靠系統bug騙取超千萬美元，微軟一軟件工程師鋃鐺入獄

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"據彭博社"},{"type":"link","attrs":{"href":"https:\/\/www.bloomberg.com\/features\/2021-microsoft-xbox-gift-card-fraud\/","title":"","type":null},"content":[{"type":"text","text":"報道"}]},{"type":"text","text":"，微軟一名工程師利用微軟商店的系統 "},{"type":"link","attrs":{"href":"https:\/\/baike.baidu.com\/item\/bug\/3353935?fr=aladdin","title":"","type":null},"content":[{"type":"text","text":"bug"}]},{"type":"text","text":"，盜取了超過 15.2 萬張 Xbox 禮品卡，價值 1010 萬美元。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"改變“命運”的 bug"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Volodymyr Kvashuk 是一名軟件工程師，2017 年加入微軟，其工作職責是負責測試電子商務基礎設施。通過模擬在微軟在線商店的購買行爲，尋找支付系統中的故障。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/b3\/b307f71baa086061005bea84e964e388.jpeg","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"他使用微軟官方提供的虛假賬戶和虛假信用卡，來進行測試，並記錄購買過程中發生的任何錯誤。這意味着他能進行大量的虛假購買。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"由於他用的是特定的虛假賬號，系統知道這次購買無效，理論上不會把商品派送出去。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"但是，他在測試過程中發現一個系統 bug："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"每當他測試購買 Xbox 禮品卡時，儘管使用的是虛假信用卡號碼，但微軟商店還是會發放真實的禮品卡——一串真實有效的 25 位卡密。"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這意味着他可以"},{"type":"text","marks":[{"type":"strong"}],"text":"無限生成 Xbox 禮品卡"},{"type":"text","text":"，並且還是"},{"type":"text","marks":[{"type":"strong"}],"text":"免費"},{"type":"text","text":"的。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"據悉，Xbox 禮品卡可以從微軟商店（Microsoft Store）購買用於 Windows 和 Xbox 的設備、遊戲、軟件、應用和電影等，包括 Xbox 遊戲軟件、Windows 和 Office 軟件，以及聯想筆記本電腦、Sonos 等實物商品。當然，你還可以把它送給親朋好友。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/ff\/ff1c18612dc81a8080e9100cc8a734f0.png","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"不過，Volodymyr Kvashuk 並未上報這個 bug，而是選擇隱瞞，並利用它來賺錢。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"他利用這個 bug 偷偷地生成 Xbox 禮品卡，10 美元、100 美元，規模從小到大。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"犯罪流程"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"根據彭博社的報道，我們可以大致概括一下 Kvashuk 的犯罪流程："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通過同事的賬戶（其中一個同事的密碼是 VerySecret1），一次可以獲得一大堆 Xbox 禮品卡；"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通過外國服務器重新路由這些請求，來隱藏購買地點；"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通過一個名爲 Paxful.com 的網站將 Xbox 禮品卡轉售爲比特幣；"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通過一個名爲 ChipMixer.com 的網站實現了比特幣交易的匿名性。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"據悉，在這個過程中，Kvashuk 利用了諸多手段來謀取更多利益。由於憑空產生的 Xbox 禮品卡數額巨大，以至於對二級市場的 Xbox 禮品卡售價產生了波動性影響。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/b9\/b998f88982d082345c44c1ff2ec38b38.webp","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"當市場上的 Xbox 禮品卡價格太低時，他就會暫停“出貨”來營造飢渴的供需關係，進而操控整個 Xbox 禮品卡市場，一直等到價格回升再繼續。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"鋃鐺入獄，9 年監禁"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"雖然 Kvashuk 在這個過程中使用了高超的反偵察、反追蹤和經濟學手段，但是 2 年後，他被聯邦特工抓獲。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"那時，他已經盜取了 15.2 萬張 Xbox 禮品卡，"},{"type":"text","marks":[{"type":"strong"}],"text":"價值 1010 萬美元"},{"type":"text","text":"。同時，他在一棟價值七位數的"},{"type":"text","marks":[{"type":"strong"}],"text":"湖濱別墅"},{"type":"text","text":"中靠這些收入生活，還打算購買"},{"type":"text","marks":[{"type":"strong"}],"text":"滑雪小屋、遊艇和水上飛機"},{"type":"text","text":"。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"去年 11 月，一名法官判處他九年監禁。他有可能在服刑至 2027 年 3 月後被遣返回老家烏克蘭，並將不得不賠償 830 萬美元。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"更多詳情："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"https:\/\/www.bloomberg.com\/features\/2021-microsoft-xbox-gift-card-fraud\/"}]}]}