21 ms·

I'm not surprised in the least. The industry is full of stories that started out as rumors but have ended up proven as true about the lengths they will go for m

I'm not surprised in the least. The industry is full of stories that started out as rumors but have ended up proven as true about the lengths they will go for more or better information. I've heard an apocryphal story that I'm still waiting for truth on. It was of a soybean prop trading firm quant who reverse engineered a cross-town rival's trading strategy, allowing them to front run their strategy. The way that they did it was taking a number from the firm's name, and using it as a random number seed, and then using that seed to find the randomized order sizes would result from their iceberg order algorithm. They would use those sizes to match to l2 passive limit order flow to try to identify activity coming from the firm. Once they discovered the direction the firm was going, they'd place a huge market order and suck up all of the liquidity that the competitor was trying to acquire passively, effectively moving the market before their competitor could fill their position. Stuff like this still blows me away, but it's just crazy enough to be true.

lykr0n 8y ago
It's just like how HFTs can make massive amounts of money just by making transactions milliseconds faster than the people next door. Stuff is insane
heavenlyblue 8y ago
Sounds smart, but also sounds quite like an urban legend.
gamblor956 8y ago
I heard that story from a quant friend. However, the way I heard the story, the targeted firm found out about their rival's attempt to game their strategy, and faked a bunch of activity. The rival's algorithm acted on the activity and placed a large market order...in the wrong direction.
- doovd 8y ago
  This is called spoofing and is illegal.
  - tomsthumb 8y ago
    From a place of total ignorance, why would telegraphing a particular false strategy to your competitor in order to get them to respond in a way that is profitable to you be illegal?
    - smartscience 8y ago
      Also, how would you ever prove it?
    - 1stcity3rdcoast 8y ago
      Because you’re not just telegraphing it to your competitor, you’re moving the entire market and affecting the bid/ask and price transparency for all its participants. That affects liquidity, derivatives, a lot of downstream negatives. That said, there are narrow instances where you can place less-than-real orders in a market [0]... it just has to be a market that is nearly and completely illiquid. [0] https://www.bloomberg.com/opinion/articles/2018-12-04/trying-to-buy-stuff-you-want-is-not-manipulation https://www.bloomberg.com/opinion/articles/2018-12-04/trying...
  - Chris2048 8y ago
    No it isn't, spoofing is feigning trading behaviour. Providing data that another company illegitimately bases their trades on isn't trading.
    - doovd 8y ago
      Yes it is. Placing orders you don't intend to be executed is spoofing. From the OP: "faked a bunch of activity"
      - Chris2048 8y ago
        I assume they mean phone network activity, not market trading activity.
      - gamblor956 8y ago
harrumph 8y ago
>taking a number from the firm's name I'm lost as to what is meant here by "number". Are you saying the target firm was randomizing its iceberg order's component order sizes using the same seed? If yes, how could the target firm's usage of that seed be known by the "attacker" here?
- darksaints 8y ago
  The target firm had a number in their name, kinda like a16z or Office365. The attacking quant knew the target was using iceberg orders which split up and randomize parts of large orders. Attacking quant took a guess at an RNG seed by guessing they used the number in the target firm's name, and then somehow fit the resulting random number stream to order chunk sizes, and was able to confirm they used that number as a seed. From then on, using that information, they would identify (I'm assuming probabilitistically) when the target firm was executing a large iceberg order, and then front run the remainder of their order. It sounds ridiculous on its face, but the industry is known for going to extremes, and that sort of problem solving isn't unheard of in other domains (like cryptography for example). I'm way out of my depth with understanding it, and it could be complete bullshit, but it isn't outside the realm of what I've seen proven in the past, which is why I'm hoping someone someday will confirm it.
  - azernik 8y ago
    That... sounds amateurish. Everyone just uses a hardware RNG for random number seeds.
    - darksaints 8y ago
      It would be amateurish if it were cryptography for sure. But I would never expect that sort of attack vector as a quant. Most quants are worried about alpha loss, not having your order flow fingerprinted.
    - ah- 8y ago
      Well it's nice for testing to have something repeatable. But still sounds like an urban legend.
nafey 8y ago
Can someone dumb this down a bit and explain? Why would you want to generate the random seed using your company name?
- darksaints 8y ago
  https://news.ycombinator.com/item?id=19515490 https://news.ycombinator.com/item?id=19515490 I'm assuming that they used the company name for their RNG seed out of laziness or ignorance...very few people would expect that line of attack.

lykr0n 8y ago

It's just like how HFTs can make massive amounts of money just by making transactions milliseconds faster than the people next door. Stuff is insane

heavenlyblue 8y ago

Sounds smart, but also sounds quite like an urban legend.

gamblor956 8y ago

I heard that story from a quant friend. However, the way I heard the story, the targeted firm found out about their rival's attempt to game their strategy, and faked a bunch of activity. The rival's algorithm acted on the activity and placed a large market order...in the wrong direction.

doovd 8y ago
This is called spoofing and is illegal.
- tomsthumb 8y ago
  From a place of total ignorance, why would telegraphing a particular false strategy to your competitor in order to get them to respond in a way that is profitable to you be illegal?
  - smartscience 8y ago
    Also, how would you ever prove it?
  - 1stcity3rdcoast 8y ago
    Because you’re not just telegraphing it to your competitor, you’re moving the entire market and affecting the bid/ask and price transparency for all its participants. That affects liquidity, derivatives, a lot of downstream negatives. That said, there are narrow instances where you can place less-than-real orders in a market [0]... it just has to be a market that is nearly and completely illiquid. [0] https://www.bloomberg.com/opinion/articles/2018-12-04/trying-to-buy-stuff-you-want-is-not-manipulation https://www.bloomberg.com/opinion/articles/2018-12-04/trying...
- Chris2048 8y ago
  No it isn't, spoofing is feigning trading behaviour. Providing data that another company illegitimately bases their trades on isn't trading.
  - doovd 8y ago
    Yes it is. Placing orders you don't intend to be executed is spoofing. From the OP: "faked a bunch of activity"
    - Chris2048 8y ago
      I assume they mean phone network activity, not market trading activity.
    - gamblor956 8y ago

harrumph 8y ago

>taking a number from the firm's name I'm lost as to what is meant here by "number". Are you saying the target firm was randomizing its iceberg order's component order sizes using the same seed? If yes, how could the target firm's usage of that seed be known by the "attacker" here?

darksaints 8y ago
The target firm had a number in their name, kinda like a16z or Office365. The attacking quant knew the target was using iceberg orders which split up and randomize parts of large orders. Attacking quant took a guess at an RNG seed by guessing they used the number in the target firm's name, and then somehow fit the resulting random number stream to order chunk sizes, and was able to confirm they used that number as a seed. From then on, using that information, they would identify (I'm assuming probabilitistically) when the target firm was executing a large iceberg order, and then front run the remainder of their order. It sounds ridiculous on its face, but the industry is known for going to extremes, and that sort of problem solving isn't unheard of in other domains (like cryptography for example). I'm way out of my depth with understanding it, and it could be complete bullshit, but it isn't outside the realm of what I've seen proven in the past, which is why I'm hoping someone someday will confirm it.
- azernik 8y ago
  That... sounds amateurish. Everyone just uses a hardware RNG for random number seeds.
  - darksaints 8y ago
    It would be amateurish if it were cryptography for sure. But I would never expect that sort of attack vector as a quant. Most quants are worried about alpha loss, not having your order flow fingerprinted.
  - ah- 8y ago
    Well it's nice for testing to have something repeatable. But still sounds like an urban legend.

nafey 8y ago

Can someone dumb this down a bit and explain? Why would you want to generate the random seed using your company name?

darksaints 8y ago
https://news.ycombinator.com/item?id=19515490 https://news.ycombinator.com/item?id=19515490 I'm assuming that they used the company name for their RNG seed out of laziness or ignorance...very few people would expect that line of attack.