19 ms·

DOJ: Hackers broke into an SEC database and made millions from inside info

448 points by djoldman 8y ago

deleted 8y ago
[deleted]
gammateam 8y ago
> said the same criminals also stole advance press releases sent to three newswire services Yeah I remember the charges against those people too Basically newswire services get hacked and people get the earnings reports beforehand SEC gets hacked and people get the earnings reports beforehand I think public resources shouldnt be spent on that. Prosecute the hacking but just drop the “trading on material non public information but only in the equities capital markets and only when there is a duty from the source to keep things nondisclosed” sanctions. It is so narrow but extremely expensive to prosecute, has with little efficacy in stopping the behavior, and incorrectly effects the collective conscious on what can be traded and when. People at this point think its actually illegal to have a trading advantage in any context
- dnadler 8y ago
  I don't understand your argument for not prosecuting MNPI trading. Are you saying that because the general public doesn't understand what MNPI is, the law shouldn't be enforced? Are you taking issue with reason the law exists, or just that the people don't understand it? And what's your basis for saying it's ineffective? From my experience, insider trading laws are taken very seriously by most of the industry.
  - gammateam 8y ago
    > basis for saying its ineffective Yes, they are effective at chilling speech and forms of legal trading. They are not effective at preventing trading on information, for example, the SEC and DOJ secured indictments against Ukrainians and Russians which it will never extradite. Wow a pen stroke after an expensive investigation, congratulations. Fix your damn IT systems if you want confidence in the securities market. > are you taking issue with reason the law exists Yes, I am. The industry takes these laws seriously without the SEC because all the SROs already had these prohibitions before the SEC copied and pasted some parts into the Code of Federal Regulations or created 10b-5 convictions that are SOMETIMES upheld by appeals courts before stripping them down in other circuits.
- rocqua 8y ago
  Insider trading is a balance. On the one hand, we want market prices to be accurate. This means we want people with material information to trade on that information. On the other hand, we need some fairness in a market. This is mostly to ensure people keep trading. In a world were inside-info is commonplace, trading without it is just stupid. This would cut off a lot of people from investing. The line needs to be drawn somewhere. The US approach of insider trading requires a broken 'duty to keep secret' isn't nice, but considering the above trade-off I think it is better than "All non-public information is off-limits". Especially because it captures the 'most disruptive' form of insider trading: people who work at a company that is getting acquired / going bankrupt.
  - JumpCrisscross 8y ago
    > On the other hand, we need some fairness in a market American insider trading law has nothing to do with fairness. It is based on theft of information. In this case, the hacker’s stole information from the SEC that belonged to the reporting companies. (This is a commonly misunderstood alley of securities law.)
    - beaconstudios 8y ago
      if that were the case, it would be legal for a company director to trade on information they gleaned from an internal meeting. Which, as far as I understand, it isn't.
      - mruts 8y ago
        That’s theft from the corporation they work for. GP is 100% correct in this case. Just read Matt Levine’s Money Stuff. He goes over this stuff a lot.
        EpicEng 8y ago
        I'm not disagreeing with you because I have no clue about this stuff, but man that is an odd usage of the word 'theft'. Sounds more like improper use to me, e.g., getting a speeding ticket while using a company truck. I didn't steal the truck, but I used it in a way which is unlawful.
illgenr 8y ago
Is there a reason why all SEC filing shouldn't be immediately publicly available?
- ceejayoz 8y ago
  Yes - so they're not released while the markets are open.
  - aqme28 8y ago
    Just curious -- why does that matter? In either case there's a single moment wherein people can trade on it. Why is it better for that moment to be at 9:30 instead of say noon?
    - rocqua 8y ago
      I guess it prevents people hammering the servers to get the earning reports ASAP. With this, people have a few hours to get the reports which means miliseconds matter less.
      - nostrademons 8y ago
        ...which happens anyway. Starting 5-10 minutes before the official earnings reports come out, investor.google.com gets hammered by bots, requesting every few milliseconds until the actual page is released. I knew an SRE that wanted to put up a fake earnings report until the official time at which the real one was released, to disincentivize this behavior, but the lawyers nixed that idea really quick.
        crumpets 8y ago
        Why didn't they just decide to delay the posting by 30 seconds? It's not like that would deter regular users but it completely eliminates the high speed trading case.
        8y ago
CedarHill 8y ago
Seems vaguely similar to another Insider Trading case relating to Slavic-descent and Marketwire: https://www.bloomberg.com/news/articles/2018-07-06/pastor-convicted-in-international-hacking-insider-trading-scam https://www.bloomberg.com/news/articles/2018-07-06/pastor-co...
roadkillon101 8y ago
I'm more curious about how they hacked into the SEC database? Did they use an email trojan? Exploit an existing flaw or backdoor? If they did this via e-mail, who did they send the mail to?
- devin 8y ago
  This is covered in the story. They sent email to SEC employees.
- tgragnato 8y ago
  The SEC’s complaint alleges that Ieremenko circumvented EDGAR controls that require user authentication and then navigated within the EDGAR system. Looks like a way to say “exfiltrating data from the endpoints”.
- lawnchair_larry 8y ago
  The good old email trojan continues to be all you need.
- deleted 8y ago
  [deleted]
- unwabuisi 8y ago
  > The hackers used malicious software sent via email to SEC employees. Then, after planting the software on the SEC computers, they sent the information they were able to gather from the EDGAR system to servers in Lithuania, where they either used it or distributed the data to other criminals, Carpenito said.
da_chicken 8y ago
So, basically, Trading Places but online?
snissn 8y ago
That's pretty smart
danaos 8y ago
Former discussion with backstory of the Ukrainian case: https://news.ycombinator.com/item?id=17831975 https://news.ycombinator.com/item?id=17831975
JumpCrisscross 8y ago
> The New York Stock Exchange has asked the SEC to consider limiting the amount of data collected by the CAT, which would include data on around 58 billion daily trades, as well as the personal details of individuals making the trades, including their Social Security numbers and dates of birth Dropping SSNs for natural persons would be a good idea.
- wtvanhest 8y ago
  IMO, everyone's SSN should be public. Mine has already be compromised by both my undergrad and grad school. At this point, I operate under the assumption that it is public knowledge for bad actors. Hiding SSNs is false security at best. If they were public, banks would stop hiding behind "identity theft" and would start having to acknowledge that its their responsibility to confirm who they are lending money to.
  - smaddox 8y ago
    This is actually a great idea, as long as the government makes clear the plan to do this, and gives banks et al time to adjust.
  - aboutruby 8y ago
    And yet many services rely on SSN for identity verification in the US (e.g. banks, telecoms, etc.)
    - gtirloni 8y ago
      You mean they rely solely on someone dictating a SSN number? That's insane. They should ask for a official ID with photo, as the very minimum. Is that something that goes against the American culture? The other day I had to give all 10 fingerprints to renew my driver's license (location: South America) and nobody seemed to care.
      - mplewis 8y ago
        That'll be leaked eventually, too.
deleted 8y ago
[deleted]
eggie5 8y ago
This isn't hard to believe if you've worked w/ the Edgar system!
- jefe_ 8y ago
  Not a security complaint but an annoying experience with the system: Sat down one Saturday to create a database for their Financial Statement and Notes data set https://www.sec.gov/dera/data/financial-statement-and-notes-data-set.html https://www.sec.gov/dera/data/financial-statement-and-notes-... Located documentation, thought okay this shouldn't be too bad. Ended up taking one day to understand the structure and another to implement the system. Finally got everything loaded in my tables and spot checked against the rendered versions on their website only to discover they truncate the most important text field. It's technically in the documentation that the value field is limited to 2048, but it's also in the documentation that the value field is for 'text analysis applications' and their website literally says: 'The information is presented without change from the "as filed" financial reports submitted by each registrant...' so I managed to gloss over this detail until I had already spent and entire weekend working on it. I just can't wrap my mind around how they got 99% of the way there and then decided, 'hey lets just truncate this field, it's only the entire purpose of this dataset.'
  - elliekelly 8y ago
    > I just can't wrap my mind around how they got 99% of the way there and then decided, 'hey lets just truncate this field, it's only the entire purpose of this dataset.' I'm willing to bet this is because they haven't made any significant changes to the system since it was implemented in 1996.
- eclipticplane 8y ago
  Calling it a "system" is an offense to all other systems.
bredren 8y ago
Pending public publishing seems to be a common liability for unwanted content disclosures. Apple struggles with this with almost every product release.
stevespang 8y ago
Just waiting for Elon Musk to tweet a dig on the SEC about this
btbuildem 8y ago
People make money off advance information all the time. Often you can see that in the price action -- take this for example: https://imgur.com/mJq1OcY https://imgur.com/mJq1OcY Three days before a positive press release, demand pressure beings to drive up the price. Coincidence? I'm too jaded to believe that.
- marcoperaza 8y ago
  It's worth noting that trading spikes in advance of public availability of news doesn't necessarily imply illegal activity. Overheard conversations between strangers, for example, are fair game.
  - jandrese 8y ago
    There is probably also magnification effects from bots scanning the market for anomalies and piling on.
  - all_blue_chucks 8y ago
    > Overheard conversations between strangers, for example, are fair game. Wrong. It's insider trading if you have material, nonpublic information. It doesn't matter how you got that information.
    - marcoperaza 8y ago
      >Wrong. It's insider trading if you have material, nonpublic information. It doesn't matter how you got that information. You are totally mistaken as far as the law in the United States. I can’t speak for other jurisdictions.
      - rrdharan 8y ago
        As I posted above, the poster is not mistaken.
        marcoperaza 8y ago
lambdasquirrel 8y ago
How did they do this and only make a few million?...
- jandrese 8y ago
  I'm guessing they didn't have a lot of money at their disposal.
- Drdrdrq 8y ago
  This is probably all the prosecutors can prove.
- ghayes 8y ago
  Matt Levine discussed this topic in Money Stuff today: https://www.bloomberg.com/opinion/articles/2019-01-16/even-cheaters-don-t-always-win https://www.bloomberg.com/opinion/articles/2019-01-16/even-c... Long-story short is that it's not always obvious how the market will react to releases. Some of the hackers only traded with a ~70% win-rate after holding the releases.
  - AznHisoka 8y ago
    70% is still very very high. They didnt make billions because they probably started with little capital.
    - zorga 8y ago
      70% is extremely high, you can easily get rich with a 51% advantage and making enough small bets to invoke the law of large numbers.
      - lambdasquirrel 8y ago
        That, and depending on the companies they got data on (i.e. any number of widely traded stocks with large market caps), they could have had a LOT of volume to play with. This is a big deal and it's mind-boggling that the breach happened.
hkmurakami 8y ago
Related reading: today's Matt Levine piece on how hard it is to make money even with this info. https://www.bloomberg.com/opinion/articles/2019-01-16/even-cheaters-don-t-always-win https://www.bloomberg.com/opinion/articles/2019-01-16/even-c...
- AznHisoka 8y ago
  They make successful trades 77% of the time they had insider information and 45% when they didnt. That clearly is an advantage. I would never expect a 90% success rate because of how random Wall Street is, but 77% over a period of time definitely is an advantage.
  - cheeze 8y ago
    That's a huge advantage. Counting cards in blackjack gives a 50.5:49.5 edge (roughly, there are variables). 77% is absolutely crushing it.
  - perl4ever 8y ago
    If I read it correctly, they were successful 77% of the time with inside info and 0% without, averaging 45%.
- ChuckMcM 8y ago
  I also like his take on the WeWork fiasco.
  - zepearl 8y ago
    Is it a fiasco or is it just "shady business" but still successful? Really just asking because I never heard about that company but saw a few days ago a post about its split into different sectors all having their names starting with "We..." and did not dig further (and I did not find anything useful today using my keywords).
    - jessaustin 8y ago
AnonQ 8y ago
My Twitter Name is Killuminati Country
AnonQ 8y ago
https://www.fbi.gov/@@search?SearchableText=Unclassified+2019&pageSize=20&page=1 https://www.fbi.gov/@@search?SearchableText=Unclassified+201...
jaimex2 8y ago
I take it they would have gotten away with it if they did it from Russia?
Hacker_Support 8y ago
DO YOU WANT TO RECOVER ALL YOUR MONEY STOLEN FROM BINARY OPTIONS AND CAPITAL INVESTMENTS??? Errrrmagerrrd!” Screams every second ad on the comment sections of every site. "Hello everyone! If you require the service of a professional hacker to help recover every penny of your lost funds easily in 2hrs with just a little amount of money bla bla bla... If you are reading this for that kinda thing, i am gonna tell it to you straight: this post isn't what you are looking for. Don’t waste the next 8 minutes of your life reading this, because none of these type of Ads “hacks” will save your lost fund with a little amount of money in 2hrs!! Instead you will be scammed again by low life scumbags! The costs will depend on the number and complexities of the systems you wish to have tested and how thorough a test you want to do. Naturally the large companies tend to be more expensive, but it is also a fair price. Of course, hiring someone to access any system you do not own of have permission to test is highly illegal almost everywhere. Doing to could end with a criminal record, hefty fine and jail time, so very few real hackers like us are willing to risk it without substantial remuneration. You may find some people (even on here) claiming to be hackers. They will either: take your money and not do anything take your money and also steal your identity and try to empty your credit card and bank accounts attempt to do a half-assed hack, get caught and turn you in because they are not good enough to hide their trail Be law enforcement These are good reasons for you to be careful hiring hackers anonymously. Hiring a hacker these days is a bit difficult because lots of people fall for scams. Does that mean there aren't real hackers online? NO definitely!! You can either do two things: You can either go to court or just hire a hacker at HackerOne. HackerOne is very familiar with the fraudsters' strategies and frequently can steer a course to a resolution through one way or another as there are often other organisations that facilitate, may be unwittingly, or are actually part of the deception. The step of last resort, legal action, is understandably daunting for a person who often has lost significant amounts of money in this way.  HackerOne fully recognises that such an experience will leave a victim decidedly risk adverse. In order to off-set the risk HackerOne has developed strategies to combat the financial risks of litigation. HackerOne has a track record of recovery in relation to financial fraud, with many strategies and tactics to hack the fraudulent broker to restore funds to their former clients. At HackerOne, we have different hackers up to any task. Some Of These Hackers Includes PETER YAWORSKI, FRANS ROSEN, JACK CABLE, JOBERT ABMA, ARNE SWINNEN And More HackerOne Official is available 24/7, And You Can Also Contact us for other Technical Hacking Services you desire Such as: * WEBSITE HACKING * PHONE HACKING (giving you Unnoticeable access to everything Happening on the Target’s Phone) * LOCATION TRACKING * CLEARING OF CRIMINAL RECORDS * SOCIAL MEDIA ACCOUNTS HACKING etc>>> Make foundings about us. Check our profile on our site to see what we've achieved. Ask us questions. We prove ourselves beyond reasonable doubts on all Hacking jobs. Be sure you are making the right decision. Don't just make payment without knowing what approach specifically. You need a professional hacker? Send a mail to >>> info.hackerone@gmail.com Be safe out there. Cheers!!
zeveb 8y ago
The fact that the SEC can't secure this sort of information is an excellent argument against key escrow and government backdoors into crypto systems: it's completely impossible to prevent leakage or theft of that sort of incredibly-valuable information.
gene_vache 8y ago
> Hackers broke into an SEC database and made millions from inside info Given the thirty minute window between copying the file to the server and the SEC posting the URL, I figure they guessed the URL from an easily predicted sequence.
flatfilefan 8y ago
Do the journalists believe Lithuania and Ukraine still somehow belong to Russia? I can’t see any explanation in the article on how was Russia involved.

448 points by djoldman 8y ago

deleted 8y ago

[deleted]

> said the same criminals also stole advance press releases sent to three newswire services Yeah I remember the charges against those people too Basically newswire services get hacked and people get the earnings reports beforehand SEC gets hacked and people get the earnings reports beforehand I think public resources shouldnt be spent on that. Prosecute the hacking but just drop the “trading on material non public information but only in the equities capital markets and only when there is a duty from the source to keep things nondisclosed” sanctions. It is so narrow but extremely expensive to prosecute, has with little efficacy in stopping the behavior, and incorrectly effects the collective conscious on what can be traded and when. People at this point think its actually illegal to have a trading advantage in any context

dnadler 8y ago
I don't understand your argument for not prosecuting MNPI trading. Are you saying that because the general public doesn't understand what MNPI is, the law shouldn't be enforced? Are you taking issue with reason the law exists, or just that the people don't understand it? And what's your basis for saying it's ineffective? From my experience, insider trading laws are taken very seriously by most of the industry.
- gammateam 8y ago
  > basis for saying its ineffective Yes, they are effective at chilling speech and forms of legal trading. They are not effective at preventing trading on information, for example, the SEC and DOJ secured indictments against Ukrainians and Russians which it will never extradite. Wow a pen stroke after an expensive investigation, congratulations. Fix your damn IT systems if you want confidence in the securities market. > are you taking issue with reason the law exists Yes, I am. The industry takes these laws seriously without the SEC because all the SROs already had these prohibitions before the SEC copied and pasted some parts into the Code of Federal Regulations or created 10b-5 convictions that are SOMETIMES upheld by appeals courts before stripping them down in other circuits.
rocqua 8y ago
Insider trading is a balance. On the one hand, we want market prices to be accurate. This means we want people with material information to trade on that information. On the other hand, we need some fairness in a market. This is mostly to ensure people keep trading. In a world were inside-info is commonplace, trading without it is just stupid. This would cut off a lot of people from investing. The line needs to be drawn somewhere. The US approach of insider trading requires a broken 'duty to keep secret' isn't nice, but considering the above trade-off I think it is better than "All non-public information is off-limits". Especially because it captures the 'most disruptive' form of insider trading: people who work at a company that is getting acquired / going bankrupt.
- JumpCrisscross 8y ago
  > On the other hand, we need some fairness in a market American insider trading law has nothing to do with fairness. It is based on theft of information. In this case, the hacker’s stole information from the SEC that belonged to the reporting companies. (This is a commonly misunderstood alley of securities law.)
  - beaconstudios 8y ago
    if that were the case, it would be legal for a company director to trade on information they gleaned from an internal meeting. Which, as far as I understand, it isn't.
    - mruts 8y ago
      That’s theft from the corporation they work for. GP is 100% correct in this case. Just read Matt Levine’s Money Stuff. He goes over this stuff a lot.
      - EpicEng 8y ago
        I'm not disagreeing with you because I have no clue about this stuff, but man that is an odd usage of the word 'theft'. Sounds more like improper use to me, e.g., getting a speeding ticket while using a company truck. I didn't steal the truck, but I used it in a way which is unlawful.

illgenr 8y ago

Is there a reason why all SEC filing shouldn't be immediately publicly available?

ceejayoz 8y ago
Yes - so they're not released while the markets are open.
- aqme28 8y ago
  Just curious -- why does that matter? In either case there's a single moment wherein people can trade on it. Why is it better for that moment to be at 9:30 instead of say noon?
  - rocqua 8y ago
    I guess it prevents people hammering the servers to get the earning reports ASAP. With this, people have a few hours to get the reports which means miliseconds matter less.
    - nostrademons 8y ago
      ...which happens anyway. Starting 5-10 minutes before the official earnings reports come out, investor.google.com gets hammered by bots, requesting every few milliseconds until the actual page is released. I knew an SRE that wanted to put up a fake earnings report until the official time at which the real one was released, to disincentivize this behavior, but the lawyers nixed that idea really quick.
      - crumpets 8y ago
        Why didn't they just decide to delay the posting by 30 seconds? It's not like that would deter regular users but it completely eliminates the high speed trading case.
        8y ago

CedarHill 8y ago

Seems vaguely similar to another Insider Trading case relating to Slavic-descent and Marketwire: https://www.bloomberg.com/news/articles/2018-07-06/pastor-convicted-in-international-hacking-insider-trading-scam https://www.bloomberg.com/news/articles/2018-07-06/pastor-co...

roadkillon101 8y ago

I'm more curious about how they hacked into the SEC database? Did they use an email trojan? Exploit an existing flaw or backdoor? If they did this via e-mail, who did they send the mail to?

devin 8y ago
This is covered in the story. They sent email to SEC employees.
tgragnato 8y ago
The SEC’s complaint alleges that Ieremenko circumvented EDGAR controls that require user authentication and then navigated within the EDGAR system. Looks like a way to say “exfiltrating data from the endpoints”.
lawnchair_larry 8y ago
The good old email trojan continues to be all you need.
deleted 8y ago
[deleted]
unwabuisi 8y ago
> The hackers used malicious software sent via email to SEC employees. Then, after planting the software on the SEC computers, they sent the information they were able to gather from the EDGAR system to servers in Lithuania, where they either used it or distributed the data to other criminals, Carpenito said.

da_chicken 8y ago

So, basically, Trading Places but online?

snissn 8y ago

That's pretty smart

danaos 8y ago

Former discussion with backstory of the Ukrainian case: https://news.ycombinator.com/item?id=17831975 https://news.ycombinator.com/item?id=17831975

JumpCrisscross 8y ago

> The New York Stock Exchange has asked the SEC to consider limiting the amount of data collected by the CAT, which would include data on around 58 billion daily trades, as well as the personal details of individuals making the trades, including their Social Security numbers and dates of birth Dropping SSNs for natural persons would be a good idea.

wtvanhest 8y ago
IMO, everyone's SSN should be public. Mine has already be compromised by both my undergrad and grad school. At this point, I operate under the assumption that it is public knowledge for bad actors. Hiding SSNs is false security at best. If they were public, banks would stop hiding behind "identity theft" and would start having to acknowledge that its their responsibility to confirm who they are lending money to.
- smaddox 8y ago
  This is actually a great idea, as long as the government makes clear the plan to do this, and gives banks et al time to adjust.
- aboutruby 8y ago
  And yet many services rely on SSN for identity verification in the US (e.g. banks, telecoms, etc.)
  - gtirloni 8y ago
    You mean they rely solely on someone dictating a SSN number? That's insane. They should ask for a official ID with photo, as the very minimum. Is that something that goes against the American culture? The other day I had to give all 10 fingerprints to renew my driver's license (location: South America) and nobody seemed to care.
    - mplewis 8y ago
      That'll be leaked eventually, too.

deleted 8y ago

[deleted]

eggie5 8y ago

This isn't hard to believe if you've worked w/ the Edgar system!

jefe_ 8y ago
Not a security complaint but an annoying experience with the system: Sat down one Saturday to create a database for their Financial Statement and Notes data set https://www.sec.gov/dera/data/financial-statement-and-notes-data-set.html https://www.sec.gov/dera/data/financial-statement-and-notes-... Located documentation, thought okay this shouldn't be too bad. Ended up taking one day to understand the structure and another to implement the system. Finally got everything loaded in my tables and spot checked against the rendered versions on their website only to discover they truncate the most important text field. It's technically in the documentation that the value field is limited to 2048, but it's also in the documentation that the value field is for 'text analysis applications' and their website literally says: 'The information is presented without change from the "as filed" financial reports submitted by each registrant...' so I managed to gloss over this detail until I had already spent and entire weekend working on it. I just can't wrap my mind around how they got 99% of the way there and then decided, 'hey lets just truncate this field, it's only the entire purpose of this dataset.'
- elliekelly 8y ago
  > I just can't wrap my mind around how they got 99% of the way there and then decided, 'hey lets just truncate this field, it's only the entire purpose of this dataset.' I'm willing to bet this is because they haven't made any significant changes to the system since it was implemented in 1996.
eclipticplane 8y ago
Calling it a "system" is an offense to all other systems.

bredren 8y ago

Pending public publishing seems to be a common liability for unwanted content disclosures. Apple struggles with this with almost every product release.

stevespang 8y ago

Just waiting for Elon Musk to tweet a dig on the SEC about this

btbuildem 8y ago

People make money off advance information all the time. Often you can see that in the price action -- take this for example: https://imgur.com/mJq1OcY https://imgur.com/mJq1OcY Three days before a positive press release, demand pressure beings to drive up the price. Coincidence? I'm too jaded to believe that.

marcoperaza 8y ago
It's worth noting that trading spikes in advance of public availability of news doesn't necessarily imply illegal activity. Overheard conversations between strangers, for example, are fair game.
- jandrese 8y ago
  There is probably also magnification effects from bots scanning the market for anomalies and piling on.
- all_blue_chucks 8y ago
  > Overheard conversations between strangers, for example, are fair game. Wrong. It's insider trading if you have material, nonpublic information. It doesn't matter how you got that information.
  - marcoperaza 8y ago
    >Wrong. It's insider trading if you have material, nonpublic information. It doesn't matter how you got that information. You are totally mistaken as far as the law in the United States. I can’t speak for other jurisdictions.
    - rrdharan 8y ago
      As I posted above, the poster is not mistaken.
      - marcoperaza 8y ago

lambdasquirrel 8y ago

How did they do this and only make a few million?...

jandrese 8y ago
I'm guessing they didn't have a lot of money at their disposal.
Drdrdrq 8y ago
This is probably all the prosecutors can prove.
ghayes 8y ago
Matt Levine discussed this topic in Money Stuff today: https://www.bloomberg.com/opinion/articles/2019-01-16/even-cheaters-don-t-always-win https://www.bloomberg.com/opinion/articles/2019-01-16/even-c... Long-story short is that it's not always obvious how the market will react to releases. Some of the hackers only traded with a ~70% win-rate after holding the releases.
- AznHisoka 8y ago
  70% is still very very high. They didnt make billions because they probably started with little capital.
  - zorga 8y ago
    70% is extremely high, you can easily get rich with a 51% advantage and making enough small bets to invoke the law of large numbers.
    - lambdasquirrel 8y ago
      That, and depending on the companies they got data on (i.e. any number of widely traded stocks with large market caps), they could have had a LOT of volume to play with. This is a big deal and it's mind-boggling that the breach happened.

hkmurakami 8y ago

Related reading: today's Matt Levine piece on how hard it is to make money even with this info. https://www.bloomberg.com/opinion/articles/2019-01-16/even-cheaters-don-t-always-win https://www.bloomberg.com/opinion/articles/2019-01-16/even-c...

AznHisoka 8y ago
They make successful trades 77% of the time they had insider information and 45% when they didnt. That clearly is an advantage. I would never expect a 90% success rate because of how random Wall Street is, but 77% over a period of time definitely is an advantage.
- cheeze 8y ago
  That's a huge advantage. Counting cards in blackjack gives a 50.5:49.5 edge (roughly, there are variables). 77% is absolutely crushing it.
- perl4ever 8y ago
  If I read it correctly, they were successful 77% of the time with inside info and 0% without, averaging 45%.
ChuckMcM 8y ago
I also like his take on the WeWork fiasco.
- zepearl 8y ago
  Is it a fiasco or is it just "shady business" but still successful? Really just asking because I never heard about that company but saw a few days ago a post about its split into different sectors all having their names starting with "We..." and did not dig further (and I did not find anything useful today using my keywords).
  - jessaustin 8y ago

AnonQ 8y ago

My Twitter Name is Killuminati Country

AnonQ 8y ago

https://www.fbi.gov/@@search?SearchableText=Unclassified+2019&pageSize=20&page=1 https://www.fbi.gov/@@search?SearchableText=Unclassified+201...

jaimex2 8y ago

I take it they would have gotten away with it if they did it from Russia?

Hacker_Support 8y ago

DO YOU WANT TO RECOVER ALL YOUR MONEY STOLEN FROM BINARY OPTIONS AND CAPITAL INVESTMENTS??? Errrrmagerrrd!” Screams every second ad on the comment sections of every site. "Hello everyone! If you require the service of a professional hacker to help recover every penny of your lost funds easily in 2hrs with just a little amount of money bla bla bla... If you are reading this for that kinda thing, i am gonna tell it to you straight: this post isn't what you are looking for. Don’t waste the next 8 minutes of your life reading this, because none of these type of Ads “hacks” will save your lost fund with a little amount of money in 2hrs!! Instead you will be scammed again by low life scumbags! The costs will depend on the number and complexities of the systems you wish to have tested and how thorough a test you want to do. Naturally the large companies tend to be more expensive, but it is also a fair price. Of course, hiring someone to access any system you do not own of have permission to test is highly illegal almost everywhere. Doing to could end with a criminal record, hefty fine and jail time, so very few real hackers like us are willing to risk it without substantial remuneration. You may find some people (even on here) claiming to be hackers. They will either: take your money and not do anything take your money and also steal your identity and try to empty your credit card and bank accounts attempt to do a half-assed hack, get caught and turn you in because they are not good enough to hide their trail Be law enforcement These are good reasons for you to be careful hiring hackers anonymously. Hiring a hacker these days is a bit difficult because lots of people fall for scams. Does that mean there aren't real hackers online? NO definitely!! You can either do two things: You can either go to court or just hire a hacker at HackerOne. HackerOne is very familiar with the fraudsters' strategies and frequently can steer a course to a resolution through one way or another as there are often other organisations that facilitate, may be unwittingly, or are actually part of the deception. The step of last resort, legal action, is understandably daunting for a person who often has lost significant amounts of money in this way.  HackerOne fully recognises that such an experience will leave a victim decidedly risk adverse. In order to off-set the risk HackerOne has developed strategies to combat the financial risks of litigation. HackerOne has a track record of recovery in relation to financial fraud, with many strategies and tactics to hack the fraudulent broker to restore funds to their former clients. At HackerOne, we have different hackers up to any task. Some Of These Hackers Includes PETER YAWORSKI, FRANS ROSEN, JACK CABLE, JOBERT ABMA, ARNE SWINNEN And More HackerOne Official is available 24/7, And You Can Also Contact us for other Technical Hacking Services you desire Such as: * WEBSITE HACKING * PHONE HACKING (giving you Unnoticeable access to everything Happening on the Target’s Phone) * LOCATION TRACKING * CLEARING OF CRIMINAL RECORDS * SOCIAL MEDIA ACCOUNTS HACKING etc>>> Make foundings about us. Check our profile on our site to see what we've achieved. Ask us questions. We prove ourselves beyond reasonable doubts on all Hacking jobs. Be sure you are making the right decision. Don't just make payment without knowing what approach specifically. You need a professional hacker? Send a mail to >>> info.hackerone@gmail.com Be safe out there. Cheers!!

zeveb 8y ago

The fact that the SEC can't secure this sort of information is an excellent argument against key escrow and government backdoors into crypto systems: it's completely impossible to prevent leakage or theft of that sort of incredibly-valuable information.

gene_vache 8y ago

> Hackers broke into an SEC database and made millions from inside info Given the thirty minute window between copying the file to the server and the SEC posting the URL, I figure they guessed the URL from an easily predicted sequence.

flatfilefan 8y ago

Do the journalists believe Lithuania and Ukraine still somehow belong to Russia? I can’t see any explanation in the article on how was Russia involved.