Forgot your password?
typodupeerror
Crime Businesses Security The Almighty Buck News Your Rights Online

Hackers Penetrate Nasdaq Computer Networks 106

Posted by Soulskill
from the turn-on-your-firewall-gentlemen dept.
PatPending tips a Wall Street Journal report claiming that hackers have repeatedly broken into the computer networks of the company running the Nasdaq Stock Exchange. "The exchange's trading platform—the part of the system that executes trades—wasn't compromised, these people said. However, it couldn't be determined which other parts of Nasdaq's computer network were accessed. Investigators are considering a range of possible motives, including unlawful financial gain, theft of trade secrets and a national-security threat designed to damage the exchange. The Nasdaq situation has set off alarms within the government because of the exchange's critical role, which officials put right up with power companies and air-traffic-control operations, all part of the nation's basic infrastructure."
This discussion has been archived. No new comments can be posted.

Hackers Penetrate Nasdaq Computer Networks

Comments Filter:
  • by sethstorm (512897) on Saturday February 05, 2011 @02:17PM (#35112344) Homepage

    I'm not sure people would notice, even if it was worse.

  • False flag? (Score:4, Interesting)

    by commodore64_love (1445365) on Saturday February 05, 2011 @02:20PM (#35112370) Journal

    Given the government's insistence they need to have power to kill-switch the internet, I can't help wondering if this was staged.

    • by Tapewolf (1639955)
      Kill-switch for NASDAQ...?
    • Re:False flag? (Score:5, Interesting)

      by Anonymous Coward on Saturday February 05, 2011 @03:25PM (#35112756)

      Given the government's insistence they need to have power to kill-switch the internet, I can't help wondering if this was staged.

      From that comment I can tell you're actually familiar with how politics works.

      Unfortunately that goes so strongly against the combination of what most people are taught growing up plus what they would naively like to believe that you're likely to encounter a lot of irrational resistance. It's the kind of "yeah yeah how's that tin-foil hat fitting you" dismissal from people who refuse to seriously research the idea and look for past instances of it, yet feel that their highly emotional stance is a valid one. Perhaps they could start to enlighten themselves by researching Operation Northwoods to see what kind of false-flag operations our government is seriously prepared to use. Government is full of primitive asshats who subscribe to consequentialism; that is, the notion that the ends justify the means.

      Most ideas in politics like an "Internet kill-switch" are presented as proposals. They're more than that. They're more like "this is what we fully intend to do anyway" or they're more like "this is what we have been doing anyway and are now trying to legitimize by signing into law" (remember the retroactive immunity for warrantless wiretapping?). The proposal stage leads to a stage of framed debate, during which time the emphasis is placed not on the importance of civil rights and limited government, but instead on terrorists, hackers, or some other outside threat serving as a boogeyman.

      It's good old "correlation does not equal causality" again, and I'll explain the cart-before-horse nature of it. This is all designed to look like these actions are the effect of reasonable debate and popular support. In reality the appearance of debate and the drumming up of support is the effect of these actions. The ones who push for these increasingly fascist measures understand one thing very well: they only need a moment of support and it will be permanently enshrined in law, never to be repealed, no matter how many later regret getting suckered by the fear-based rhetoric. Understand this and you'll rarely (if ever) be surprised by anything you see on the news.

      As to whether this particular event was staged, I don't have proof one way or the other. It does remind me of a quote from Franklin D. Roosevelt: "In politics, nothing happens by accident. If it happened, you can bet it was planned that way."

      • by bigpet (1695756)

        I don't think anybody is going to call him tin-foil hat crazy because he essentially said:
        "The timing seems suspiciously convenient, we should consider the possibility that this was staged."

        you call 'em tin-foil hat crazy when they say:
        "The timing is suspicious, it was an inside job"

        Regarding the things the US government has done to get legitimization for what they want (immediate reason for the start of the Vietnam war) this would be a perfectly reasonable thing to do for them if it was really high priori

      • lool you are crazy!
    • by sumdumass (711423)

      I can't for the life of me understand why you got modded troll.. I didn't RTFA but I'm going on a wild guess and assuming that the hackers didn't walk into the NASDAQ HQ, sit at a terminal and guess a password while everyone walked by no noticing them.

      But just in case someone out there failed to put knowledge from one area together with a comment in another, the situation is like this, the US government wants a kill switch for the internet. They claim it's to stop attacks. Recently, we saw Egypt shutting do

      • by Fnkmaster (89084)

        It's funny you say this, but I have set up servers in the data center that houses the primary NASDAQ exchange servers in Carteret, New Jersey (there's also a backup facility elsewhere in New Jersey).

        They don't publicize this data center's location, but it's not exactly top secret within the finance industry because lots of firms need fast, direct access to route orders and get market data. Heck, Google will tell you exactly where it is if you ask the right questions.

        The building is a Verizon data center, a

    • by bonch (38532)

      Hey, I'm sure the government can be trusted. I sure can't wait for "net neutrality" and having the FCC--the same organization that flipped out over Janet Jackson's nipple and drove broadcasters like Howard Stern off the air--regulating internet traffic and telling sysadmins at ISPs how to manage the traffic on their private networks. Sure sounds neutral to me.

      • the crux of that issue is that we don't want ISPs to be treated as 'private networks'. We want them treated somewhat akin to common carriers, with regulation. It is important to note that the constitution guarantees rights for citizens, not corporations. I don't want any corporations to have rights.

    • And they'll just ignore how the "kill-switch" wouldn't help at all since, by the time they realize there's a breach, information could already be leaked. In fact, the only use I could imagine for this kill-switch is to stop a DDOS, but then what sane person trades one site being killed for the entire Internet being killed?
  • Wall Street Bonuses (Score:5, Interesting)

    by Anonymous Coward on Saturday February 05, 2011 @02:21PM (#35112378)

    Wall Street Bonuses last year was $20.3 billion.
    I think it's obvious who is hacking the system.

  • Because this will send a wave of uncertainty through the markets and make me money!
    .

    That's really scary -- I trade for my living these days (my own money only) and of course, use computers to do it -- theirs and mine.
    .

    We could hope that all it is is some evilt HFT firm trying to figure out how to quote-stuff better and make a little more money on the spreads quicker, but somehow, having that be the best possible likely outcome is scary itself.
    .

    This house of cards of money that is really only bit

  • by wordsnyc (956034) on Saturday February 05, 2011 @02:29PM (#35112424) Homepage

    Considering that 80% of activity in the market is program trading and that 70% of shares are held for 11 seconds or less, I think we have bigger problems. This whole shebang is not, strictly speaking, capitalism. It's parasitic roulette played with imaginary money. Of course, at the end of the week the players get to take home real money.

    • yeah, because ARM is selling nothing and Google is giving away its product for free, and for some reason not so obvious to your level of IQ they are bringing home boatloads of money. They are apparently using magic to make money, which should be banned.
      • Re: (Score:2, Offtopic)

        by peragrin (659227)

        your post has nothing to do with the GP's.

        He was saying how the majority of trades aren't interested in the companies but whether or not the stock will go up or down 30 seconds from now and how much can i make from that movement.

        less 15% of investors invest for long term companies, and even less hold on to said stock for longer than a month. Most investments are only 30 second actions of buy let it go up 1 cent and sell it again. actual company performance in that face is entirely unrealistic and unnecess

        • by Anne Thwacks (531696) on Saturday February 05, 2011 @03:40PM (#35112846)
          Make that 7 days, to allow people time to read the weekend coverage of the companies' market trading conditions. (And to ensure the risk of coming unstuck if you are relying on microsecond movements).

          No wealth is created by this kind of activity. The money that goes to the winners comes from your bank charges and insurance premiums.

        • And you are aware that finding the price of stock does cost money and a high temporal resolution and precision of the price is useful and may worth the additional cost?
        • by HiThere (15173)

          24 hours isn't long enough. It should be at least a week, with preprogrammed buy and sell orders within that week allowed.

          Alternatively, have there be a tax on stock transactions that decreases if you hold the stock for a long period of time. Say 100% if you hold it for 1 minute and 0% if you hold it for 5 years. Other values determined by linear interpolation. (Yes, you pay more than 100% of the stock value if you hold it for less than a minute, and you are paid if you hold it for more than 5 years. B

      • when a company does an IPO, or offers more shares, they get the cash. after that the stock value is not closely related to any amount of money the company makes; the trades have no direct impact on the company. the buying and selling of shares on the market does not gain the company any cash. the value of the stocks are set by the willingness of the traders to buy and sell the shares.

        while the desire to buy shares may be related to the anticipated corporate performance, there is no actual tie of share va

        • by maxume (22995)

          There are plenty of stocks paying a 3% or greater dividend. The 3% is a direct relationship between the actual performance of the company and the stock price.

        • by aliquis (678370)

          while the desire to buy shares may be related to the anticipated corporate performance, there is no actual tie of share value to company performance.

          For the minute? Most often not. For the day? Unless there is any reports or analysis, probably neither. For the week/month in a large company? Probably. Over multiple years? Definitely.

          The bigger the company, the more trades, the more news and analysis, the more likely the price is somewhat right.

      • by twebb72 (903169)
        Agreed. Parent should complain how he's broke somewhere else.

        You can learn how to play ball or you can watch from the sideline.

    • The players being the large stock trading firms, of course.

    • by socsoc (1116769)
      [citation needed]
    • by Doctor O (549663)

      This is most interesting, can you tell me the source to those numbers? I want to use them next time somebody is trying to talk me into buying any stock-based financial product. Or wants to tell me why the stock markets should NOT be made illegal.

  • by DoofusOfDeath (636671) on Saturday February 05, 2011 @02:39PM (#35112500)

    Any yet it's almost impossible to get research funding for developing proof systems for computer programs, and/or developing proof-friendly (e.g., non-Turing-complete) languages, which could eliminate whole categories of vulnerabilities and bugs. Epic.

    • by Anonymous Coward

      Let me guess. You have no idea what you are talking about.

      In terms of anything that would be amenable to your research, nasdaq is the best of the best. Their matching engine does not have bugs of consequence more than once a year, and the "consequence" is always small, noticed immediately and has no finanical impact. No, I don't work for nasdaq.

      Let's get back to reality. They like all financial firms have to interface with 1000 different partners, each with their own protocols.

    • by JamesP (688957)

      Erm... no

      Or, in the words of Donald Knuth "Beware of bugs in the above code; I have only proved it correct, not tried it."

      Most bugs have nothing to do with 'proof'

      Try proofing a code against an API, against random input, agains other (buggy) modules, etc, etc That's the problem

  • ... that we're hacked from PlentyOfFish a little while ago!
  • Time to break out the illegal wiretaps and ignore the 4th amendment some more.

  • Motives included unlawful financial gain? That's amusing!

  • Everything must go. NASDAQ was just the first step. Better go check the basement of the social security building in MD. I'll bet you'll find the hackers there. Oh um bring some firepower with you. Seriously though, that must have been one talented hack.
    • Everything must go. NASDAQ was just the first step. Better go check the basement of the social security building in MD. I'll bet you'll find the hackers there. Oh um bring some firepower with you.

      I'm sure the powers-that-be can at least find a balding, middle-aged New York cop with a drinking problem to go in.

      Although finding one with a hot daughter might take a bit more work...

  • the computer network of the company that runs the Nasdaq Stock Market

    Well there's your first problem. What the hell is a private corporation doing controlling an entire nation's stock market? If it's something so huge and influential and important to the country it can be the target of attack to disrupt our economy, it should damn well be under Military-grade security and government control.

    • Re: (Score:3, Insightful)

      by Jon Stone (1961380)

      it should damn well be under Military-grade security and government control.

      Is this the "military-grade security and government control" that prevents classified material being leaked to Wikileaks so effectively?

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        > Well there's your first problem. What the hell is a private corporation doing controlling an entire nation's stock market? If it's something so huge and influential and important to the country it can be the target of attack to disrupt our economy, it should damn well be under Military-grade security and government control

        Nasdaq doesn't control the entire nation's stock market. The SEC has taken aggressive steps over the least decade - with LARGE success, according to its stated intent - to create an

        • by FooAtWFU (699187)
          Okay, I'll bite at your "only buy or sell stocks four times a year". That wouldn't shoot capitalism dead, but it would be a hindrance. The market helps perform price discovery: no one really knows how much a company is worth (since it's all about future earnings), but if you have information about it that the rest of the market doesn't, you have a financial incentive to exploit it and your exploitation will help bring the price closer to what it should be. This affects how much people are willing to invest
    • by DarkOx (621550)

      Because its just a market place were private entities exchange private property with each other. Why should the government be involved at all?

      Are you suggesting that everything that is huge, influential, or could impact our economy be nationalized? How about UPS and Fedex, CSX, they are the biggest distribution companies around if they were attacked it could disrupt our economy, should they be nationalize, should every one of their planes have a fighter escort, and ever rail car a platoon to guard it?

      Serio

  • Genetic (Score:3, Interesting)

    by Kingrames (858416) on Saturday February 05, 2011 @03:10PM (#35112674)
    You know, it won't be long before the algorithms used for trading become pseudo-genetic, and start to do this kind of stuff themselves.

    The trading that goes on is influenced as much by meta-information as it is solid information.
    For all we know that could be part of the system by now already.

    I wouldn't be surprised - in fact I'd EXPECT that words like "google" "fox" and "recession" are either hard-coded into algorithms or the hardest-hitting highest profile terms used to weigh the value of stocks.

    There's no way you can design a secure system. Attacks like this should be considered a constant, and you need to find a smarter way to discourage them.

    I say that the best way is to design a system with low-hanging fruit to serve as detection of an attack, which will shut down access to the higher level stuff when it detects intrusion - or far better, replace real information with fake information. Make the attackers think they've succeeded, feed them false positives and misinformation, and then relax knowing your information is secure. In this way you're not so much building a wall that can't be broken down, you're attacking a soft target. No idea how effective it'd be in practice though.

    Don't pay any attention to this though, I'm just rambling.
  • For all that the day to day transaction on the stock market have very little relation to what's happening in the real world, when the stock market crashes it does have an effect on the real economy.

    So i guess it's a really good thing that we don't have to worry about a cyberwar [slashdot.org] or we might be it real trouble! After all, the countries that don't like America would never want to hurt us economically unless they were also willing to invade!
  • by plopez (54068)

    Was it Goldman-Sachs?

  • hmm... is there computer access in the prison library?

  • by fuzzyfuzzyfungus (1223518) on Saturday February 05, 2011 @03:43PM (#35112876) Journal
    I do actually find this story rather scary; but not because of the "zOMG hackerz@!" angle. Of course there are going to be hackers sniffing around stock exchanges. Given that online attacks aimed at penny-ante shit like hotmail accounts, facebook, and WoW are economically viable, obviously there is going to be some interest in hitting the places where the actual money lives...

    The scary bit is the idea that it is a generally accepted truth among the feds and similar that the ability of noise-traders to slosh imaginary money around like shit through a goose is a critical part of American infrastructure and a national security concern. As important as Power companies? Srsly? Are we really so deep in stacks of heavily leveraged electronic monopoly money that continued access to electronic exchanges is as important as continued access to electricy? If so, we really are fucked.
    • by twebb72 (903169)

      Are we really so deep in stacks of heavily leveraged electronic monopoly money that continued access to electronic exchanges is as important as continued access to electricy?

      Yes. It is as or more important. But you found the right website to gripe on.

  • This is one of the many areas that Schneier and Clarke talk about being 'offlimits' when nation/actors conduct 'cyberwar'. Of course, who plays by the books? Not the bad guys... or us for that matter!
  • Oddly, most of those subpoenaed have long since gone blind.
  • The prevailing wisdom with vital computer infrastructure is to have it on a private network with no internet interconnect, but how do you do that with a system designed to handle public input? I think the next step is a stripped down OS running software written just for that task, with no extra functionality. The simpler the system the fewer parts you have to security audit. Of course that still leaves the problem of are the people running the system trustworthy (It's a black box, with no public scrutiny
  • by DarkOx (621550) on Saturday February 05, 2011 @08:01PM (#35114674) Journal

    First of this is a private company. Sure they are probably one of the most regulated organizations in existence but they are still private. Other that SEC compliance issues that might be a result of this hack Government has no damned business being involved or even commenting.

    Second comparing it to air traffic control is just stupid. The market has circuit breakers, it takes holidays, and there is a history of closures and outages. When was the last time anyone turned off air traffic control? That's right NEVER, on the other hand the nation seems to hmm along just fine Saturdays, Sundays, all the hours outside of 9:30a - 4p the rest of the week, without the NASDAQ being open.

    I am not saying unexpected market closures are not majorly disruptive but nobody dies so they really are not up their with some of those other services.

  • Per WSJ story (http://online.wsj.com/article/SB10001424052748704858404576127854072207040.html , use google hole to view) intruders "...installed malicious programs on a Web-accessible system called Director's Desk, one of its technology offerings that facilitates communication and sharing of files among corporate officers."

    I wonder how many key-loggers etc are cleaned up from executive workstations an laptops every day in US but never reported.

  • The crooks just realized that the largest casino is located on the East Coast. And instead of having to deal with the mob afterwards, they just have angry pensioners and some low-life pension-funds who are basically tooth-less when they can't bribe or strong-arm somebody into what they want him to do.
  • I am not sure, but was not the economic crisis because of all the stocks having been invested and everything teetering on the edge of disaster, is this not another crisis waiting to happen?
    What can be done against this, I do not think separating all computers to be independent (like in BSG) is an option here.

Stupidity, like virtue, is its own reward.

Working...