9 ms·

Kvashuk, the complaint suggests, was undone by Microsoft's UST Fraud Investigation Strike Team (FIST), which noticed a suspicious increase in the use of CSV to

Kvashuk, the complaint suggests, was undone by Microsoft's UST Fraud Investigation Strike Team (FIST), which noticed a suspicious increase in the use of CSV to buy subscriptions to Microsoft's Xbox gaming system in February 2018. The investigators traced the digital funds, which had been resold on two different websites, to two whitelisted test accounts. From there, FIST proceeded to trace the accounts and transactions involved. With the assistance of the US Secret Service and the Internal Revenue Service, investigators concluded that Kvashuk had defrauded Microsoft, despite efforts to conceal his identity with fake accounts and to hide public blockchain transactions using a Bitcoin mixing service. In addition to service provider records that point to Kvashuk, the complaint notes that Microsoft's online store uses a form of device fingerprinting called a Fuzzy Device ID. Investigators, it's claimed, linked a specific device identifier to accounts associated with Kvashuk. Pretty involved dissection, went all the way down to digital fingerprinting to catch it. The thief was smart about the hiding it, but not smart enough, but he had to know after $10m they would catch on. Reminds me of the McDonalds Monopoly game that the extended family of one of the people that worked at the printing place kept winning which was improbable, then expanded further where everyone would give them a cut of the winnings up to $24m [1]. > Jerome Jacobson and his network of mobsters, psychics, strip-club owners, and drug traffickers won almost every prize for 12 years, until the FBI launched Operation ‘Final Answer.’ Take $10m or $24m from a large corporation, someone is going to notice. [1] https://www.thedailybeast.com/how-an-ex-cop-rigged-mcdonalds-monopoly-game-and-stole-millions https://www.thedailybeast.com/how-an-ex-cop-rigged-mcdonalds...

iamnotacrook 7y ago
"he had to know after $10m they would catch on...Take $10m, someone is going to notice" You don't know that for every person caught after taking $10m there aren't 5 who took $100m then stopped and got away with it. It's just pure speculation.
- drawkbox 7y ago
  Possibly, in the McDonald Monopoly scam eventually the mob got involved, so maybe some are able to get away with it somewhere. But like in Office Space, when the account gets big enough it has to eventually be investigated and people aren't smart to run up a big amount but get greedy, whether they find the money or not who knows but someone will know.
- onion2k 7y ago
  You don't know that for every person caught after taking $10m there aren't 5 who took $100m then stopped and got away with it. It's just pure speculation. I'd assume a $100m hole in a company balance sheets when they get audited would make the news.
  - sverige 7y ago
    But if you're really smart, you might get away with over $10MM (in 1978 dollars!) without the bank noticing for eight days -- when the FBI told them. https://www.social-engineer.org/wiki/archives/Hackers/hackers-Mark-Rifkin-Social-Engineer-furtherInfo.htm https://www.social-engineer.org/wiki/archives/Hackers/hacker... https://en.m.wikipedia.org/wiki/Stanley_Mark_Rifkin https://en.m.wikipedia.org/wiki/Stanley_Mark_Rifkin https://coolinterestingstuff.com/worlds-biggest-heists-stanley-rifkins-10-million https://coolinterestingstuff.com/worlds-biggest-heists-stanl...
    - captn3m0 7y ago
      Punjab National Bank, a state-owned bank in India ~lost $1.4B, without knowing about it for more than a year. ~lost is somehwhat vague because all it involved was a Letter of Undertaking that was a "promise" by the bank to return that money. They did honor it, losing billions of dollars. [0]: https://en.wikipedia.org/wiki/Punjab_National_Bank_Scam https://en.wikipedia.org/wiki/Punjab_National_Bank_Scam [1]: https://economictimes.indiatimes.com/news/international/obama-says-new-budget-rules-will-rein-in-spending/an-evergreen-lou-story-how-shetty-co-pulled-the-pnb-con/articleshow/63163744.cms https://economictimes.indiatimes.com/news/international/obam...
  - JOnAgain 7y ago
    If they found it. Big company get so complex i don’t think that’s a given. It’s not like they’d be kissing $100m from a single bank account and just be like, that number is low.
    - mygo 7y ago
      this is why you have balance sheets. it would have been caught by the time the accountants needed to figure out total balances and payables and receivables.
- bduerst 7y ago
  Yes, it would be survivor bias, but usually publicly-traded companies have a fiduciary duty to report these types of theft, even if they don't know who committed them.
- ricktdotorg 7y ago
  a recent example where the guy got away with nearly $40m over a number of years. internal billing scam https://www.justice.gov/usao-cdca/pr/ex-accounting-manager-charged-embezzling-36-million-company-client-has-been-extradited https://www.justice.gov/usao-cdca/pr/ex-accounting-manager-c...
gingabriska 7y ago
>The thief was smart about the hiding it, but not smart enough I am interested in knowing in what ways he could have never been caught? What did he miss?
- ars 7y ago
  He should have slowed down maybe. Also got greedy - he could have had 1 million and live on the interest, but he had to keep going.
  - tuananh 7y ago
    he sold it for much cheaper value. 10m could have been sold for 1 or 2m
  - brianwawok 7y ago
    Most people over-estimate the long term life of a million dollars in 2019. Standard wisdom gives you the 4% rule.. i.e. you can spend 4% of a balance to have a principle last forever (Based on historic stock market data, no guarantee it will actually work in the future). 4% of a million is only 40k. Can you live on 40k a year? Yes, billions of people make less than or equal to 40k a year. However most software devs like this guy who was making over 100k a year would be "content" to retire on 40k a year. He would need at least 3 million to live on the 120k a year ;)
    - bduerst 7y ago
      This is also handy napkin math for retirement.
      - justsid 7y ago
        More like handy napkin math to figure out that my retirement plan is going to involve me dying young.
        brianwawok 7y ago
anonymous5133 7y ago
Using a bitcoin washing service and then sending the proceeds from the bitcoin transactions to your bank account is not exactly trying to conceal the activity.
- darkpuma 7y ago
  Trying ineptly is still trying.
- blaser-waffle 7y ago
  So then what is the play? Send it to someone else's bank account?
  - magashna 7y ago
    Monero laundering, or holding it for a while. Get too greedy and move too quickly, likely to stumble
    - bduerst 7y ago
      Are there any reliable and trustworthy Monero exchanges that allow anonymity? Not even Coinbase supports Monero, and Kraken requires identification.
    - darkpuma 7y ago
      > "or holding it for a while." I wonder if the FBI has an automated system for monitoring bitcoin addresses that are associated with investigations that went cold possibly years ago, and as such no longer have the active attention of any [human] agents. Probably, right? It seems like it would be a good idea anyway.
mtgx 7y ago
> Take $10m or $24m from a large corporation, someone is going to notice. This is the problem with stealing "easy money." It's hard to stop, especially if you don't spend the first portion of money wisely. It's why card skimmers always get caught, too, eventually. They can't just steal $100,000 and be done with it. That's barely enough for a fully loaded Tesla Model S. They have to keep on stealing, and after a few years of this, are you really going to go back to a 9-5 job paying you $30,000 or less a year for hard work? So it's not really about criminals "being dumb" about continuing to steal the money, unless you define being dumb the moment they first did it. It's more about them feeling like they have no choice but to keep doing it.
- zulln 7y ago
  > It's why card skimmers always get caught, too, eventually. Given how much money actually is estimated to be skimmed and how few that actually get caught I doubt this.
- gwd 7y ago
  > This is the problem with stealing "easy money." It's hard to stop, especially if you don't spend the first portion of money wisely. Plus there's a weird psychological effect in some people where they feel guilty and actually want to get caught. A few years ago I dropped my wallet somewhere, and someone picked it up and used the contactless cards a couple times. They caught him when, the next day, he was shouting and threatening people and generally acting obnoxious, and was arrested with my wallet (complete with my photo ID) still on him. Why did the guy suddenly get himself arrested? Why didn't he at least get rid of the wallet first? Maybe there's no connection between the two, but people are complicated.
  - IG_Semmelweiss 7y ago
    No. Has nothing to do with psychology. The name for this in statistics is ergodicity. Nassim Taleb, an expert on this subject, as well as many other authors in risk management have established that even professionals in statistics fare very poorly in understanding ergodicity in real life. In short , its not psych, its human nature
sametmax 7y ago
There are two technical interesting take aways in this: 1 - Microsoft, and probably most big companies, have persistent tracking ID on most stuff that are hard to get rid of and can be used to identify you and devices linked to you in a fuzzy way. I mean, we know about super cookies, fingerprinting and such, but it's another to hear it being used to track somebody that was careful and using multiple anonymous accounts. 2 - BTC mixers will not protect you. Correlating one single wallet with you will make it possible to them retrace the entire history.
- homero 7y ago
  Well Microsoft has access to full hardware IDs on PC and Xbox.
- samdoidge 7y ago
  As for 2, I would have thought one of the privacy coins could have been utilised: Buy Monero with Biticoin -> Transfer Monero to another wallet -> Buy Bitcoin with Monero. But I guess it isn't that easy.
  - sametmax 7y ago
    Most exhanges ask for KYC, so the BTC wallet would still be attached to your ID. You need to do that with individuals, which is much harder, especially for a high amount of money. Not saying this is impossible, but it's no as simple as it used to be.
    - deleted 7y ago
      [deleted]
  - magnamerc 7y ago
    Apparently this also breaks Moneros privacy by identifying a BTC address associated it (even without KYC). You need to buy Monero from LocalMonero if you want to be truly private.
- buildzr 7y ago
  > BTC mixers will not protect you. Correlating one single wallet with you will make it possible to them retrace the entire history. It's also possible they both knew the address which was paid out to buy the stolen merchandise and they saw he had withdrawals from a bitcoin exchange in bank records. Given these two facts, it's pretty easy to draw a line between them even when mixers are used. But if you don't already know who to suspect this is much harder to do.
duxup 7y ago
From a technical standpoint I wonder what the developer who is stealing is thinking. I've worked lots of places with access to lots of things. I have technical know how and presumably so does he. Even if I was inclined to do something like this I know that many of my coworkers / people at the company ... are more than capable of tracking down most anything if given enough attention. The first and best protection I could think of is simply the volume of what is stolen to keep from being noticed. Once noticed with sufficient motivation it's just a matter of time.
- pbhjpbhj 7y ago
  There's lots of things that could impair his reasoning (drink, gambling, other emotional stress, illness), or it could be motivated by revenge, or ...
- fragmede 7y ago
  Reading between the lines, the article says they got away with it for months, and were only caught because they got greedy - to the tune of a luxury car and a mansion! This smells like a crime of opportunity; most crimes aren't throughly-planned, well-executed Hollywood-grade bank heists - or their digital equivalent, so there also isn't a thoroughly planned exit strategy to a non-extradition country, just a vague notion that something will happen, eventually. Possibly getting caught.
  - toyg 7y ago
    > most crimes aren't throughly-planned, well-executed Hollywood-grade bank heists And this is why Crime and Punishment is an ageless masterpiece of literature.
johnbrodie 7y ago
The explanation in the article is fairly well done. One thing I can't help but think whenever there are more involved processes for catching someone though, is that we'll never know if that was the actual method used. For a large enough case, they could utilize some other, more secretive method, and then parallel construct this (believable) one, with the benefit of already knowing the final answer. Not something I'm saying _happened_ here, but certainly something I think everyone should keep in mind when they read these types of cases.
dd36 7y ago
We only know about the times it is noticed.

iamnotacrook 7y ago

"he had to know after $10m they would catch on...Take $10m, someone is going to notice" You don't know that for every person caught after taking $10m there aren't 5 who took $100m then stopped and got away with it. It's just pure speculation.

drawkbox 7y ago
Possibly, in the McDonald Monopoly scam eventually the mob got involved, so maybe some are able to get away with it somewhere. But like in Office Space, when the account gets big enough it has to eventually be investigated and people aren't smart to run up a big amount but get greedy, whether they find the money or not who knows but someone will know.
onion2k 7y ago
You don't know that for every person caught after taking $10m there aren't 5 who took $100m then stopped and got away with it. It's just pure speculation. I'd assume a $100m hole in a company balance sheets when they get audited would make the news.
- sverige 7y ago
  But if you're really smart, you might get away with over $10MM (in 1978 dollars!) without the bank noticing for eight days -- when the FBI told them. https://www.social-engineer.org/wiki/archives/Hackers/hackers-Mark-Rifkin-Social-Engineer-furtherInfo.htm https://www.social-engineer.org/wiki/archives/Hackers/hacker... https://en.m.wikipedia.org/wiki/Stanley_Mark_Rifkin https://en.m.wikipedia.org/wiki/Stanley_Mark_Rifkin https://coolinterestingstuff.com/worlds-biggest-heists-stanley-rifkins-10-million https://coolinterestingstuff.com/worlds-biggest-heists-stanl...
  - captn3m0 7y ago
    Punjab National Bank, a state-owned bank in India ~lost $1.4B, without knowing about it for more than a year. ~lost is somehwhat vague because all it involved was a Letter of Undertaking that was a "promise" by the bank to return that money. They did honor it, losing billions of dollars. [0]: https://en.wikipedia.org/wiki/Punjab_National_Bank_Scam https://en.wikipedia.org/wiki/Punjab_National_Bank_Scam [1]: https://economictimes.indiatimes.com/news/international/obama-says-new-budget-rules-will-rein-in-spending/an-evergreen-lou-story-how-shetty-co-pulled-the-pnb-con/articleshow/63163744.cms https://economictimes.indiatimes.com/news/international/obam...
- JOnAgain 7y ago
  If they found it. Big company get so complex i don’t think that’s a given. It’s not like they’d be kissing $100m from a single bank account and just be like, that number is low.
  - mygo 7y ago
    this is why you have balance sheets. it would have been caught by the time the accountants needed to figure out total balances and payables and receivables.
bduerst 7y ago
Yes, it would be survivor bias, but usually publicly-traded companies have a fiduciary duty to report these types of theft, even if they don't know who committed them.
ricktdotorg 7y ago
a recent example where the guy got away with nearly $40m over a number of years. internal billing scam https://www.justice.gov/usao-cdca/pr/ex-accounting-manager-charged-embezzling-36-million-company-client-has-been-extradited https://www.justice.gov/usao-cdca/pr/ex-accounting-manager-c...

gingabriska 7y ago

>The thief was smart about the hiding it, but not smart enough I am interested in knowing in what ways he could have never been caught? What did he miss?

ars 7y ago
He should have slowed down maybe. Also got greedy - he could have had 1 million and live on the interest, but he had to keep going.
- tuananh 7y ago
  he sold it for much cheaper value. 10m could have been sold for 1 or 2m
- brianwawok 7y ago
  Most people over-estimate the long term life of a million dollars in 2019. Standard wisdom gives you the 4% rule.. i.e. you can spend 4% of a balance to have a principle last forever (Based on historic stock market data, no guarantee it will actually work in the future). 4% of a million is only 40k. Can you live on 40k a year? Yes, billions of people make less than or equal to 40k a year. However most software devs like this guy who was making over 100k a year would be "content" to retire on 40k a year. He would need at least 3 million to live on the 120k a year ;)
  - bduerst 7y ago
    This is also handy napkin math for retirement.
    - justsid 7y ago
      More like handy napkin math to figure out that my retirement plan is going to involve me dying young.
      - brianwawok 7y ago

anonymous5133 7y ago

Using a bitcoin washing service and then sending the proceeds from the bitcoin transactions to your bank account is not exactly trying to conceal the activity.

darkpuma 7y ago
Trying ineptly is still trying.
blaser-waffle 7y ago
So then what is the play? Send it to someone else's bank account?
- magashna 7y ago
  Monero laundering, or holding it for a while. Get too greedy and move too quickly, likely to stumble
  - bduerst 7y ago
    Are there any reliable and trustworthy Monero exchanges that allow anonymity? Not even Coinbase supports Monero, and Kraken requires identification.
  - darkpuma 7y ago
    > "or holding it for a while." I wonder if the FBI has an automated system for monitoring bitcoin addresses that are associated with investigations that went cold possibly years ago, and as such no longer have the active attention of any [human] agents. Probably, right? It seems like it would be a good idea anyway.

mtgx 7y ago

> Take $10m or $24m from a large corporation, someone is going to notice. This is the problem with stealing "easy money." It's hard to stop, especially if you don't spend the first portion of money wisely. It's why card skimmers always get caught, too, eventually. They can't just steal $100,000 and be done with it. That's barely enough for a fully loaded Tesla Model S. They have to keep on stealing, and after a few years of this, are you really going to go back to a 9-5 job paying you $30,000 or less a year for hard work? So it's not really about criminals "being dumb" about continuing to steal the money, unless you define being dumb the moment they first did it. It's more about them feeling like they have no choice but to keep doing it.

zulln 7y ago
> It's why card skimmers always get caught, too, eventually. Given how much money actually is estimated to be skimmed and how few that actually get caught I doubt this.
gwd 7y ago
> This is the problem with stealing "easy money." It's hard to stop, especially if you don't spend the first portion of money wisely. Plus there's a weird psychological effect in some people where they feel guilty and actually want to get caught. A few years ago I dropped my wallet somewhere, and someone picked it up and used the contactless cards a couple times. They caught him when, the next day, he was shouting and threatening people and generally acting obnoxious, and was arrested with my wallet (complete with my photo ID) still on him. Why did the guy suddenly get himself arrested? Why didn't he at least get rid of the wallet first? Maybe there's no connection between the two, but people are complicated.
- IG_Semmelweiss 7y ago
  No. Has nothing to do with psychology. The name for this in statistics is ergodicity. Nassim Taleb, an expert on this subject, as well as many other authors in risk management have established that even professionals in statistics fare very poorly in understanding ergodicity in real life. In short , its not psych, its human nature

sametmax 7y ago

There are two technical interesting take aways in this: 1 - Microsoft, and probably most big companies, have persistent tracking ID on most stuff that are hard to get rid of and can be used to identify you and devices linked to you in a fuzzy way. I mean, we know about super cookies, fingerprinting and such, but it's another to hear it being used to track somebody that was careful and using multiple anonymous accounts. 2 - BTC mixers will not protect you. Correlating one single wallet with you will make it possible to them retrace the entire history.

homero 7y ago
Well Microsoft has access to full hardware IDs on PC and Xbox.
samdoidge 7y ago
As for 2, I would have thought one of the privacy coins could have been utilised: Buy Monero with Biticoin -> Transfer Monero to another wallet -> Buy Bitcoin with Monero. But I guess it isn't that easy.
- sametmax 7y ago
  Most exhanges ask for KYC, so the BTC wallet would still be attached to your ID. You need to do that with individuals, which is much harder, especially for a high amount of money. Not saying this is impossible, but it's no as simple as it used to be.
  - deleted 7y ago
    [deleted]
- magnamerc 7y ago
  Apparently this also breaks Moneros privacy by identifying a BTC address associated it (even without KYC). You need to buy Monero from LocalMonero if you want to be truly private.
buildzr 7y ago
> BTC mixers will not protect you. Correlating one single wallet with you will make it possible to them retrace the entire history. It's also possible they both knew the address which was paid out to buy the stolen merchandise and they saw he had withdrawals from a bitcoin exchange in bank records. Given these two facts, it's pretty easy to draw a line between them even when mixers are used. But if you don't already know who to suspect this is much harder to do.

duxup 7y ago

From a technical standpoint I wonder what the developer who is stealing is thinking. I've worked lots of places with access to lots of things. I have technical know how and presumably so does he. Even if I was inclined to do something like this I know that many of my coworkers / people at the company ... are more than capable of tracking down most anything if given enough attention. The first and best protection I could think of is simply the volume of what is stolen to keep from being noticed. Once noticed with sufficient motivation it's just a matter of time.

pbhjpbhj 7y ago
There's lots of things that could impair his reasoning (drink, gambling, other emotional stress, illness), or it could be motivated by revenge, or ...
fragmede 7y ago
Reading between the lines, the article says they got away with it for months, and were only caught because they got greedy - to the tune of a luxury car and a mansion! This smells like a crime of opportunity; most crimes aren't throughly-planned, well-executed Hollywood-grade bank heists - or their digital equivalent, so there also isn't a thoroughly planned exit strategy to a non-extradition country, just a vague notion that something will happen, eventually. Possibly getting caught.
- toyg 7y ago
  > most crimes aren't throughly-planned, well-executed Hollywood-grade bank heists And this is why Crime and Punishment is an ageless masterpiece of literature.

johnbrodie 7y ago

The explanation in the article is fairly well done. One thing I can't help but think whenever there are more involved processes for catching someone though, is that we'll never know if that was the actual method used. For a large enough case, they could utilize some other, more secretive method, and then parallel construct this (believable) one, with the benefit of already knowing the final answer. Not something I'm saying _happened_ here, but certainly something I think everyone should keep in mind when they read these types of cases.

dd36 7y ago

We only know about the times it is noticed.