The defendant must comply with a sentence of more than 10 years in prison
A Chinese software manager was convicted of stealing around $1M USD exploiting a known vulnerability in the Huaxia Bank ATM system.
According to network security and ethical hacking specialists from the International Institute of Cyber Security, the 43-year-old man worked at the banking institution’s software development center when he discovered a loophole in the bank’s central operating system that provided him a deadline for withdrawals that would not be recorded in the systems.
Qin Qisheng discovered that, since 2016, cash withdrawals made around midnight were not registered by the bank; the employee also realized that the flaw had been systematically exploited since its discovery, for almost two years.
According to network security specialists, Qin developed a set of scripts, injected them into Huaxia Bank systems, and was able to exploit the security flaw without generating suspicion. Evidences suggest that the plan of Qin Qisheng succeeded; for more than a year, the software manager performed cash withdraws of between $700 and $3k USD in a systematic way.
Part of Qin Qisheng’s plan was to use a ‘test’ bank account, used for security analysis at the bank, as a source of ATM withdrawals. Chinese authorities estimate that the former employee would have stolen more than 7M Yuan (approximately $1M USD).
After more than a year Huaxia Bank discovered the fraud of its employee, who tried to justify himself by stating that he had done all this as part of “an internal security test plan”. When questioned about the stolen money, the software manager mentioned that the assets were on his own bank account and that they would be returned to the bank at the end of the system tests.
According to local media reports, Huaxia Bank would have decided to accept the employee’s explanation; however, the Chinese authorities did not buy his story and found him guilty of robbery after his arrest in December 2018.
Qin will now have to comply with a 10-and-a-half-year prison sentence.
Huaxia Bank asked the Chinese authorities to dismiss the case, as all stolen assets were returned shortly after the incident was known. The police considered this application to be ‘illegitimate’, so the implicated has no choice but to comply with his sentence.
According to specialists in network security, the cybercriminals do not have only methods such as the use of skimmers, exploiting vulnerabilities and design flaws to rob ATMs. Recently a group of researchers discovered a malware variant specially designed to compromise ATMs; this tool is available on some hacker forums on dark web. The average price of this kind of malicious software is around $25k USD.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
