Nasdaq Intrusion Spreads To Listed Companies

New submitter SpzToid writes "Nasdaq's Directors Desk is a program sold to both listed and private companies, whose board members use it to share documents and communicate with executives. Apparently Directors Desk was infected during a breach widely publicized earlier this year. It has now become known that hackers were able to access confidential documents and communications of the corporate directors and board members who received this infected application, said Tom Kellermann, chief technology officer with security technology firm AirPatrol Corp. It is unclear how long the Directors Desk application was infected before the exchange identified the breach, according to Kellermann and another source."

Comments

Hey, I can dream...

[Qzukk]

"Reports indicate that the modified version replaced the "Idiot Defense" button (which normally wipes all records of having read the various incriminating documents and was a key selling point of the software) with a button that would email the documents to all 50 states' attorneys general."

Nah, it probably just copied everything and sent it all to China.

TO THE CLOUD!

[inject_hotmail.com]

What could go wrong?

Re:TO THE CLOUD!

[Anonymous Coward]

Indians, Sin Nombre virus and the delicate soil.

Linux?

[Anonymous Coward]

Maybe they should have used Windows...

Disturbing

[msobkow]

The idea of a secured system designed for the sole purpose of allowing executives and board members of the corporations to communicate in secret is profoundly disturbing on so many levels...

Re:Disturbing

[Anonymous Coward]

Why? Private companies that are publicly traded are required by law to make their finances public, but other than that, they can be as opaque or as transparent as they want. And I'm okay with this. I would agree with you if you were talking about the public sector, however.

Re:Disturbing

[tlhIngan]

The idea of a secured system designed for the sole purpose of allowing executives and board members of the corporations to communicate in secret is profoundly disturbing on so many levels...

If it's a private company, not a big deal - that's why they're called private companies. What's worrying is that this is promoted by a stock exchange for the sole purpose of private communications and documents in public companies.

That's the big problem. I don't care if Craigslist (private) uses it - they don't have the disclosure rules and stuff that public companies like eBay have.

Re:Disturbing

[causality]

The idea of a secured system designed for the sole purpose of allowing executives and board members of the corporations to communicate in secret is profoundly disturbing on so many levels...

Yes. I'll say up-front that I don't advocate such a criminal activity and anything I say next should be interpreted in that context. I'll add that my reason for this isn't because I'm so sympathetic to the execs who were made to look stupid by this breach, nor do I blindly believe that everything which is legal is good and everything which is illegal is bad, but because I imagine it would be serious prison time if anyone doing it got caught. I'm tempted to say that if caught, they should receive a medal, not prison time.

Having said that ... I smiled and felt a certain satisfaction when I read this news. They may have made the legal system and the financial system into their personal playgrounds, and established a revolving door between the two, but this finally is one arena where they are going to get humbled again and again. The hackers who perpetrate such attacks are idealistic and can do a great deal with little or no organization, making them quite difficult to include in the corruption represented by their targets of choice.

By contrast, we long ago gave up any serious notion of our politicians actually representing us and implementing some serious transparency and accountability in either system. I have said before and will reiterate again, you breed lawlessness when you systematically eliminate every legitimate "working through the system" method of effecting change or obtaining justice. Want to go through the court system? Well I hope you have lots of money and years of your life to invest in something you are likely to lose anyway. Want to run for office? I hope you don't cross the political and financial interests who can get you there, who are the gatekeepers much more than the voting booth has ever been. Most people are law-abiding and will stop there. Others, not so much.

The power brokers who will be humiliated and maybe even harmed by this are simply reaping what they have sown. This is one realm where they are not so untouchable. In my opinion, it's healthy for society that they be reminded of that from time to time, and any decent person with principles wants that to happen in this sort of nonviolent manner. If you haven't noticed, people are getting fed up with the status quo and the direction in which it is moving. Something has to change; this is an amicable way for it to happen.

Re:Disturbing

[Oxford_Comma_Lover]

In part because it makes accountability to shareholders (and law, for that matter) harder than it already is. In part because it disincentivizes them from looking at company-wide solutions to security problems. In part because when it is for contact between companies, it turns into a shield for antitrust violations.

Re:Disturbing

[Shoten]

The idea of a secured system designed for the sole purpose of allowing executives and board members of the corporations to communicate in secret is profoundly disturbing on so many levels...

Actually, it makes an enormous amount of sense. Keep in mind that things like IPOs, discussion around delisting, and other decisions that involve both a stock exchange and a public-traded company don't just happen. There's a good bit of communication that has to happen first, and even a rumor about some events can have impact on that company's stock price. So just as it is with company-internal information about financials during a quiet period just before an official announcement, it makes sense for there to be a channel of communications whereby things can be kept quiet until they are deliberately (rather than accidentally) disclosed.

Re:Disturbing

[HornWumpus]

"People of the same trade seldom meet together, even for merriment and diversion, but the conversation ends in a conspiracy against the public, or in some contrivance to raise prices."

Adam Smith (the commie bastard).

Re:Disturbing

[causality]

The idea of a secured system designed for the sole purpose of allowing executives and board members of the corporations to communicate in secret is profoundly disturbing on so many levels...

Actually, it makes an enormous amount of sense. Keep in mind that things like IPOs, discussion around delisting, and other decisions that involve both a stock exchange and a public-traded company don't just happen. There's a good bit of communication that has to happen first, and even a rumor about some events can have impact on that company's stock price. So just as it is with company-internal information about financials during a quiet period just before an official announcement, it makes sense for there to be a channel of communications whereby things can be kept quiet until they are deliberately (rather than accidentally) disclosed.

I believe what you have there is a self-fulfilling prophecy or maybe a Catch-22.

If these things were always done publically and transparently with no secrecy, rumors wouldn't cause people to bolt like frightened animals. Any rumor that is heard could be compared to the information that has accumulated thus far and a judgment could be made as to whether it is consistent with decisions that have already taken place. In fact it wouldn't be a rumor; it would be verified and documented or it would be bullshit.

The reason rumors are so powerful is precisely because those processes are such a "black box", so any information that leaks is regarded as some kind of special insider information that must be acted upon before someone else does. A process that is transparent from the beginning would remove this aura of exclusivity and secrecy that drives precisely the knee-jerk reactions you describe.

Not only would transparency bring stability to these markets and the financial decisions that affect them, it would also eliminate the notion of "insider trading". For all publically-traded corporations, why wouldn't this be desirable?

Re:Disturbing

[Dripdry]

Here here. (does that qualify this as a "me too" post?)

Over the last few years I feel as if more and more "Violence is the answer" posts around the internet are popping up. Some may argue that freedom is only won with the blood of patriots, but I deeply hope that our republic is not so far gone that this is the only option left (and one that is, honestly, not likely to happen in any case). So, while I also do not condone illegal activity, I can say that I hope transparency and fairness can be reintroduced peacefully, that the sordid and the powerful can be humbled by whatever means is best for the most people.

Also, something about Tarkin, and a grasp, and slipping through fingers?

Re:Disturbing

[msobkow]

What a shame I can't mod you up after commenting myself. Well said.

Re:Disturbing

[Anonymous Coward]

You seem to live in la-la land.. there are many reasons why certain information cannot be public before a decision has been made...

Re:Disturbing

[causality]

Here here. (does that qualify this as a "me too" post?)

Over the last few years I feel as if more and more "Violence is the answer" posts around the internet are popping up. Some may argue that freedom is only won with the blood of patriots, but I deeply hope that our republic is not so far gone that this is the only option left (and one that is, honestly, not likely to happen in any case). So, while I also do not condone illegal activity, I can say that I hope transparency and fairness can be reintroduced peacefully, that the sordid and the powerful can be humbled by whatever means is best for the most people.

Also, something about Tarkin, and a grasp, and slipping through fingers?

The following should be construed as my opinion. In this psychotic legal environment, I will add that it is to be interpreted as a hypothetical scenario. With that out of the way...

I'll be straight with you. For those who really run the show, I think violence is exactly what they are trying to provoke. They have been and are gearing up for it in many different ways. Power-hungry fevered egos would love nothing more than an excuse to clamp down and enforce perpetual martial law. I believe this is why they don't even try to hide their asshattery anymore. They want it in your face. They want you to react to it in a predictable way. They are saying "oh yeah, you don't like that, well wtf are you going to do about it?" Don't fall for that. You'd be a fool to let them provoke you. Anyone who does that is going to lose badly to a very well-prepared adversary. Don't do it.

I'll tell you what they don't want. The very last thing they want is peaceful, non-violent resistance like what Ghandi and Thoreau advocated. It doesn't give them anything to work with. They would have to drop all pretense of justification if they went heavy-handed against something like that, which would cost them the support of much of the military and police who would execute it. Those two forces are on their side if the real patriots can easily be portrayed as terrorists or rebels or whatever the evil of the day is. If they don't fall for that because they love peace, that's when the soldiers and cops stop being such myrmidons and start questioning their orders and who is really served by them.

Something like that also implies non-participation in their way of doing things, such as the monetary system, paying taxes, etc. It would amount to cutting the bottom out of the pyramid. They really do derive their power from the consent of the governed, it's just that the governed no longer understand what that means.

But in either case, violence is the biggest and worst mistake you can make with these "people". That would be playing their game by their rules. You are going to lose if you try it. I don't mind repeating myself: don't do it. Not only would you harm yourself, you also cause a guilt by association against anyone who also understands the problem but has sense enough to look for constructive solutions.

Re:Disturbing

[Phantom Gremlin]

What's worrying is that this is promoted by a stock exchange for the sole purpose of private communications and documents in public companies.

Exactly right.

Why the fuck is *NASDAQ* promoting this program? They're a stock exchange. Let them do that. Let someone else write and sell garbage like this.

Security breaches like this taint NASDAQ's reputation. And for what? The amount of revenue this could have generated is peanuts compared to revenue from running the exchange itself.

Oh, for the good old days, when "heads will roll for this" was meant literally, not figuratively. Just think of it as a little chlorine in the gene pool.

Re:Disturbing

[Anonymous Coward]

God I wish I had mod points! I think you have spoken well for the majority of us. Now we just need these documents exposed to the public....

Re:Disturbing

[rrohbeck]

On the other hand, serious commentators have said the powers that be will only start to take notice when we have riots like in the UK. Just sayin'.

Re:Disturbing

[rrohbeck]

It has been shown that the "invisible hand" of the market works if all participants have same knowledge.
So if you want real market capitalism there can be no secrets. Even any delay distorts the optimum.
Hence scammers. Err, speculators. Err, traders.

Re:Disturbing

[Alex Belits]

Here is something more disturbing and just as relevant, though violence has no part in it:

Freedom is a stupid idea to begin with. All the time humans have to sacrifice something they want to achieve something more valuable and important. Sure, freedom is attractive -- as long as it is your freedom. But if some form of freedom is supposed to be available to either everyone or no one, it may be a perfectly valid reasoning that having it is not worth the trouble of other people having it, too. Most of "economic freedom" is firmly in this "not worth the trouble" category for everyone but tiny fraction of population that happens to be super rich.

Plenty of such freedom was sacrificed with great results -- now-oppressed employers can't pay below minimum wage, have unsafe working conditions, pay in scrip, defraud the employees, plan that employees will not survive long enough to be paid, etc. Make no mistake -- laws that prohibit those atrocities are denying people real freedoms, at the same level as, say, freedom of speech or freedom of association. Without those laws no fundamental principle of "freedom" is violated. Those forms of freedom (again, not unlike freedom of speech that some people love so much) are available to everyone, but only useful to wealthy and powerful people. With such freedom I would be able to hire, say, a maid or a shoe shine guy and impose unsafe working conditions on them. Then, after performing an act of minor assholery on a shoe shine guy I would have to go back to the coal mine and work for less than a cost of food to sustain my life while breathing more carbon in than out, but everyone would have more freedom.

It just happens that people are better off when no one has freedom to mistreat others in such a manner no matter how wealthy he is, so government oppresses population by denying everyone this kind of freedom, thus promoting public good at the price of certain kinds of freedom. So freedom can just likely be a good or bad thing, and in each particular case it should exist or not exist depending on its effect on the whole society. It's stupid to worship the idea of freedom by itself, and nothing should be promoted just because it is "freedom" -- things must have valid use and purpose, and their availability in society must be supported by those uses and purposes, not nebulous slogan of "freedom".

Nothing will be improved until American society will abandon the idea of freedom as foundation of its ideology, and start caring about well-being of people. Then maybe they will have some use for freedoms that they will have left and shown to be valuable. Or maybe even invent new, more useful ones -- I am sure, Thomas Jefferson would have hard time understanding what kinds of freedom Richard Stallman is talking about or what they are good for, so we can just as well have no understanding of what will be good or bad centuries or even decades later.

Re:Disturbing

[fostware]

It ties in beautifully with the Fear, Uncertainty, Doubt currently in use by everyone in power at the moment, where opposing viewpoints are dismissed as violent, dangerous, extremist, damaging to your wallet / the economy and everything else depicted of non-conformists in books like "1984" and "Fahrenheit 451", etc.

And just like "Fahrenheit 451", the masses are placated by faux interactivity and big screen TVs.

Both books will be "strongly suggested" reading once my child is able to read and understand, but it may be too late by then...

Re:Disturbing

[Renraku]

Ahh, but they have a card up their sleeve for just that situation. If you won't get violent, there are people that will. People that often work in law enforcement. People that won't be there when the riot police start issuing beat downs. Then they'll say on the news that the OW...err...insurgents..got violent and attempted to vandalize/loot/stampede/etc. It'll all be right there on tape.

It'll be blasted across your TV screen and favorite news website. Look, see what those protesters did today! We had to step in and keep them from harming innocent people!

Re:Disturbing

[Anonymous Coward]

It just happens that people are better off when no one has freedom to mistreat others in such a manner no matter how wealthy he is, so government oppresses population by denying everyone this kind of freedom, thus promoting public good at the price of certain kinds of freedom.

That's like calling regulation the same thing as oppression. Poor regulation might be oppression, not all regulation is oppression. Whatever you're smoking, you should cut down on it.

Lastly all Governments that want to stay in power must maintain a monopoly on violence. It doesn't even matter what form of Government. So even long time Dictators will not allow just anyone to mistreat others. Only the Dictator's "dogs" are allowed to do so. If you allow someone else to exert violence, that person could gather enough power to overthrow you.

Re:Disturbing

[Alex Belits]

That's like calling regulation the same thing as oppression.

"Oppression" and "regulation" mean exactly the same. The difference between terms is entirely in speaker's feeling or agreement with the action -- "oppression" if he is opposed to it, "regulation" if it supports it.

Dictators

"Dictator" is a head of state that US Government is opposed to.

Re:Disturbing

[Anonymous Coward]

"Violence is the answer"?

Well rich men are more afraid of bullets. They have more to lose.......
Maybe that is also why you don't see rich men fighting the wars that they start.
If your poor all you have is your life and since you don't have any money or power then well your life isn't worth anything anyways.

Remember this country was born with a gun against ternary
Too bad we got fat and lazy..

"Nasdaq's Directors Desk is a program sold to both listed and private companies, whose board members use it to share documents and communicate with executives.

Didn't they used to call this insider trading and wasn't it illegal?

Re:Disturbing

[Dripdry]

Replying to my own post here, if anyone is still reading this overall discussion.

Litigious world: I do not condone illegal activity.

I think causality might have the way of it: The way to cut them off is to stop feeding the beast. What if monetary protests began, like very large numbers of people not paying taxes, not shopping for goods and services, and generally peaceful civil disobedience occurred?
Also, the idea that those higher up WANT us to commit violence to seal a litigious fate worse than death does make some sense. I know some very sick people in positions of power who seem to love seeing this sort of thing, they get all holier-than-thou, like it gives them a reason to exist since they are the "calm, rational ones", while they often seem to be deeply manipulative instigators. It makes me wonder how twisted/disconnected from reality the real power brokers are.

As far as the UK riots... I see them and on one hand I hope it brings meaningful change, but a part of me knows it probably won't, that violence just gives the media a chance to have a field day. We've gotten SO used to violence on TV that when real violence happens it's just another show to enjoy, which seems a bit scary.

One of the only hopes I can really hold onto solidly is that NO country that has ever existed has been able to keep these practices up for too long. In our modern era it may be easier with media, so the bread and circuses may continue for longer, but I have to wonder how far our resources can take us in keeping up such a charade. It's a weak hope, but it's something.

Re:Disturbing

[Dripdry]

I'd mod you up if I could. It's really nice to see some different slants on ideas.

Re:Disturbing

[undeadbill]

Actually, the founding fathers were very concerned that Liberty might be conflated with Freedom, and today it seems they were right. Liberty, basically, is a sum of non-contradictory rights held in common. Freedom is just an exemption of control, and often can conflict with other freedoms. Mostly, the founding fathers were concerned that liberties should be clearly enshrined, and that freedoms were mostly up to localities to implement or disagree upon as they saw fit.

The problem I see is that we have forgotten the meaning and importance of liberty in American culture, and have been distracted by chasing after whatever freedom is dangled in front of our collective faces as a distraction.

Re:Disturbing

[tombeard]

You are confusing positive rights and negative rights.
http://en.wikipedia.org/wiki/Negative_and_positive_rights

Re:Disturbing

[tombeard]

So you say there must be a legal hidden channel so collusion can take place?

Re:Disturbing

[Alex Belits]

"Freedom" is by definition a negative right (and therefore "always good" in the mind of libertarians and similar idiots).

Not that the idea of "negative" and "positive" right has much of a foundation in reality to begin with -- humans can not live without affecting each other.

Re:Disturbing

[Alex Belits]

Liberty, basically, is a sum of non-contradictory rights held in common. Freedom is just an exemption of control, and often can conflict with other freedoms.

I am pretty sure, this is not a definition accepted anywhere. "Non-contradictory rights held in common" are never sufficient to form a basis of a society -- conflict is unavoidable and any resolution that requires a participation of any third party necessarily involves oppression. Claiming that some form of oppression is "natural" and therefore is not oppression at all, are based on nothing but subjective preferences of a person making such claim, and are often rejected after society's preferences.

Same founding fathers of US seen slavery as "non-contradictory rights held in common" by everyone who matters. Supporters of unrestricted Capitalism believe that unlimited property rights applied to means of production, natural resources and ideas to be "non-contradictory rights held in common". Spammers believe that their use and interpretation of freedom of speech is within "non-contradictory rights held in common", etc. Each of those "liberties" are suddenly recognized as something else when opposition to them becomes popular in society. The truth is, there are so few truly "non-contradictory" things in any society, any discussion of those things is pointless.

Keep Critical Infrastructure Offline

[bennett000]

Simply analyzing the probabilities involved in computer intrusion should be enough to convince anyone that can understand high-school mathematics that we NEED to unplug critical infrastructure from global networks. Unfortunately the powers that be seem woefully ignorant of how technology works. The anti-piracy campaigns that involve breaking DNS highlight this ignorance.

Re:Keep Critical Infrastructure Offline

[Dunbal]

So write a book about it, become a consultant, and charge them money for telling them how to avoid trouble.

Re:Keep Critical Infrastructure Offline

[geekoid]

yeah. most critical infrastructure is off line.

Re:Keep Critical Infrastructure Offline

[gweihir]

While it would be nice to do so, it will hardly be possible. Instead it is high time to send those making bad IT security decisions to prison for it. While this will also hit a few engineers, most will be managers going cheap, ignoring warnings and generally being incompetent.

Re:Keep Critical Infrastructure Offline

[gweihir]

So write a book about it, become a consultant, and charge them money for telling them how to avoid trouble.

That will not help. The problem is the decision makers do not have the incentives to make the right decisions and a lot of incentives to make the wrong ones. Incidentally, there are quite a few good books on the topic by now.

Re:Keep Critical Infrastructure Offline

[bennett000]

While it would be nice to do so, it will hardly be possible. Instead it is high time to send those making bad IT security decisions to prison for it. While this will also hit a few engineers, most will be managers going cheap, ignoring warnings and generally being incompetent.

I don't see this being hardly possible at all, thirty years ago we got along fine without having our critical infrastructure's information systems not plugged into a global network. I'm speaking more of nuclear reactors, hydroelectric dams, shipping locks, railway switches etc.

On the subject of stock exchanges, I seriously doubt much good has come from plugging stock exchanges into the global information network. Even as recently as fifteen years ago people were physically trading stocks on the floor of some of the world's major exchanges. Nowadays computers perform thousands upon thousands of trades in a fraction of the time their former human counter parts could. Is this really a good thing though? There's an absurd arms race going on between investment firms to install increasingly faster computers as close to exchanges as possible to get the 'jump' on trades. There's even a new trans-Atlantic trunk line going in, that shaves off a few milliseconds of latency, all in the name of automatically trading stocks, and 'making' millions of dollars. What purpose are these systems really serving though? Why is it a good idea to put such an insane amount of speculation into our financial markets? The day to day price of stock had little enough relationship to the actual value of a company prior to computers dominating the trading scene, now this representation is becoming more diluted.

As for sending people to prison for making bad IT security decisions, it's a lovely idea, but how do you determine who's to blame? The second something goes wrong, everyone starts pointing the finger at everyone else. Is the CFO to blame for not budgeting enough IT dollars? Is the head of IT to blame because she was following orders without questioning them? Should all the employees just be locked up to be safe? What about the programmer who didn't terminate a string properly, who works for an entirely different company that sold the software to the firm that was breached??

Then there's the people problem. Even if we could somehow make the billions of lines of code that drive computers perfect, we'd still have people opening up alleged 'job interviews', which are really just malicious excel files, or what have you. In this case at least there's a forensic trail and a 'smoking' gun to link the ignoramuses to their negligence.

I think there are a lot of cases where it would be a lot cheaper to hire security cleared specialists to manually handle the transfer of data between secure isolated networks, and the global internet. Sure it would seem more expensive, but these breaches can cost hundreds of millions of dollars. Specialists can be bought for less than a hundred thousand a year each, and they can be held directly accountable.

Re:Keep Critical Infrastructure Offline

[Dripdry]

Unfortunately, with such a twisted legal system, that could be tough.

Someone here on slashdot gave an account of an executive hiring his wife as an IT project engineer. She had no experience, and proceeded to run the entire project into the ground. However, since she had an executive title, she went on to other companies and made a lot of money, while her assistant (who had to do 2 jobs, manage and fix/develop this project), who was quite experienced and competent, had his career ruined.

I mention this because it might not be that hard to shift the blame over to other people when the legal poop starts hitting the fan.

However, I WILL contradict myself too and point out that certified civil engineers are held legally liable for structures they develop. To keep the analogy straight, though, there aren't people with pick axes, buzz saws, and baseball bats constantly trying to tear down said structure, where-as in security IT this is the case.

Yes

[Anonymous Coward]

#winning

Use BATS Instead

[Anonymous Coward]

Who cares about Nasdaq anyway. Just use their competitor exchange BATS instead.

This is really pathetic

[gweihir]

Not even conclusive independent traffic recording seems to have been in place. These idiots must have believed it could not happen to them. Time to make this criminally negligent and send those responsible away for a few years. And yes, I most likely mean management making bad decisions.

in the words of Nelson

[Khashishi]

Ha Ha

Erm

[ctnp]

#winning

I posted this earlier on my mobile as an AC and it was deleted, presumably by some mod.

Re:Erm

[ctnp]

Oops, shows up in the comments list now. Odd caching. Please disregard, nothing to see here, move along.

Directors info - yawn

[Animats]

Whoever broke into this had no idea how lame most directors meetings are. This is a simple but overpriced collaboration and calendar app for 70 year olds, with a 24 hour help desk. Nice, uncluttered GUI.

The main corporate secrets that filter up to board members involve mergers, acquisitions, and firing the CEO. Knowing about M&A activity early has trading value; not much else does. M&A activity is so slow right now that it's barely worth following.

Incidentally, this is "cloud-based". NASDAQ runs the "cloud". The client is available as an iPhone app. Competitors include BoardVantage and PWC Board Center.

What ever you do ..

[Anonymous Coward]

What ever you do don't mention Microsoft Windows .. :)

Wikileaks?

[rrohbeck]

That might be interesting.

Maybe I missed it

[Anonymous Coward]

but it is more likely this was engineered to occur by the developers/creators of the software. I believe this follows the timeless technique once known as a "Trojan Horse". Perhaps it is just me attempting to think like a sociopath.