7 ms·
BofA Programmer Heads to Prison After Coding ATMs to Spit Out Free Cash
- clarebear 15y agoSounds like Office Space.
- jsavimbi 15y agoMore like Superman III.
- leftnode 15y agoIt doesn't sound like either of those movies. They just shaved off dollar amounts less than 1 cent from millions of transactions. This guy just had the machines spit out extra money when he entered his ATM card.
- marconaut 15y agoSounds like somebody has a case of the Mondays.
- jason_slack 15y agoI think you have my stapler.....
- hugh3 15y agoPlease, just stop. I mean, I love quoting tangentially-related old movies too, I think it's totally the highest form of wit, but the url for fark.com is "fark.com".
- bitwize 15y ago"...some cash machine in Bumsville, Idaho spits out $700 into the middle of the street. I did that! That was me!" "You did this from your house?" "What are you, stoned or stupid? You hack a bank across state lines, you get nailed by the FBI!"
- endlessvoid94 15y agoMan, I was JUST going to quote that. Well done.
- omouse 15y agoLike father/BoA like son?
- bhavin 15y agoOne would wonder if there were any code reviews in place or not? Any code that has monetary effects has to go through a series of code reviews (saying from my experience working with a client in banking industry) and tests. I would be curious as to how the 'bug' went undetected until deployment!
- bdunbar 15y agoAny code that has monetary effects has to go through a series of code reviews The article reported that he installed malware on select ATMs. I acknowledge that this leaves a great deal to the imagination, but one suspects a code review would not catch the problem. The code was clean, the implementation on certain machines went awry.
- AndyKelley 15y agoIn other words, he did some kind of internal hacking to install his code - illegally bypassing the code review process.
- bdunbar 15y agoMaybe? I can only speculate that the hack wasn't in the code at all, but something he installed on the individual ATM. "Oh, look: you can login to the ATM after installing the code. Hey what if I ..." If so he didn't bypass the code review so much as skip around it, whistling a jaunty 'nope nothing illegal here' tune.
- smackfu 15y agoIdeally, any software that runs on the system would be digitally signed by the development shop, after their code review process. Otherwise anyone with direct physical access to the hardware (or to the distribution system for code updates) could add malware like this guy did.
- ck2 15y agoPeople in charge of the BofA mortgage signature fraud should go to prison too. http://www.cbsnews.com/8301-504803_162-20049744-10391709.html http://www.cbsnews.com/8301-504803_162-20049744-10391709.htm... But I guess it's a lot easier to prosecute people who can't afford expensive lawyers.
- ohyes 15y agoAlso its more difficult to defraud people (or you know, legal entities with all of the same rights as people) who can afford expensive lawyers.
- anigbrowl 15y agoProsecuting financial fraud is usually a great deal slower and more complex because it's more difficult to prove intent (compared to both incompetence and pursuit of legitimate profit), because it can involve so many more people (many of whom may not have been doing anything wrong at the individual level, but whose actions taken together were wrong at an institutional level), and because the rewards are more diffuse and indirect (unit profits lead to pay rises or career advancement for those involved, rather than bags of cash or deposits into secret accounts). That's not to say that people can't or shouldn't be prosecuted, just that it's a more difficult undertaking. A recent example: http://www.housingwire.com/2011/04/19/ex-tbw-ceo-lee-farkas-convicted http://www.housingwire.com/2011/04/19/ex-tbw-ceo-lee-farkas-...
- ck2 15y agoSigning someone else's name at the behest of a department head is pretty clear fraud (and more obvious when it's 1000's of documents being signed with someone else's name and backdated). Watch the 60 Minutes segments. Prosecutors don't want to take on the financial sector because it ruins their achievement record if they lose or it takes too long because the defendant can afford good lawyers. They stick to the people who cannot afford a defense. No-one has been prosecuted for the financial crisis, I mean the economy was DESTROYED, we are years into it now.
- 15y ago
- delinka 15y agoI wonder how they'd have felt about it making phantom lines of credit instead. (Of course, with interest.) "Oh, it's Programmer D! How's it goin', D? You want $1,000? OK! And since you don't have enough money just now, I'll just jot this down for you to pay back later." And magically, when I deposit $5,000, it pays back a few hundred on my, er, his loan. :-)
- delinka 15y agoFine, more apropos- yeah, the guy was an idiot. I was going to pontificate on how one might actually pull this off, but there's always a problem: you're gonna make mistakes and eventually get caught.
- jwhitney 15y agoOr, you won't and then no one will know how you did it.
- fragsworth 15y agoIf you don't mess up, nobody will know that you did it anything at all. They don't seem to publish statistics on these things very often, but my gut tells me more people get away with crimes than don't.
- encoderer 15y agoOn a related note: The Bank Of America ATMs are really, really great. Their ATMs and their online bill pay service are some great banking tech. They're the only reason I'm a BoA customer for my checking and cashflow accounts. With their BillPay service, I can have BoA download e-bills from, say, credit card companies or utilities, and pay the amount of the bill on its due date. I never have to worry about it. I can set rules like "Pay my electric bill its full amount on its due date unless it's over $200" so I'm protected from crazy billing errors draining my account. This guy was just a dumbass.
- zach 15y agoAnd yet they still use the Windows "ding" for everything, because of course there's no budget for sound design in an ATM project. I hear those weirdly-out-of-place Windows sounds everywhere. It grates on me the same way Comic Sans grates on those who appreciate type. Someone who does sound design could pick up this banner and impress everyone with set of free UI sounds that are classic and usable.
- calloc 15y agoThat is because those ATM's are running on top of embedded Windows. Mostly Embedded Windows XP.
- bitwize 15y agoNot only is it annoying but it broadcasts "You are using a Windows machine". Which to be also broadcasts "This machine is completely untrustworthy for financial purposes." Oh, and a lot of them are Diebolds...
- hugh3 15y agoWhich to be also broadcasts "This machine is completely untrustworthy for financial purposes." Does it? I've never heard of anyone defrauding a BofA ATM except this guy. And this guy got caught.
- leviathant 15y ago
- hansy 15y agoHow did he get caught?
- jason_slack 15y agoThat is a line from "Hackers" one of Angelina Jolie's first movies!
- jason_slack 15y agowhy was this modded down but hansy's comment wasn't
- gojomo 15y agoRegardless of whether that's also a line from a movie – and I did not recognize it as such – it's still a legitimate question. After reading the article, I too wondered exactly how he got caught. I can guess, but it'd be interesting to know. In contrast, reflexively referencing a movie/celebrity isn't interesting.
- lazugod 15y agoOr he could actually be asking how he was caught.
- jason_slack 15y agoI totally did not read Hansy's comment that way since it was posted in a weird place in the thread. I thought he/she was referring to line from "hackers" Hansy, I apologize.
- anigbrowl 15y agoI'll laugh if it turns out he boasted about (indirectly) on HN. Unlikely, but not impossible - many criminals are undone by a burning desire for peer validation.
- Killah911 15y agoI'm just dying to know how exactly he did it and how they tracked him down. I've joked about this type of thing with friends, but it would be absolutely hilarious if he did something to the effect of putting his information within the malware which led cops right to his doorsteps. I have a feeling, this may be something at the level of a burglar leaving footprints in the snow right to his home... I mean, wouldn't they have locked him up and thrown away the keys if it were more of an Oceans 11 type plan & they had to chase him down spending tons of federal money? 400k & 27 months for what essentially is equivalent to bank robbery?
- itgoon 15y agoMy guess is that when the money in the ATMs didn't reconcile. It may be normal for a set of ATMs to be off by a few hundred a year, but anything higher than the norm would be enough to set off alarms. After that, it just involves reviewing code checkins and camera footage. Just a guess, though. Hell, maybe he used ATM card first before each "heist".
- ChuckMcM 15y agoATM fraud has a long and storied history. Kind of a must read for security types since some amount of 'loss' through the ATM network is planned for by the banks. At a surety conference hosted by First Data and SWIFT there was a lively discussion where everyone agreed that the old "tie a chain around it and take it with you" was the most difficult one to guard against. But at least it met the critical criteria of detection. The serial numbers of every bill that goes into an ATM are recorded, the date they leave the ATM is also recorded, the serial numbers of every bill that enters a bank are recorded and their source. Cash is anonymous but it's life cycle is not.
- smackfu 15y agoCan anyone figure out where a year went here? He plead guilty in April 2010. Was he really just sentenced in May 2011?