10 ms·

Short-selling as a way to profit from security vulnerabilities

181 points by ISL 10y ago

mikekij 10y ago
(Disclosure: I'm working on a med device security startup.) Taking public short positions, then publicizing vulnerabilities is perhaps the shittiest way to ensure patients are not harmed by these vulnerabilities. I wonder if Carson Block would be as enthusiastic about this approach if his grandmother had a St. Jude ICD in her chest.
- ISL 10y ago
  There may be some white-hat middle ground; disclose the vulnerability to the vendor, wait 90 days, if no patch has been released/recall initiated, it's open season for the short sellers....
  - IshKebab 10y ago
    That doesn't exactly incentivise the vendor to prevent future vulnerabilities though.
  - tomp 10y ago
    No, the problem is that these companies don't pay the fair price (i.e. what their unvestors stand to lose if knowledge of this vulnerability is disclosed) to the researchers. Personally, I don't feel any kind of moral obligation to essentially sponsor the investors of these companies (if I were a security researcher).
    - dsfyu404ed 10y ago
      If I have a 95% chance of losing a dollar from a vulnerability. I'm not gonna pay you a dollar for it. I have a 100% chance of losing a dollar that way and a 95% chance if I don't. Even if I buy it from you it may cost me 50 cents to fix it. Then I lose $1.50. If I pay you 45 cents then I break even if the process scales up to tons of $1 95% vulnerabilities that can be fixed for 50 cents. Fair price is a pipe dream. But considering the huge sums of money that are involved something more than "here's $500, thanks for your time" would be nice. As it stands if you're good at breaking stuff you can make more money breaking it for the bad guys than for the good guys. No other industry has this problem. E.g. a good lockpicker or safe cracker can make more money performing his/her trade legitimately.
      - SolarNet 10y ago
        I think the point of short selling is an activist way of saying "Have a fair price or see your stock price plummet when we do it the other way."
- bink 10y ago
  While what he's doing is completely unethical, I don't know if I'd go so far as to say it's putting anyone at risk. Placing a call to an investment firm to short a stock shouldn't take so long as to delay the release of an advisory. That being said I don't like what I'm seeing in some parts of the security community as of late. Security is becoming a misnomer as companies and groups are actively hoarding and selling vulnerabilities and making us all less safe.
  - chillydawg 10y ago
    Companies like google, facebook and microsoft are forced to spend bajillions either finding their own bugs and fixing them or buying the bugs and fixing them. Can you imagine the fallout of a massive google or facebook data breach? It's probably their single biggest risk. I rest easy at night knowing $100bn+ firms have a very strong economic incentive to find and fix security flaws of all kinds.
    - SSLy 10y ago
      which sony isn't…
  - lawnchair_larry 10y ago
    Or is it the manufacturer being unethical?
  - harmegido 10y ago
    I don't view this as unethical. I think it actually promotes security. Consider that there are lots of products out there with serious vulnerabilities that no one knows about. A bad actor has tons of incentive to try to find these and keep it secret while exploiting it (for whatever their nefarious aims are). White hats have very little incentive to do so - bug bounties are a joke. So it may be worthwhile for a black hat to spend millions in security research, but it wouldn't for a white hat. The incentives are out of balance. This type of action presents a way to balance out the incentives. The good actor here only benefits by telling the world about the vulnerability, at which point any users can demand a fix or stop using the product (I realize this specific product is a bit tougher to stop using, but the point remains for most other cases).
- chillydawg 10y ago
  I dunno. It forces new entrants to not screw about when it comes to security. If there is a very real threat of a predatory security/short crew trying to take you down, you're going to invest in security and make sure your product is better.
- deleted 10y ago
  [deleted]
- dandermotj 10y ago
  This guy has three options: 1) short 2) go long 3) do nothing. Given he knows about this vulnerability, what is the "ethical" thing to do. But the stock? Don't engage? I think, in fact, he has a duty to short the stock.
- onewaystreet 10y ago
  Unless med companies start paying these security companies to find bugs (which they don't) they will need to find other ways to make money or stop looking all together.
- ourmandave 10y ago
  Is this an actual thing I have to worry about? Oh noes! The Russian hackers are gonna kill gma unless I pay 'em all the bitcoins!
Inthenameofmine 10y ago
I was just discussing this idea with friends the other day. It's definitely going to become big business, especially once these funds can take leveraged short positions. This is also a good way to finance very expensive investigative journalism. Just short the companies' you've found dirt on. Any idea why these models aren't huge already?
- beachstartup 10y ago
  > Any idea why these models aren't huge already? because successful traders don't tend to advertise their winning strategies. by the time some outfit like bloomberg is doing stories on it, rest assured it's already huge.
  - tptacek 10y ago
    How could it be huge without continuous media stories tying major vulnerabilities to stock price drops? This is the first such story anyone I know directly has been involved in. Also: in 20 years of working with companies on vulnerabilities, never once has this ever come up.
  - deleted 10y ago
    [deleted]
- joe_the_user 10y ago
  Well, There's a reason journalists have a code of (supposed) ethics. Anyone engaging in investigations for this kind of profit clearly has given up their claim to ordinary journalism (but hey, if this kind of business took off, things might be worth it).
  - loeg 10y ago
    What is the ethical implication here?
    - _asummers 10y ago
      Presumably that one might opportunistically look for and find dirt that might not actually be there due to financial motivations to do so. I think this could be mitigated by being really careful with what you find and how you craft that narrative, but that concern is there. If the story is really there, though, I don't see much of an ethical dilemma.
1337biz 10y ago
Wasn't weev trying to run a similar operation with hu is TRO LLC hedgefund? https://newrepublic.com/article/117477/andrew-weev-auernheimers-tro-llc-could-send-him-back-prison https://newrepublic.com/article/117477/andrew-weev-auernheim...
- r1b 10y ago
  Correct, weev is the progenitor of this idea.
joe_the_user 10y ago
Ianal but I find the idea of this approach being legal to be astounding. If nothing else, many firm have attempted to sue security researchers for computer intrusion - if nothing else, based on the EULA not allowing that kind of thing. I used to think of that kind of lawsuit as really sleazy but with this, everything seems fair game. Plus it seems possible that libel or insider-trader laws could be leveraged here given that they too are pretty flexible. Anyway, pure speculation, I'd be curious what lawyers thought.
- maxerickson 10y ago
  Characterizing flaws in a publicly available product is not anywhere near insider trading. It's obviously research, not proprietary information. It's also likely to be quite easy to avoid libel/slander. Just specify when you obtained the product and demonstrate the flaw in the product you obtained. edit edit: reading fail.
  - armitron 10y ago
    Except that demonstrating a flaw _by predatory profit-driven entities that have a direct stake in said flaw_ leaves plenty of room for spin and hype. This is already obvious if you read the MW report, some of the "vulnerabilities" are so contrived that the real-world impact is miniscule if not entirely absent, yet they present them (whilst omitting key facts and occulting others) in such a way as to elicit a certain response from the readers. Given that security is not a solved problem, by far, if you allow this sort of behavior you're opening up the gates of Hell. There needs to be an objective overseer, that is not profit-driven, for proper evaluation. This Muddy Waters-MedSec fiasco is evoking memories of the Wild West and is surely not where we want to end up.
    - twblalock 10y ago
      > There needs to be an objective overseer, that is not profit-driven, for proper evaluation. This Muddy Waters-MedSec fiasco is evoking memories of the Wild West and is surely not where we want to end up. So, another Federal bureaucracy? Or what? And how could you guarantee that such a body would remain objective, and avoid regulatory capture? I think the solution you propose could easily be worse than the problem.
cs702 10y ago
Isn't this analogous to buying property insurance on your neighbor's home and then posting instructions for breaking into it on the Internet? Or shorting a bank stock and then posting instructions for electronically stealing millions from it? I'm not sure this is a good thing. Potentially, it's a slippery slope from making it easy for others to attack a company, to encouraging others to attack the company, to actually attacking the company... to benefit financially from a fall in the company's stock price. At the extreme, this reminds me of the character Le Chifre in the Bond movie "Casino Royale," who at one point purchases put options on an airplane manufacturer and simultaneously hires a terrorist to destruct the company's new prototype airliner to profit from the declining stock price.[1] [1] https://en.wikipedia.org/wiki/Le_Chiffre#2006_film_biography https://en.wikipedia.org/wiki/Le_Chiffre#2006_film_biography
- cloudjacker 10y ago
  > from a fall in the company's stock price Under the presupposition that fictionally inflated prices in your 401k are a good thing. More accurate prices of equities are better for the health of the market. The financial motivation should be the incentive to avoid delaying the inevitable.
redthrowaway 10y ago
That's a great idea, and far more likely to lead to real change than simply informing the company. Wipe away millions of the CEO's equity, then watch how quickly it gets fixed.
iraklism 10y ago
I was just thinking about this last night. I've discovered a pretty serious security issue with a leading manufacturer of IP cameras. To keep it short you can takeover every single camera that is connected to the cloud (not by randomly enumeration of the devices, you have access to the central database with more than 1mil connected devices). I did the "right" thing. If I'm lucky I'm probably going to get a 4 digit bounty and a nice blog post for my CV. But I can't help to think what would happen if I handed this to a competitor or just shorted the company (listed with billions market cap) and helped create a nice clickbaity media shitstorm.
- tptacek 10y ago
  I think you'd find the company's competitors pretty disinterested. You might find that doing so simply gets your bug disclosed to the vendor through its competitors, costing you credit and the bounty and potentially some legal fees.
- iaw 10y ago
  I'd be concerned that taking any action with securities could be construed as insider trading (the SEC has been expanding the definition recently). On the idea of giving/selling the information to a competitor (possibly for some stock as well) seems like a reasonable course of action. The current bug reporting environment doesn't properly motivate some companies to fix their issues and reward the people that find them, maybe develop one that does. If a company letting fatal security issues through became a competitive problem, we may stop seeing as many fatal security issues.
  - eli 10y ago
    I don't understand. What would a competitor do with a flaw in someone else's product? Exploit it? Release it? Having a hard time imagining they would pay more than the company itself.
    - iaw 10y ago
      Publicize on it. Imagine an ad where they demonstrate how flawed their competitors product is by showing you anyone can watch you on it?
jwatte 10y ago
We're living in William Gibson's world. There just less neon than he imagined!
rotskoff 10y ago
This situation seems colored by the specifics of the case. The questions of morality and ethics wouldn't be involved were the company in question, say, a cybersecurity firm. In that case, it might seem perfectly reasonable to use this type knowledge advantage as a means to beat the market, especially if the firm were unwilling to pay directly for the information. The origin of this sort of behavior, it seems to me, is a lack of understanding on the part of firms. If St. Jude's appreciated the market value of securing its devices, it would surely pay for the exploit. However, there's an inefficiency in the market and this prompts "hackers" to seek alternative means to profit from the work and research that they've done. I personally would not engage in this type of exploitation, but these situations will lead companies to place more value on security of IOT and other connected devices than they currently do.
cm2187 10y ago
Not convinced it can really become common. Hacking can make attribution very hard and in certain jurisdictions (Russia), many intrusions aren't even illegal, and when they are, very hard to prove even if you know the culprit. A transaction on a US stock market on the other hand is very easy to track (based on very heavy regulations on Know Your Customer, and regulators can search in minutes who shorted a given stock on a given day) and market abuses laws themselves carry multiple years jail sentences for insider dealing. So for a hacker to profit from short-selling, he has to take considerably more risks. Much easier to sell the data to a competitor or anyone else.
aaron695 10y ago
"Lumber Liquidators Holdings Inc.’s stock plunge over the past week, fueled by allegations of excessive formaldehyde in its flooring, can be traced back to a blog post from an obscure 25-year-old short seller." http://www.bloomberg.com/news/articles/2015-03-04/how-a-25-year-old-investor-spurred-lumber-liquidators-plunge http://www.bloomberg.com/news/articles/2015-03-04/how-a-25-y...
dforrestwilson1 10y ago
There are plenty of hedge funds that do this already, sometimes they put up a blog post. Sometimes they simply "talk their book". To the degree that informed investors own the stock, the stock will or won't react. An example of a short thesis which the market has judged to be baseless despite the hype: http://www.reuters.com/article/us-dish-network-kerrisdale-idUSKCN0XW2AY http://www.reuters.com/article/us-dish-network-kerrisdale-id... Institutional investors have held onto DISH stock since, because while Dish may not be doing great, it is not failing for the reasons Kerrisdale has pitched. The predatory sort of shorting - pumping and dumping, is most common in penny stocks or stocks heavily owned by retail investors. These "investors" don't do their own research, they don't read 10-Ks, and they believe every little thing they read on the internet. An example of a stock which has been pumped and dumped for years is ORMP: http://seekingalpha.com/symbol/ORMP http://seekingalpha.com/symbol/ORMP In the aggregate I believe that short sellers serve a useful purpose, adjusting valuations down for stocks which do not merit their current price.

181 points by ISL 10y ago

(Disclosure: I'm working on a med device security startup.) Taking public short positions, then publicizing vulnerabilities is perhaps the shittiest way to ensure patients are not harmed by these vulnerabilities. I wonder if Carson Block would be as enthusiastic about this approach if his grandmother had a St. Jude ICD in her chest.

ISL 10y ago
There may be some white-hat middle ground; disclose the vulnerability to the vendor, wait 90 days, if no patch has been released/recall initiated, it's open season for the short sellers....
- IshKebab 10y ago
  That doesn't exactly incentivise the vendor to prevent future vulnerabilities though.
- tomp 10y ago
  No, the problem is that these companies don't pay the fair price (i.e. what their unvestors stand to lose if knowledge of this vulnerability is disclosed) to the researchers. Personally, I don't feel any kind of moral obligation to essentially sponsor the investors of these companies (if I were a security researcher).
  - dsfyu404ed 10y ago
    If I have a 95% chance of losing a dollar from a vulnerability. I'm not gonna pay you a dollar for it. I have a 100% chance of losing a dollar that way and a 95% chance if I don't. Even if I buy it from you it may cost me 50 cents to fix it. Then I lose $1.50. If I pay you 45 cents then I break even if the process scales up to tons of $1 95% vulnerabilities that can be fixed for 50 cents. Fair price is a pipe dream. But considering the huge sums of money that are involved something more than "here's $500, thanks for your time" would be nice. As it stands if you're good at breaking stuff you can make more money breaking it for the bad guys than for the good guys. No other industry has this problem. E.g. a good lockpicker or safe cracker can make more money performing his/her trade legitimately.
    - SolarNet 10y ago
      I think the point of short selling is an activist way of saying "Have a fair price or see your stock price plummet when we do it the other way."
bink 10y ago
While what he's doing is completely unethical, I don't know if I'd go so far as to say it's putting anyone at risk. Placing a call to an investment firm to short a stock shouldn't take so long as to delay the release of an advisory. That being said I don't like what I'm seeing in some parts of the security community as of late. Security is becoming a misnomer as companies and groups are actively hoarding and selling vulnerabilities and making us all less safe.
- chillydawg 10y ago
  Companies like google, facebook and microsoft are forced to spend bajillions either finding their own bugs and fixing them or buying the bugs and fixing them. Can you imagine the fallout of a massive google or facebook data breach? It's probably their single biggest risk. I rest easy at night knowing $100bn+ firms have a very strong economic incentive to find and fix security flaws of all kinds.
  - SSLy 10y ago
    which sony isn't…
- lawnchair_larry 10y ago
  Or is it the manufacturer being unethical?
- harmegido 10y ago
  I don't view this as unethical. I think it actually promotes security. Consider that there are lots of products out there with serious vulnerabilities that no one knows about. A bad actor has tons of incentive to try to find these and keep it secret while exploiting it (for whatever their nefarious aims are). White hats have very little incentive to do so - bug bounties are a joke. So it may be worthwhile for a black hat to spend millions in security research, but it wouldn't for a white hat. The incentives are out of balance. This type of action presents a way to balance out the incentives. The good actor here only benefits by telling the world about the vulnerability, at which point any users can demand a fix or stop using the product (I realize this specific product is a bit tougher to stop using, but the point remains for most other cases).
chillydawg 10y ago
I dunno. It forces new entrants to not screw about when it comes to security. If there is a very real threat of a predatory security/short crew trying to take you down, you're going to invest in security and make sure your product is better.
deleted 10y ago
[deleted]
dandermotj 10y ago
This guy has three options: 1) short 2) go long 3) do nothing. Given he knows about this vulnerability, what is the "ethical" thing to do. But the stock? Don't engage? I think, in fact, he has a duty to short the stock.
onewaystreet 10y ago
Unless med companies start paying these security companies to find bugs (which they don't) they will need to find other ways to make money or stop looking all together.
ourmandave 10y ago
Is this an actual thing I have to worry about? Oh noes! The Russian hackers are gonna kill gma unless I pay 'em all the bitcoins!

Inthenameofmine 10y ago

I was just discussing this idea with friends the other day. It's definitely going to become big business, especially once these funds can take leveraged short positions. This is also a good way to finance very expensive investigative journalism. Just short the companies' you've found dirt on. Any idea why these models aren't huge already?

beachstartup 10y ago
> Any idea why these models aren't huge already? because successful traders don't tend to advertise their winning strategies. by the time some outfit like bloomberg is doing stories on it, rest assured it's already huge.
- tptacek 10y ago
  How could it be huge without continuous media stories tying major vulnerabilities to stock price drops? This is the first such story anyone I know directly has been involved in. Also: in 20 years of working with companies on vulnerabilities, never once has this ever come up.
- deleted 10y ago
  [deleted]
joe_the_user 10y ago
Well, There's a reason journalists have a code of (supposed) ethics. Anyone engaging in investigations for this kind of profit clearly has given up their claim to ordinary journalism (but hey, if this kind of business took off, things might be worth it).
- loeg 10y ago
  What is the ethical implication here?
  - _asummers 10y ago
    Presumably that one might opportunistically look for and find dirt that might not actually be there due to financial motivations to do so. I think this could be mitigated by being really careful with what you find and how you craft that narrative, but that concern is there. If the story is really there, though, I don't see much of an ethical dilemma.

1337biz 10y ago

Wasn't weev trying to run a similar operation with hu is TRO LLC hedgefund? https://newrepublic.com/article/117477/andrew-weev-auernheimers-tro-llc-could-send-him-back-prison https://newrepublic.com/article/117477/andrew-weev-auernheim...

r1b 10y ago
Correct, weev is the progenitor of this idea.

joe_the_user 10y ago

Ianal but I find the idea of this approach being legal to be astounding. If nothing else, many firm have attempted to sue security researchers for computer intrusion - if nothing else, based on the EULA not allowing that kind of thing. I used to think of that kind of lawsuit as really sleazy but with this, everything seems fair game. Plus it seems possible that libel or insider-trader laws could be leveraged here given that they too are pretty flexible. Anyway, pure speculation, I'd be curious what lawyers thought.

maxerickson 10y ago
Characterizing flaws in a publicly available product is not anywhere near insider trading. It's obviously research, not proprietary information. It's also likely to be quite easy to avoid libel/slander. Just specify when you obtained the product and demonstrate the flaw in the product you obtained. edit edit: reading fail.
- armitron 10y ago
  Except that demonstrating a flaw _by predatory profit-driven entities that have a direct stake in said flaw_ leaves plenty of room for spin and hype. This is already obvious if you read the MW report, some of the "vulnerabilities" are so contrived that the real-world impact is miniscule if not entirely absent, yet they present them (whilst omitting key facts and occulting others) in such a way as to elicit a certain response from the readers. Given that security is not a solved problem, by far, if you allow this sort of behavior you're opening up the gates of Hell. There needs to be an objective overseer, that is not profit-driven, for proper evaluation. This Muddy Waters-MedSec fiasco is evoking memories of the Wild West and is surely not where we want to end up.
  - twblalock 10y ago
    > There needs to be an objective overseer, that is not profit-driven, for proper evaluation. This Muddy Waters-MedSec fiasco is evoking memories of the Wild West and is surely not where we want to end up. So, another Federal bureaucracy? Or what? And how could you guarantee that such a body would remain objective, and avoid regulatory capture? I think the solution you propose could easily be worse than the problem.

cs702 10y ago

Isn't this analogous to buying property insurance on your neighbor's home and then posting instructions for breaking into it on the Internet? Or shorting a bank stock and then posting instructions for electronically stealing millions from it? I'm not sure this is a good thing. Potentially, it's a slippery slope from making it easy for others to attack a company, to encouraging others to attack the company, to actually attacking the company... to benefit financially from a fall in the company's stock price. At the extreme, this reminds me of the character Le Chifre in the Bond movie "Casino Royale," who at one point purchases put options on an airplane manufacturer and simultaneously hires a terrorist to destruct the company's new prototype airliner to profit from the declining stock price.[1] [1] https://en.wikipedia.org/wiki/Le_Chiffre#2006_film_biography https://en.wikipedia.org/wiki/Le_Chiffre#2006_film_biography

cloudjacker 10y ago
> from a fall in the company's stock price Under the presupposition that fictionally inflated prices in your 401k are a good thing. More accurate prices of equities are better for the health of the market. The financial motivation should be the incentive to avoid delaying the inevitable.

redthrowaway 10y ago

That's a great idea, and far more likely to lead to real change than simply informing the company. Wipe away millions of the CEO's equity, then watch how quickly it gets fixed.

iraklism 10y ago

I was just thinking about this last night. I've discovered a pretty serious security issue with a leading manufacturer of IP cameras. To keep it short you can takeover every single camera that is connected to the cloud (not by randomly enumeration of the devices, you have access to the central database with more than 1mil connected devices). I did the "right" thing. If I'm lucky I'm probably going to get a 4 digit bounty and a nice blog post for my CV. But I can't help to think what would happen if I handed this to a competitor or just shorted the company (listed with billions market cap) and helped create a nice clickbaity media shitstorm.

tptacek 10y ago
I think you'd find the company's competitors pretty disinterested. You might find that doing so simply gets your bug disclosed to the vendor through its competitors, costing you credit and the bounty and potentially some legal fees.
iaw 10y ago
I'd be concerned that taking any action with securities could be construed as insider trading (the SEC has been expanding the definition recently). On the idea of giving/selling the information to a competitor (possibly for some stock as well) seems like a reasonable course of action. The current bug reporting environment doesn't properly motivate some companies to fix their issues and reward the people that find them, maybe develop one that does. If a company letting fatal security issues through became a competitive problem, we may stop seeing as many fatal security issues.
- eli 10y ago
  I don't understand. What would a competitor do with a flaw in someone else's product? Exploit it? Release it? Having a hard time imagining they would pay more than the company itself.
  - iaw 10y ago
    Publicize on it. Imagine an ad where they demonstrate how flawed their competitors product is by showing you anyone can watch you on it?

jwatte 10y ago

We're living in William Gibson's world. There just less neon than he imagined!

rotskoff 10y ago

This situation seems colored by the specifics of the case. The questions of morality and ethics wouldn't be involved were the company in question, say, a cybersecurity firm. In that case, it might seem perfectly reasonable to use this type knowledge advantage as a means to beat the market, especially if the firm were unwilling to pay directly for the information. The origin of this sort of behavior, it seems to me, is a lack of understanding on the part of firms. If St. Jude's appreciated the market value of securing its devices, it would surely pay for the exploit. However, there's an inefficiency in the market and this prompts "hackers" to seek alternative means to profit from the work and research that they've done. I personally would not engage in this type of exploitation, but these situations will lead companies to place more value on security of IOT and other connected devices than they currently do.

cm2187 10y ago

Not convinced it can really become common. Hacking can make attribution very hard and in certain jurisdictions (Russia), many intrusions aren't even illegal, and when they are, very hard to prove even if you know the culprit. A transaction on a US stock market on the other hand is very easy to track (based on very heavy regulations on Know Your Customer, and regulators can search in minutes who shorted a given stock on a given day) and market abuses laws themselves carry multiple years jail sentences for insider dealing. So for a hacker to profit from short-selling, he has to take considerably more risks. Much easier to sell the data to a competitor or anyone else.

aaron695 10y ago

"Lumber Liquidators Holdings Inc.’s stock plunge over the past week, fueled by allegations of excessive formaldehyde in its flooring, can be traced back to a blog post from an obscure 25-year-old short seller." http://www.bloomberg.com/news/articles/2015-03-04/how-a-25-year-old-investor-spurred-lumber-liquidators-plunge http://www.bloomberg.com/news/articles/2015-03-04/how-a-25-y...

dforrestwilson1 10y ago

There are plenty of hedge funds that do this already, sometimes they put up a blog post. Sometimes they simply "talk their book". To the degree that informed investors own the stock, the stock will or won't react. An example of a short thesis which the market has judged to be baseless despite the hype: http://www.reuters.com/article/us-dish-network-kerrisdale-idUSKCN0XW2AY http://www.reuters.com/article/us-dish-network-kerrisdale-id... Institutional investors have held onto DISH stock since, because while Dish may not be doing great, it is not failing for the reasons Kerrisdale has pitched. The predatory sort of shorting - pumping and dumping, is most common in penny stocks or stocks heavily owned by retail investors. These "investors" don't do their own research, they don't read 10-Ks, and they believe every little thing they read on the internet. An example of a stock which has been pumped and dumped for years is ORMP: http://seekingalpha.com/symbol/ORMP http://seekingalpha.com/symbol/ORMP In the aggregate I believe that short sellers serve a useful purpose, adjusting valuations down for stocks which do not merit their current price.