靠系统bug骗取超千万美元，微软一软件工程师锒铛入狱

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"据彭博社"},{"type":"link","attrs":{"href":"https:\/\/www.bloomberg.com\/features\/2021-microsoft-xbox-gift-card-fraud\/","title":"","type":null},"content":[{"type":"text","text":"报道"}]},{"type":"text","text":"，微软一名工程师利用微软商店的系统 "},{"type":"link","attrs":{"href":"https:\/\/baike.baidu.com\/item\/bug\/3353935?fr=aladdin","title":"","type":null},"content":[{"type":"text","text":"bug"}]},{"type":"text","text":"，盗取了超过 15.2 万张 Xbox 礼品卡，价值 1010 万美元。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"改变“命运”的 bug"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Volodymyr Kvashuk 是一名软件工程师，2017 年加入微软，其工作职责是负责测试电子商务基础设施。通过模拟在微软在线商店的购买行为，寻找支付系统中的故障。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/b3\/b307f71baa086061005bea84e964e388.jpeg","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"他使用微软官方提供的虚假账户和虚假信用卡，来进行测试，并记录购买过程中发生的任何错误。这意味着他能进行大量的虚假购买。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"由于他用的是特定的虚假账号，系统知道这次购买无效，理论上不会把商品派送出去。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"但是，他在测试过程中发现一个系统 bug："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"每当他测试购买 Xbox 礼品卡时，尽管使用的是虚假信用卡号码，但微软商店还是会发放真实的礼品卡——一串真实有效的 25 位卡密。"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"这意味着他可以"},{"type":"text","marks":[{"type":"strong"}],"text":"无限生成 Xbox 礼品卡"},{"type":"text","text":"，并且还是"},{"type":"text","marks":[{"type":"strong"}],"text":"免费"},{"type":"text","text":"的。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"据悉，Xbox 礼品卡可以从微软商店（Microsoft Store）购买用于 Windows 和 Xbox 的设备、游戏、软件、应用和电影等，包括 Xbox 游戏软件、Windows 和 Office 软件，以及联想笔记本电脑、Sonos 等实物商品。当然，你还可以把它送给亲朋好友。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/ff\/ff1c18612dc81a8080e9100cc8a734f0.png","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"不过，Volodymyr Kvashuk 并未上报这个 bug，而是选择隐瞒，并利用它来赚钱。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"他利用这个 bug 偷偷地生成 Xbox 礼品卡，10 美元、100 美元，规模从小到大。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"犯罪流程"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"根据彭博社的报道，我们可以大致概括一下 Kvashuk 的犯罪流程："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通过同事的账户（其中一个同事的密码是 VerySecret1），一次可以获得一大堆 Xbox 礼品卡；"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通过外国服务器重新路由这些请求，来隐藏购买地点；"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通过一个名为 Paxful.com 的网站将 Xbox 礼品卡转售为比特币；"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通过一个名为 ChipMixer.com 的网站实现了比特币交易的匿名性。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"据悉，在这个过程中，Kvashuk 利用了诸多手段来谋取更多利益。由于凭空产生的 Xbox 礼品卡数额巨大，以至于对二级市场的 Xbox 礼品卡售价产生了波动性影响。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/b9\/b998f88982d082345c44c1ff2ec38b38.webp","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"当市场上的 Xbox 礼品卡价格太低时，他就会暂停“出货”来营造饥渴的供需关系，进而操控整个 Xbox 礼品卡市场，一直等到价格回升再继续。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"锒铛入狱，9 年监禁"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"虽然 Kvashuk 在这个过程中使用了高超的反侦察、反追踪和经济学手段，但是 2 年后，他被联邦特工抓获。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"那时，他已经盗取了 15.2 万张 Xbox 礼品卡，"},{"type":"text","marks":[{"type":"strong"}],"text":"价值 1010 万美元"},{"type":"text","text":"。同时，他在一栋价值七位数的"},{"type":"text","marks":[{"type":"strong"}],"text":"湖滨别墅"},{"type":"text","text":"中靠这些收入生活，还打算购买"},{"type":"text","marks":[{"type":"strong"}],"text":"滑雪小屋、游艇和水上飞机"},{"type":"text","text":"。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"去年 11 月，一名法官判处他九年监禁。他有可能在服刑至 2027 年 3 月后被遣返回老家乌克兰，并将不得不赔偿 830 万美元。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"更多详情："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"https:\/\/www.bloomberg.com\/features\/2021-microsoft-xbox-gift-card-fraud\/"}]}]}