Teen bought Google ad for his scam website and made 48 Bitcoins duping UK online shoppers A "sophisticated" teenager has had £2.1m ($2.88m) in cryptocurrency confiscated after he set up a phishing site and advertised it on Google, duping consumers into handing over gift voucher redemption codes. The schoolboy set up a website impersonating gift voucher site Love2Shop. Having done that he then bought Google ads …
I expect he'll start seeing job offers from Facebook soon - clearly he has a good understanding of the current way the world works.
Yes, he committed a crime but a lot of time kids are just playing on the Internet without any expectation of massive profits like that.
Upvoted because I agree with the sentiment though not the particulars. I would not consider running a scam to be a good entry into security work. Definitely put him to work, but if he wants to learn the technical side, I don't think that should be done as part of the deal.
I doubt that very much. Some social engineering helps in penetration, but you still need to know how to do the various other things involved in testing. For the media understanding of pen-testing (hey look at this story of a security procedure failing) he could probably do it. For the actual job of pen-testing (identifying the security failings which are most dangerous for the institution and finding ways to start to solve them) he would probably not have the required skills yet.
I agree. I'm getting more of a "I'm so much smarter than these idiots around me, I deserve this money more than they do" kind of vibe here. He probably thought that he'd never be caught, because he was so much more intelligent than everyone else.
I acknowledge that this may not actually be the situation, it's just the feeling I get. Partly because that particular demon has sat on my shoulder for a couple of decades now.
Re: 'I expect he'll start seeing job offers from Facebook soon - clearly he has a good understanding of the current way the world works."
Unfortunately, it seems with Humans, if you make someone enough money, you can get away with an awful lot that you wouldn't otherwise. This isn't a new thing. Look at Jimmy Saville. He abused hundreds of vulnerable people, and got away without being punished probably because those in power looked the other way when they heard rumours.
I'd rather that scholarship went to someone who stayed within the law and would struggle to afford it rather than penalising them.
I get people do screw up and it shouldn't ruin his adult life, but it sure shouldn't be rewarded. He can do something positive now he narrowly escaped juvi, and earn a scholarship of the back of that, instead.
"Bitcoin transactions are all recorded on the digital asset's blockchain, a register of exactly who transferred what to whom and when."
What I never understand, is that if this is true, how can entire bitcoin depositories be raided (digitally) and they lose millions of $ in Bitcoin. Surely if this is all traceable then stolen bitcoin can be identified, and then treated/recovered as stolen goods.
I believe there is logistics problems with doing so. Yes, Bitcoin transactions are all recorded in the blockchain but the Bitcoin itself is a dataset often recorded in "wallets". If the wallet is 'stolen', that is hacked, what they are taking is essentially a journal containing the identification locators of the Bitcoin.
Since (it seems) most people do not have secondary records of the Bitcoin identifiers, stealing the wallet that contains the identifiers also means that you lose access to the blockchain records associated with those individual record identifiers.
You've lost access to the door number of the room that itself contains the file cabinet that holds the records, and there are hundreds of millions of doors.
At least, this is what I believe to be the problem (as I do not hold Bitcoin myself).
Close, it's just that when bitcoin are stolen they are transferred from the owners wallet (registered in the block chain) to the thiefs wallet. The wallets require a private key to move the funds, so if its moved to stoneone else's wallet they no longer have access and none else can move it either. The only way to move them back is with that private key or by rolling back the block chain to before it was stolen, removing all transactions after, this will not happen as it will cause a fork in the block chain, meaning a new bitcoin coin would exist, one for people that accepted the roll back and one for those that didn't.
Bitcoin wallets can be recreated on to any computer using the 12-24 word seed phrase that corresponds to the private key. Being hacked generally means the seed phrase is compromised or someone has left the passwords to their computer and software wallet lying around. The wallet can simply be created and stored on paper or better on a cold storage device if you wish. If the seed phrase is lost or forgotten then the wallet will be unrecoverable; as Satoshi said this is considered a "donation to every other holder".
Every transaction is recorded on the blockchain so stolen funds can be marked and tracked.
In this case the Bitcoins may have simply resided on the exchange where they were bought. If it was in the UK it would be fairly easy for the authorities to trace stolen credit cad details to his acccount and seize them but there isn't enough info in the article.
"Every transaction is recorded on the blockchain so stolen funds can be marked and tracked."
Now that this is said and I think about it, doesn't that rather eliminate the claim of "anonymous"? It is only "anonymous" so far as an individual Bitcoin's ID isn't known, "security through obscurity". All the plod needs is a single Bitcoin to track against its blockchain; once a single Bitcoin's history dataset is known, it can be compared to others to find a pattern of usage for a single buyer across the Bitcoin system.
(note I am not saying that this will be "easy", just possible)
You are correct. Bitcoin and many cryptocurrencies like it are not at all anonymous. They are only pseudonymous. Law enforcement and private companies have systems for tracking transactions in it. There are some cryptocurrencies which use more complex mathematics to be anonymous, but they are often less popular.
"What I never understand, is that if this is true, how can entire bitcoin depositories be raided (digitally) and they lose millions of $ in Bitcoin. Surely if this is all traceable then stolen bitcoin can be identified, and then treated/recovered as stolen goods."
Here's the workflow. An exchange stores its coins in a wallet. A good exchange uses a bunch of wallets, just as a bank uses multiple vaults in different places. A bad one may only use a few ones containing all the value. In order to transfer coins for the customers, the private keys for the wallets need to be on a trading system; if you use humans for security on each transaction, the exchange doesn't get customers because it would take hours to start a transaction.
If an attacker steals a private key to one of those wallets, they can authorize any transaction from it. They do that and transfer all the coins to their wallet. The problem now is that, although the blockchain tells you where the money has gone, it doesn't tell you who controls that place. A wallet address is just a cryptographic value. Setting one up is anonymous and takes a few seconds. Anyone can watch that address to see what it does, but they can't just take the coins out. If the thief uses the coins in some way that identifies themselves, law enforcement may locate them and force them to turn over the private key. If they take efforts to hide where the coins are going, they may not be located.
Stolen cryptocurrency may be converted into other types which are harder to track. It can be tumbled, which means that a system will chop up the value from multiple people and distribute it into a bunch of new wallets so you don't know who has it. It can be used to purchase things which won't report to law enforcement (E.G. buying stolen credit cards in order to use those to fund purchases). In those cases, the problem is identifying who has the currency.
>What I never understand
Rich people don't need to understand money laundering. They simply employ the best accountants. It's the life blood of the City of London.
For some reason, less rich people think crypto makes laundering easy. But at some point cash becomes crypto, and crypto becomes cash. Information leaks at every step.
I should start a website like that for a short period, but you know, hide my tracks much better. Redeem vouchers with his own account? A newbie mistake.
Disclaimer: your honour, I made this comment hypothetically. If I were to actually go into cybercrime, I wouldn't brag to anybody, much less a public forum on the Internet, surely.
From the story, all the "profit" from this scam was put into vouchers in his own name (not a great idea)
If the kid had been less stupid, all his profit from other dishonest activities (a lot according to the report), would have been fine as they obviously slipped through the radar.
Should have hidden the bitcoins and card / paypal details better, if kid had ensured any data on device(s) only related to "current" scam then would have kept the decent wodge of bitcoins.
If someone is going to do something as risky as online crime (don't see the point myself, but I'm risk averse & have family depending on me so risking jail never on the radar) you would at least make an effort to not have any incriminating evidence around of previous crimes. And FFS, must be massively risk addicted as that bitcoin stash was sufficient to not need to bother with crime anyway (unless the schoolboy had a phenomenal coke & hookers habit, massive gambling addiction or something else that pisses away the cash at a phenomenal rate)
I once had to explain to somebody how easy it was to set up a website and make it look like a legitimate one. They couldn't believe that they'd fallen for a scam but it wasn't the normal domain they'd visited. Luckily for them it wasn't all bad news. The website they'd been to was another domain but it was simply a different version of the main one. A bit like smile.amazon.com, although this one had a different suffix but still owned by the same company. This was many years ago and scams have gotten more sophisticated since then.
>I once had to explain to somebody how easy it was to set up a website and make it look like a legitimate one.
This last week received emails from "HMRC", all look good but niggling doubts (they had attachments) caused me to look deeper and compare them to emails I knew to be genuine. The emails had been sent from a different non-UK gateway and the .xls and .doc attachments contained 'interesting' code.
If the kid had been less stupid
I'm not sure he should be called stupid. Naive yes, but definitely smarter than the average kid.
I hope that he gets the chance to put his talents to much better use in the future, but if not then he only has himself to blame when he gets caught.
Shouldn't someone be looking in their general direction? Isn't this more a huge fail on their part? And this incident shines a bright light on it. Especially since love2shop probably uses googles Ad services too? Google was fooled by a kid! I hope the kid has learned a lesson or two.
Ah.but that's not the medias agenda is it ?
Similarly strong encryption isn't illegal, but will be mentioned in any article about child porn or paedophiles.
And a light and a fan become a "sophisticated professional setup" when a poor sod is caught growing a plant.
Well, here in the Good Ol' US of A it wouldn't matter at all. The cops could have:
Confiscated all his ill gotten gains.
Confiscated his BitCoins.
Confiscated all his computer equipment.
Confiscated his parents home, cars and the entire contents of their bank accounts!
Land of the free and all that! More like free money for local law enforcement!
Don't be so defensive: if someone raided a bank vault and made off with diamonds and then sold them for $2m in cash, then the article would say the thief made $2m from stolen diamonds.
If someone runs a scam and launders people's online vouchers into Bitcoins, then the article would say just that.
At some point, usually at the top, we have to mention the money and assets involved. In this case, the teen bought BTC using his ill-gotten gains.
C.
A wry joke, like many teenagers, he really just needs some guidance. Personally, someone really needs to sit down and do a debrief converting a simple "you've done wrong" to these are the learning points and the lessons learnt.
If you are the owner of one of the small businesses that GoDaddy uses in its TV adverts, this teenager has the skills you need to build an effective web business.
Doing this would help the teen to move on and positively re-orient their thinking. Obviously, if it happens again...
The "were able to highlight that the police are now able to effectively investigate offences of this nature" is very important here. No mention of any backdoor or using the fruits of mass surveilance. The victim made a complaint to the police, police investigated, just like it shoul be.
Will this calm the hysteria about the necessity to search every bit of memory everywhere for child pornography? Sadly, no.
Is this yet another sociopath being congratulated?
Seriously, any muppet with valid payment details can advertise, any muppet can craft a convincing looking web form, the html code is right fucking there on the www to be used and abused
The only people who would be interested in their skills if we can fucking call them that, is the insecurity and unintelligence services
What a brave new world
‘ DC Casey added: "Cryptocurrency is often thought, by criminals, to be an anonymous way to move funds around undetected but I'm glad that in this case, we were able to highlight that the police are now able to effectively investigate offences of this nature."’
I trust this statement will be made available to the court when the Home Office makes another attempt to break encryption on the grounds that it allows anonymous criminality.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
