17-year-old hacker held $1.5 billion in stealable funds: grateful police caught me before I turned 18

In his underage years, A Ye, a junior high school graduate, through self-taught "hacking" techniques, used cyber attacks to extract bank card information and passwords of clients in bulk. Together with his accomplices, he exploited vulnerabilities in online payment systems to fraudulently drain others' bank accounts for substantial illicit profits. According to preliminary verification, since 2013, A Ye had been operating online with downstream members using screen names such as "Crocodile" and "Ten Years Without Meeting," employing a loosely organized and intermittent collaboration method to carry out these crimes, illegally profiting over 14 million yuan.

The task force explained that A Ye fully exploited the weaknesses and vulnerabilities in information security during the rapid development of the big data era. By writing his own hacking software, he selectively attacked well-known recruitment websites or other websites containing large amounts of customer information to steal customer data from the backend. According to A Ye, after accumulating a certain amount of bank card information, he would post messages in QQ groups to find monetization “channels” and “partners.” The so-called “channels” refer to methods of exploiting vulnerabilities in online payments to fraudulently withdraw and monetize funds from bank card accounts.

In fact, A Ye's criminal focus was on the "four key pieces" of bank card information, which refer to the bank account number, ID card number, login password, and mobile phone number. According to A Ye's recollection, he collected a large number of email accounts and passwords through online searches and other means, and then wrote his own software to attack recruitment websites, as these recruitment sites only required an email address and password to log in. He obtained millions of pieces of citizens' personal information and organized this information together with big data obtained through other channels into a database. Using a complete set of data organization software developed with "E Language," he automatically matched the information into complete "four key pieces" of bank card information.

A Ye expressed: He was extremely grateful that the police worked overtime through the night to apprehend him before his eighteenth birthday, and visited him at the detention center on his birthday with his favorite roast goose leg. Currently, A Ye is studying C++ and website-related content with peace of mind at the detention center, and dreams of becoming an expert in cybersecurity and a "red hat hacker" in the future.

(Southern Metropolis Daily)

How are sentences determined for crimes committed by individuals under 18? A brief analysis of China's age provisions for criminal responsibility.

According to Article 17 of China's Criminal Law regarding the age of criminal responsibility, we can roughly draw the following conclusions:

(1) A person under the age of fourteen who commits a crime shall not be held criminally liable.

(2) A person who has reached the age of sixteen and commits a crime shall bear criminal responsibility.

(3) A person who has reached the age of fourteen but is under the age of sixteen and commits intentional homicide, intentional injury causing serious bodily harm or death, rape, robbery, drug trafficking, arson, explosion, or poisoning (or any of the eight acts contained therein) shall bear criminal responsibility.

(4) A person who has reached the age of fourteen but is under the age of eighteen and commits a crime shall be given a lighter or mitigated punishment.

(5) If a person is not subject to criminal punishment because he or she is under the age of sixteen, his or her parents or guardians shall be ordered to discipline and educate him or her; when necessary, the government may also take him or her into custody for education.

It is worth noting that the ages mentioned above all refer to full years of age, specifically the full years of age at the time the offense was committed. In this case, A Ye had not yet passed his 18th birthday at the time of capture, and therefore may still be handled in accordance with the provisions of point (4) above, with a lighter or mitigated penalty as a juvenile offender.

But as A Ye said: “A hacker might make hundreds of thousands or even millions in a single night, but the price of breaking the law is losing your freedom. Actually, for me, what hurts more than losing my freedom is that I hurt my family. My mother and girlfriend spent everything they had to hire a lawyer for me. The house can no longer be built, and my younger brother and sister’s tuition has become a problem···”

Therefore, young people should use their intelligence on the right path, and not always think about making quick money, especially illegal quick money, as it will cost them a lifetime!

Tip: Online payment passwords must be different from other passwords.

With online shopping so frequent and so much personal information online, how can ordinary users protect themselves from hackers stealing their bank card information? In response to these new types of crime, the task force officers have summarized the following prevention tips.

First, strengthen password management. Police officers stated that the case revealed that many users had overly simple passwords and used the same password for online payment, email, QQ, WiFi, and other accounts, which is extremely dangerous. Once hackers breach any one account, they can obtain the bank card password.

[Tip] Online payment passwords must be unique, different from other passwords, and should be changed periodically. Never use birthdays or regular number patterns as passwords.

Second, the payment stage requires caution. Police officers stated that crimes of this nature ultimately "cash out" at the online payment stage. Typically, criminals exploit the vulnerability of mobile banking, which does not verify the reserved phone number and login device number, to purchase phone recharge cards, Q coins, and other items, then find buyers to convert them into cash.

[Tip] In such cases, during online payment, it is advisable to use a USB shield, or choose payment methods that involve dynamic passwords and verification codes.

Third, strengthen phone management. Police stated that in the cases, hackers send malware (usually targeting Android systems) to cardholders' phones, gain control, and redirect SMS messages to obtain verification codes for large transactions, transferring and stealing funds before cashing out.

[Tip] On your phone, do not install or click on software and links from unknown sources, regularly run antivirus scans on your phone, and it is best not to connect to unknown Wi-Fi networks.

Fourth, pay attention to bank card management.

[Tip] Users are advised to use credit cards for consumption and debit cards for financial management. After all, credit card accounts have no funds, and the amount per transaction can be controlled.