Slashdot Mirror
FBI Scolds NASDAQ Over Out of Date Patches
DMandPenfold writes "NASDAQ's aging software and out of date security patches played a key part in the stock exchange being hacked last year, according to the reported preliminary results of an FBI investigation. Forensic investigators found some PCs and servers with out-of-date software and uninstalled security patches, Reuters reported, including Microsoft Windows Server 2003. The stock exchange had also incorrectly configured some of its firewalls. NASDAQ, which prides itself on running some of the fastest client-facing systems in the financial world, does have a generally sound PC and network architecture, the FBI reportedly found. But sources close to the investigation told Reuters that NASDAQ had been an 'easy target' because of the specific security problems found. Investigators had apparently expressed surprise that the stock exchange had not been more vigilant."
If these had been Linux servers, Microsoft would now be making bold statements about "Linux Insecurity" and urging Everyone to get a complete Microsoft Solution with patch management.
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
Hey it's friday. let's just go get a beer and skip this patch testing. What could Possibly go wrong?
Your attempt to join our hive-mind is appreciated, but found to be lacking in zeal.
Reuters which is quoted in the article and which also provide feeds for the market are very slow at providing support updated Windows.
http://thomsonreuters.com/products_services/financial/financial_products/a-z/3000_xtra/#tab3
Reuters 3000 Software requirements:
Windows Vista with Service Pack 1, Windows XP Pro with Service Pack 2 and Service Pack 3.
Office 2007 and Office 2007 with Service Pack 1 (with restrictions on Excel 2007 Service Pack 1).
IE 6.0, IE 6.0 with Service Pack 1 and Service Pack 2, IE 7.0.
It's all about Marketing. MS Windows is has plenty of speed if you are willing to put the right hardware behind it and the brochure advertising their platform only mentions that their system has the lowest latency when processing stock data and not total cost.
If they have 2 choices:
A) which is easy to set up and can be run by click-monkeys but is full of security vulnerabilities
or
B) harder to set up and requires people who know what they're doing but is very secure...
the BAs I'm afraid will will always go for A since people will usually trade effort now (setting up) for effort later (clearing up after a hack).
They run both. The actual trading system (I recall) runs some form of heavily modified real time linux, because the high-speed traders demand crazily fast speeds - they are trading on the microsecond level now, and growing frustrated by the time it takes for a signal to go down an ethernet cable. The Windows servers will be for things like the frontend interface used by the less-high-speed traders.
Scolds? Really? What is this, kindergarten? How about a nice hefty fine to make them take security seriously? Oh, I forgot, can't be angering the real bosses. :/
NASDAQ makes at least $0.001 in exchange fees for every single transaction that happens on that exchange, and yet they can't hire a competent IT department.
Seven puppies were harmed during the making of this post.
Why bother? If someone breaks in and screws up the prices, they'll just roll back all the trades that hurt Goldman Sachs.
If I have been able to see further than others, it is because I bought a pair of binoculars.
....the updates will be complete when they finish compiling!
What I find interesting is the "and uninstalled security patches" does that mean that some employee did some sabotage? That could also explain the firewall part.
cap: unclosed
Dear WallStreet,
I will work for profits. Condo in Manhattan.
Thanks
P.S. I am serious.
It's a culture issue on the concept of server up-time vs service up-time.
I developed the patch management process that is used on the servers of one of the largest trading companies in the world. I got started on this at the time after hearing one of the server admins brag about an up-time over five years. What he was really saying was that he hadn't patched his servers in over 5 years. Unless your running a mainframe or a certain flavors of Linux a reboot is required for many patches.
When one of those servers go down the cost is measured in the millions of dollars per minute. The culture took as a matter of pride to make sure that never happened. The best perceived way to avoid this was avoid anything that could affect server up-time. Since patching necessarily involved rebooting the server it simply wasn't done.
Changing this culture was a half year long internal political fight that boiled down to a single thing. I posited the argument that server up-time should no longer be tracked as a metric and should instead be replaced with service up-time.
During that half year period I developed the process (working with a lot of other teams) for patching these servers without affecting service up-time. Doing so involved creating a SLA that had server maintenance windows defined for specific times. It also explicitly defined that service availability would not be affected by having a server be unavailable during those very maintenance windows.
Ultimately the culture was so entrenched that it literally took upper management handing down orders from on high that server up-time was no longer allowed to be tracked as a metric. In the end we were patching our servers on a routine basis and doing so without impacting service availability.
It is impossible for a cynic (admin) to get certain concepts through to an optimist (management).
Every day that you are not cracked (or the crack go undetected) is "proof" for the optimist that he was right and you were just pushing unnecessary precautions to justify your job.
So, those 24 months ... that's over 700 times he was "proven" right and you were "proven" wrong.
The same with skipping patches. Every patch skipped multiplied by every day without a crack ... he's right thousands of times and you're chicken little ("the sky is falling, the sky is falling").
why is it that they are running windows at all? It insecure slow and any other serious OS is fully customizable down to the kernel
Seriously? You think an organization that failed to properly point & click to configure a firewall would be *helped* by having something that's customizable down to the kernel?
Any wonder that NASDAQ isn't trustworthy? Look at the guy that created it.
The article I am reading it from, from E-Week, July 24th 2006 issue, lists it specifically so, quoted next:
"NASDAQ, the largest U.S. electronic stock market, lists companies from 37 countries. Their crucial trading and messaging systems use SQLServer 2005 to handle up to 64,000 transactions per second with 99.999% uptime"
(& it's probably more now, because I am basing that off of 2006 information (but it has stayed up & running 24x7 into the "fabled '5-9's" of uptime doing so).
* "RTOS" (real-time OS) doesn't mean speed, but rather guarantee of delivery (ala for example, no dropped packets)...
(You're making it sound like speed of ops, as far as what "real time" actually means... & though the term MAY sound that way? It's not really about speed, but about guarantee of info. delivery!)
APK
P.S.=> You said NASDAQ's using Linux? Hey - I'd like to see proof of that please - NYSE &/or LSE do, but NASDAQ?? ANYHOW... thank you for proof of your statements!
... apk
Given that the FBI's security is shit, if they're shocked at how bad yours is, you know you're fucked.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"