4 ms·

I guess there are kind of two things people worry about with electronic markets and hacking. One is just crashing the market so that nobody can trade for some p

by minimax 12y ago

I guess there are kind of two things people worry about with electronic markets and hacking. One is just crashing the market so that nobody can trade for some period of time. The other is actually stealing funds from one or more market participants. I'm not sure which case you had in mind, but I think the former is probably a lot easier than the latter.

tptacek 12y ago
A friend of mine once had the best idea ever for a destructive piece of malware. Assume you have a reliable infection vector on Windows machines. Now, instead of deleting hard drives or enrolling machines into a botnet, just find every Excel spreadsheet you can, and subtly fuck with the numbers. If you wanted to damage the US economy, a similar approach taken with compromised electronic markets could probably do some real damage.
- minimax 12y ago
  That is a cool idea because the spreadsheets are probably not backed up so you have no reference to compare it to. This is not exactly the case in the markets. For instance when I send my order into NASDAQ, I get an order accept message back that includes all the parameters in the original order message. If you artificially cancel my order when I think the order should have executed immediately or been posted to the book, I'll notice that and call the exchange trade desk to ask wtf happened. For displayed, non-IOC orders I'll also see my order in the market data feed. When I get an execution the price of the execution should match (or improve) the price of my order. I'll also see copies of all these orders and executions in the DROP copy from my clearing firm. In other words there are a lot of places to insert your own surveillance to make sure your trading is happening the way you expect it to, and many firms already have such surveillance schemes in place because 1) regulatory requirements and 2) software has bugs and sometimes things break. * This is all re US equity markets because that's my area of expertise. Maybe it's different on other electronic venues.
kasey_junk 12y ago
You probably couldn't do the latter very often or for much money. But man would it undermine the markets when it came to light.
Igglyboo 12y ago
So just like TDKR?

by minimax 12y ago

tptacek 12y ago

A friend of mine once had the best idea ever for a destructive piece of malware. Assume you have a reliable infection vector on Windows machines. Now, instead of deleting hard drives or enrolling machines into a botnet, just find every Excel spreadsheet you can, and subtly fuck with the numbers. If you wanted to damage the US economy, a similar approach taken with compromised electronic markets could probably do some real damage.

minimax 12y ago
That is a cool idea because the spreadsheets are probably not backed up so you have no reference to compare it to. This is not exactly the case in the markets. For instance when I send my order into NASDAQ, I get an order accept message back that includes all the parameters in the original order message. If you artificially cancel my order when I think the order should have executed immediately or been posted to the book, I'll notice that and call the exchange trade desk to ask wtf happened. For displayed, non-IOC orders I'll also see my order in the market data feed. When I get an execution the price of the execution should match (or improve) the price of my order. I'll also see copies of all these orders and executions in the DROP copy from my clearing firm. In other words there are a lot of places to insert your own surveillance to make sure your trading is happening the way you expect it to, and many firms already have such surveillance schemes in place because 1) regulatory requirements and 2) software has bugs and sometimes things break. * This is all re US equity markets because that's my area of expertise. Maybe it's different on other electronic venues.

kasey_junk 12y ago

You probably couldn't do the latter very often or for much money. But man would it undermine the markets when it came to light.

Igglyboo 12y ago

So just like TDKR?