuk. Pretty involved dissection, went all the way down to digital fingerprinting to catch it. The thief was smart about the hiding it, but not smart enough, but he had to know after $10m they would catch on. Reminds me of the McDonalds Monopoly game that the extended family of one of the people that worked at the printing place kept winning which was improbable, then expanded further where everyone would give them a cut of the winnings up to $24m [1]. > Jerome Jacobson and his network of mobsters, psychics, strip-club owners, and drug traffickers won almost every prize for 12 years, until the FBI launched Operation ‘Final Answer.’ Take $10m or $24m from a large corporation, someone is going to notice. [1] https://www.thedailybeast.com/how-an-ex-cop-rigged-mcdonalds-monopoly-game-and-stole-millions https://www.thedailybeast.com/how-an-ex-cop-rigged-mcdonalds...

iamnotacrook 7y ago
"he had to know after $10m they would catch on...Take $10m, someone is going to notice" You don't know that for every person caught after taking $10m there aren't 5 who took $100m then stopped and got away with it. It's just pure speculation.
- drawkbox 7y ago
  Possibly, in the McDonald Monopoly scam eventually the mob got involved, so maybe some are able to get away with it somewhere. But like in Office Space, when the account gets big enough it has to eventually be investigated and people aren't smart to run up a big amount but get greedy, whether they find the money or not who knows but someone will know.
- onion2k 7y ago
  You don't know that for every person caught after taking $10m there aren't 5 who took $100m then stopped and got away with it. It's just pure speculation. I'd assume a $100m hole in a company balance sheets when they get audited would make the news.
  - sverige 7y ago
    But if you're really smart, you might get away with over $10MM (in 1978 dollars!) without the bank noticing for eight days -- when the FBI told them. https://www.social-engineer.org/wiki/archives/Hackers/hackers-Mark-Rifkin-Social-Engineer-furtherInfo.htm https://www.social-engineer.org/wiki/archives/Hackers/hacker... https://en.m.wikipedia.org/wiki/Stanley_Mark_Rifkin https://en.m.wikipedia.org/wiki/Stanley_Mark_Rifkin https://coolinterestingstuff.com/worlds-biggest-heists-stanley-rifkins-10-million https://coolinterestingstuff.com/worlds-biggest-heists-stanl...
    - captn3m0 7y ago
      Punjab National Bank, a state-owned bank in India ~lost $1.4B, without knowing about it for more than a year. ~lost is somehwhat vague because all it involved was a Letter of Undertaking that was a "promise" by the bank to return that money. They did honor it, losing billions of dollars. [0]: https://en.wikipedia.org/wiki/Punjab_National_Bank_Scam https://en.wikipedia.org/wiki/Punjab_National_Bank_Scam [1]: https://economictimes.indiatimes.com/news/international/obama-says-new-budget-rules-will-rein-in-spending/an-evergreen-lou-story-how-shetty-co-pulled-the-pnb-con/articleshow/63163744.cms https://economictimes.indiatimes.com/news/international/obam...
gingabriska 7y ago
>The thief was smart about the hiding it, but not smart enough I am interested in knowing in what ways he could have never been caught? What did he miss?
- ars 7y ago
  He should have slowed down maybe. Also got greedy - he could have had 1 million and live on the interest, but he had to keep going.
  - tuananh 7y ago
    he sold it for much cheaper value. 10m could have been sold for 1 or 2m
  - brianwawok 7y ago
    Most people over-estimate the long term life of a million dollars in 2019. Standard wisdom gives you the 4% rule.. i.e. you can spend 4% of a balance to have a principle last forever (Based on historic stock market data, no guarantee it will actually work in the future). 4% of a million is only 40k. Can you live on 40k a year? Yes, billions of people make less than or equal to 40k a year. However most software devs like this guy who was making over 100k a year would be "content" to retire on 40k a year. He would need at least 3 million to live on the 120k a year ;)
    - bduerst 7y ago
      This is also handy napkin math for retirement.
      - justsid 7y ago
        More like handy napkin math to figure out that my retirement plan is going to involve me dying young.
        brianwawok 7y ago
anonymous5133 7y ago
Using a bitcoin washing service and then sending the proceeds from the bitcoin transactions to your bank account is not exactly trying to conceal the activity.
- darkpuma 7y ago
  Trying ineptly is still trying.
- blaser-waffle 7y ago
  So then what is the play? Send it to someone else's bank account?
  - magashna 7y ago
    Monero laundering, or holding it for a while. Get too greedy and move too quickly, likely to stumble
    - bduerst 7y ago
      Are there any reliable and trustworthy Monero exchanges that allow anonymity? Not even Coinbase supports Monero, and Kraken requires identification.
    - darkpuma 7y ago
      > "or holding it for a while." I wonder if the FBI has an automated system for monitoring bitcoin addresses that are associated with investigations that went cold possibly years ago, and as such no longer have the active attention of any [human] agents. Probably, right? It seems like it would be a good idea anyway.
mtgx 7y ago
> Take $10m or $24m from a large corporation, someone is going to notice. This is the problem with stealing "easy money." It's hard to stop, especially if you don't spend the first portion of money wisely. It's why card skimmers always get caught, too, eventually. They can't just steal $100,000 and be done with it. That's barely enough for a fully loaded Tesla Model S. They have to keep on stealing, and after a few years of this, are you really going to go back to a 9-5 job paying you $30,000 or less a year for hard work? So it's not really about criminals "being dumb" about continuing to steal the money, unless you define being dumb the moment they first did it. It's more about them feeling like they have no choice but to keep doing it.
- zulln 7y ago
  > It's why card skimmers always get caught, too, eventually. Given how much money actually is estimated to be skimmed and how few that actually get caught I doubt this.
- gwd 7y ago
  > This is the problem with stealing "easy money." It's hard to stop, especially if you don't spend the first portion of money wisely. Plus there's a weird psychological effect in some people where they feel guilty and actually want to get caught. A few years ago I dropped my wallet somewhere, and someone picked it up and used the contactless cards a couple times. They caught him when, the next day, he was shouting and threatening people and generally acting obnoxious, and was arrested with my wallet (complete with my photo ID) still on him. Why did the guy suddenly get himself arrested? Why didn't he at least get rid of the wallet first? Maybe there's no connection between the two, but people are complicated.
  - IG_Semmelweiss 7y ago
    No. Has nothing to do with psychology. The name for this in statistics is ergodicity. Nassim Taleb, an expert on this subject, as well as many other authors in risk management have established that even professionals in statistics fare very poorly in understanding ergodicity in real life. In short , its not psych, its human nature
sametmax 7y ago
There are two technical interesting take aways in this: 1 - Microsoft, and probably most big companies, have persistent tracking ID on most stuff that are hard to get rid of and can be used to identify you and devices linked to you in a fuzzy way. I mean, we know about super cookies, fingerprinting and such, but it's another to hear it being used to track somebody that was careful and using multiple anonymous accounts. 2 - BTC mixers will not protect you. Correlating one single wallet with you will make it possible to them retrace the entire history.
- homero 7y ago
  Well Microsoft has access to full hardware IDs on PC and Xbox.
- samdoidge 7y ago
  As for 2, I would have thought one of the privacy coins could have been utilised: Buy Monero with Biticoin -> Transfer Monero to another wallet -> Buy Bitcoin with Monero. But I guess it isn't that easy.
  - sametmax 7y ago
    Most exhanges ask for KYC, so the BTC wallet would still be attached to your ID. You need to do that with individuals, which is much harder, especially for a high amount of money. Not saying this is impossible, but it's no as simple as it used to be.
    - deleted 7y ago
      [deleted]
  - magnamerc 7y ago
    Apparently this also breaks Moneros privacy by identifying a BTC address associated it (even without KYC). You need to buy Monero from LocalMonero if you want to be truly private.
- buildzr 7y ago
  > BTC mixers will not protect you. Correlating one single wallet with you will make it possible to them retrace the entire history. It's also possible they both knew the address which was paid out to buy the stolen merchandise and they saw he had withdrawals from a bitcoin exchange in bank records. Given these two facts, it's pretty easy to draw a line between them even when mixers are used. But if you don't already know who to suspect this is much harder to do.
duxup 7y ago
From a technical standpoint I wonder what the developer who is stealing is thinking. I've worked lots of places with access to lots of things. I have technical know how and presumably so does he. Even if I was inclined to do something like this I know that many of my coworkers / people at the company ... are more than capable of tracking down most anything if given enough attention. The first and best protection I could think of is simply the volume of what is stolen to keep from being noticed. Once noticed with sufficient motivation it's just a matter of time.
- pbhjpbhj 7y ago
  There's lots of things that could impair his reasoning (drink, gambling, other emotional stress, illness), or it could be motivated by revenge, or ...
- fragmede 7y ago
  Reading between the lines, the article says they got away with it for months, and were only caught because they got greedy - to the tune of a luxury car and a mansion! This smells like a crime of opportunity; most crimes aren't throughly-planned, well-executed Hollywood-grade bank heists - or their digital equivalent, so there also isn't a thoroughly planned exit strategy to a non-extradition country, just a vague notion that something will happen, eventually. Possibly getting caught.
  - toyg 7y ago
    > most crimes aren't throughly-planned, well-executed Hollywood-grade bank heists And this is why Crime and Punishment is an ageless masterpiece of literature.
johnbrodie 7y ago
The explanation in the article is fairly well done. One thing I can't help but think whenever there are more involved processes for catching someone though, is that we'll never know if that was the actual method used. For a large enough case, they could utilize some other, more secretive method, and then parallel construct this (believable) one, with the benefit of already knowing the final answer. Not something I'm saying _happened_ here, but certainly something I think everyone should keep in mind when they read these types of cases.
dd36 7y ago
We only know about the times it is noticed.

0n34n7 7y ago

Silly billy

martin_ 7y ago

> If convicted of mail fraud, the former Microsoft software engineer could face as much as 20 years in prison and a $250,000 fine. It doesn't mention returning what he took... So he steals over 10m and buys a 1.6m house and can only be fined up to $250k? With 20 years in prison, and let's say out in 10 years of good behavior wouldn't that raise his annual income (which is taxed) from $116,000 to north of $1m?

brianwawok 7y ago
He won’t get to keep it
rahimnathwani 7y ago
Fines are punishment. Restitution/compensation is separate.
- pkilgore 7y ago
  This. Also, as an attorney, I view all descriptions of possible sentences with extreme skepticism. A hyperbolic explanation [1] so I don't have to retype something similar: > Federal sentences are calculated using the United States Sentencing Guidelines. The guidelines are a very complex set of rules used to calculate a federal sentence based upon the crime charged, the circumstances of the case, and the criminal record of the defendant. Calculating a very simple sentence is like completing a very simple tax return under, say, 1040-EZ; a complex sentence is like completing a tax return for a troubled entity engaged in questionable tax practices. Or, for you old-school geeks, like creating a Runequest character for a friend who is an argumentative rules-lawyer. From the enactment of the guidelines in the 1980s until United States v. Booker in 2005, the guidelines were binding upon federal judges — they had to follow the guidelines unless there were grounds for a "departure," meaning the rare circumstance not contemplated by the guidelines. Guidelines-application litigation was time-consuming, tedious, and generally despised by trial and appellate judges. In 2005, the Supreme Court decided to construe the guidelines as mere recommendations which federal judges must consider, thus avoiding the Constitutional dilemma of the sentencing judge making findings of fact driving the sentence without a jury's input. Now, federal judges calculate and consider guidelines sentences, but make their own determination, taking into account the factors required by federal statute. Appellate courts review trial judges' sentences for "reasonableness," in which adherence to the guidelines is one factor. Sentences within the guidelines are presumed reasonable. Most federal judges tend to issue sentences close to the guidelines; some impose sentences below, but it's rarer to see one impose a sentence above. [1] excerpted from the much longer and funnier https://www.popehat.com/2013/02/05/crime-whale-sushi-sentence-eleventy-million-years/ https://www.popehat.com/2013/02/05/crime-whale-sushi-sentenc...

kobiton 7y ago

Dhdjdi

mevile 7y ago

I'm glad he was caught. Kudos to Microsoft's security team for their help catching him. If he was arrested in July 2019 after being dismissed in 2018 after the investigation began, I wonder why he didn't run then?

londons_explore 7y ago
Perhaps he was dismissed for some other unrelated reason? Or perhaps he was very confident in hiding the fact he was behind the scam? Ie. He might have just claimed someone else must have guessed his test account credentials because the password was "1234".
duxup 7y ago
I wonder what % of people would real put a serious effort into running and staying hidden long term. That's not a sure deal, and leaving the familiar for a life on the run / looking over your shoulder is a pretty big thing to consider.

TheLuddite 7y ago

Too bad that he was not from a serious country like Russia or China. He could've taken the money and went home and the US cannot deport him.

AndriyKunitsyn 7y ago
Ukraine also doesn't give up its citizens, just like Russia. Ukrainian and Russian hackers are often caught in their holiday trips abroad, when they relax from their money stealing activities. But that's the point of luxury life - it's easier to live it in US than in Ukraine. And why is that "bad"?
- gdy 7y ago
  You need to change your constitution!
- Bartweiss 7y ago
  It is interesting that he decided to stick around in Washington after ripping off Microsoft. He bought a $1.6M house there, so he presumably liked the area, but it seems like one hell of a risk. Even if he kept coming to the US or had his banked funds seized, locating hard assets like the house in Ukraine would do quite a bit to improve his odds of a good outcome. Among other things, a potential $250k fine on a $10M theft doesn't sound like much, but it's got to be tough to pay off with your assets seized and your career prospects crippled. Having some seizure-proof goods in another country would have made that a lot more manageable. Of course, the risk/reward on this sort of thing is usually crummy regardless, so maybe we shouldn't be surprised (much less disappointed) that the people involved tend to make some other risky choices.

zerr 7y ago

> initially worked for Microsoft as a contractor How do you find such contract work? (at BigCo's I mean)

kiallmacinnes 7y ago
Microsoft employs many contractors, we tend to call them "vendor staff" internally. More often than not these people will come from external companies who supply the staff, but they will be based on-site and embedded onto a team for the duration of their contract. Pretty sure I can't name any of our vendor companies, but you can take a guess at some of the bigger ones I'm sure.
- deaddrop 7y ago
  >...we tend to call them "vendor staff" internally... There was a time when MSFT called them "dash trash". Good times. /s
  - Scuds 7y ago
    They still tend to get worked pretty hard, have no job security and don't get paid anywhere near as well.
- juskrey 7y ago
  Not a big secret - just google largest Ukrainian IT companies (they are all outsourcing)
- magashna 7y ago
  getting an auditing threat from a @v-microsoft.com accounts are pretty common
deaddrop 7y ago
>How do you find such contract work? It's a misnomer[0]. You usually find this work through vendor companies that actually hold the contracts with BigCo's. To the BigCo, you're a contractor but you're "technically" an FTE with the vendor company, who holds the actual contract (head count x duration) to work at the BigCo. [0] - https://en.wikipedia.org/wiki/Misnomer https://en.wikipedia.org/wiki/Misnomer

darkwater 7y ago

TBH the article looks a bit sensationalist. The $10m worth in CSV were sold obviously at a lower price, so it couldn't possibly make him 10 million US dollars; plus, they went through other black market resellers who I guess would take their cut.

withinrafael 7y ago
He net roughly 3 million USD dollars [1] after a bunch of resale activity, per complaint (case 2:19-mj-00321-PLM). [1] https://regmedia.co.uk/2019/07/17/us_v_kvashuk.pdf https://regmedia.co.uk/2019/07/17/us_v_kvashuk.pdf page 25
- newyankee 7y ago
  Won't the IRS find sudden jumps in balance ? He must have had to pay taxes on this i guess. How else can he explain the source ?
  - pbhjpbhj 7y ago
    Bought Bitcoin and held it (offline wallet) for ~15 years?
    - newyankee 7y ago
      but then they will ask for blockchain transaction history to prove it ?
      - pbhjpbhj 7y ago
        If you washed it, surely you can't do that?
  - withinrafael 7y ago
    Page 25 of the complaint (see parent post) also details how he didn't report the new income to the IRS and filed false returns. (Ouch.)

nobrains 7y ago

"... despite efforts to conceal his identity ... to hide public blockchain transactions using a Bitcoin mixing service." Does someone have details on what he was trying to do here and why did he have to use bitcoin mixing in the first place?

candiodari 7y ago
I imagine that if you do this, you'd sell gift cards for store currency in Bitcoin, and presumably also in cash. You'd probably want to avoid using bank transactions.

fareesh 7y ago

When he buys the stored-value stuff off the store using his test account and then the stored-value card is redeemed by like 100 other Xbox accounts, isn't that all the evidence you need? 1) Sale Transaction of stored-value currency linked to Dev 2) Stored-value currency redeemed and deposited into accounts linked to spaceninja888 on X-Box Live (100 other transactions like this) Isn't this sufficient evidence to prove he stole the money? Even if he gave it away for free, isn't it still fraud?

homero 7y ago
It was A test account, it wasn't exactly linked to him.
- fareesh 7y ago
  did multiple users have access to it?
- techslave 7y ago
  it was directly and uniquely linked to him.
techslave 7y ago
yes. that’s how they got him.

astura 7y ago

I think this is an example of "pigs get fat, hogs get slaughtered." Edit: if someone looks at a jail sentence and a $250,000 fine and decides stealing millions is still "worth it" even if you are caught, it's actually not. Judges order restitution to the defrauded, even if you can't realistically pay it. That means your assets will be seized (bye bye Tesla and house) and you'll never be able to build wealth ever again because any of your future wages will be garnished, forever, because you'll never be able to pay back that debt, which will be the amount you stole plus interest plus legal fees.

ev0lv 7y ago
He will likely just go to Ukraine after he gets released.

chiefalchemist 7y ago

> "In addition to service provider records that point to Kvashuk, the complaint notes that Microsoft's online store uses a form of device fingerprinting called a Fuzzy Device ID. Investigators, it's claimed, linked a specific device identifier to accounts associated with Kvashuk." 1) I guess he wasn't aware of this ID'ing. That's odd. 2) Fake accnts aside, I'd presume he used a VPN as well as other means to mitigate his trackability. But the FD ID can still work? Ouch. 3) If this is what MS can do, imagine what the NSA is dabbling in.

qaq 7y ago

They always forget the last step move to a country with no extradition to US

koheripbal 7y ago
How would he have convinced his wife and kids that that was necessary?

anonymous5133 7y ago

I've read the indictment and here are my comments on it: 1. Stop using google and related services. They log all your data forever (keyword searches). The FBI/governments are now going to google to get this data to use for investigation purposes. This is probably the same for any major internet company that records data (they all do). The only exception is for companies that pride themselves in having a "no logging" policy...maybe like duckduckgo. 2. Your computer can be tracked by its device characteristics. This is almost the same as your IP address or physical address to a certain extent. This was a significant part of the prosecution's evidence. You can use a USB bootable device like TAILs to potentially mitigate this risk. 3. The guy filed tax returns for something like 50-150k/year in taxable income. In certain years he had deposits into his bank account totaling $2.8 million.....I mean come on now...how do you think that's not going to raise a red flag...at least for the IRS? 4. BTC mixing services will not necessarily guarantee your privacy, especially if you are using KYC exchanges. Even if you are not doing anything illegal with your BTC...you'll still have to be able to explain where the money came from. This guy was going to use the excuse that his father gave him the BTC for free....and paid for all the BTC with cash. 5. If you're doing anything shady, for the love of god don't use a bank. Also if you are doing anything shady, don't use a KYC exchange. You're probably just better off staying entirely in crypto or selling the crypto for physical cash and just staying in cash. My overall impression is for the amount this guy stole, he planned it out very sloppily and made very little effort to EFFECTIVELY conceal his activity.

smogcutter 7y ago
At this point, basically your plan needs to end with "and then move to a non-extradition country" or you're fucked, sooner or later.