Slashdot Mirror
Cyber Ring Stole Secrets For Gaming US Stock Market
chicksdaddy writes Reuters has the scoop this morning on a new report out from the folks at FireEye about a cyber espionage ring that targets financial services firms. The campaign, dubbed FIN4 by FireEye, stole corporate secrets for the purpose of gaming the stock market. FireEye believes that the extensive cyber operation compromised sensitive data about dozens of publicly held companies. According to the report, the victims include financial services firms and those in related sectors, including investment bankers, attorneys and investor relations firms. Rather than attempting to break into networks overtly, the attackers targeted employees within each organization. Phishing e-mail messages led victims to bogus web sites controlled by the hackers, who harvested login credentials to e-mail and social media accounts. Those accounts were then used to expand the hackers' reach within the target organization: sending phishing email messages to other employees.
The people running this ring are honest about their intentions?
if there were no losses to common folk I would welcome this development.
The ways in which common folk will suffer losses from this type of corporate sabotage, e.g. that institutional investors such as pension funds are "required" to be a part of the stock casino and dodgy derivative financial contraptions, is another discussion. Worth having, imho.
More on topic, perhaps, FTS:
According to the report FireEye the victims include financial services firms and those in related sectors, including investment bankers, attorneys and investor relations firms.
I wonder whether the perpetrators are not at some remove employed by much the same demographic as the victims...
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
Goldman Sachs is a member of Congress? I think you mean "Only the people bribing members of Congress".
You're right I guess, but I can see how we'd get confused. "Businessman" is a much over-represented group in Congress (this is true in lots of other countries of course).
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
No, the "emailing employees" parts is getting played up, so they're computer bogeymen ("hackers") instead of just the usual above board backstabbing trader types. It's the scarewords that make a good story, not the substance.
...stole corporate secrets for the purpose of gaming the stock market.
They seem to know a lot about these guys.
After all, corporate secrets can be sold for competitive advantages, for financially scamming those institutions or their clients, for embarrassing those institutions targeted, and/or for blackmailing purposes. The fact that they know it's for gaming the stock market implies that they have some evidence of that.
People possessing the privileged information that was stolen are not allowed to use it for their own benefit when making stock trades. They are not directly hurt. Use of the unfair advantage that stolen privileged information provides facilitates a wealth transfer from everyone participating in the stock market to those committing the crime. The common folk are hurt in a very diffuse sort of way. Anyone with any sense ought to know that the common folk are always at a disadvantage when investing in the stock market. The bigger issue is that this sort of thing undermines trust in the system itself. If everyone refuses to put their 401K money into the stock market because they believe the game is hopelessly rigged against them then that can become a real problem. Personally I'd rather small investors could just keep their money in interest bearing savings accounts that provide a fair return and only large investors who take significant stakes in companies and are active in exercising their shareholder rights own stocks. Institutional investors abdicate their responsibilities and leave a publicly owned firm without effective oversight by its owners, leaving no one but government and the likes of the SEC to protect the interests of the public.
Way to go 'Merica!!
Why is Snark Required?
...stole corporate secrets for the purpose of gaming the stock market.
They seem to know a lot about these guys.
After all, corporate secrets can be sold for competitive advantages, for financially scamming those institutions or their clients, for embarrassing those institutions targeted, and/or for blackmailing purposes. The fact that they know it's for gaming the stock market implies that they have some evidence of that.
My guess is they work for the NSA
No.
The NSA already has most of that data from their wiretaps. If they wanted to game the market they wouldn't do it using such easily detectable moves.
The article indicates heavy speculation that this is done by insiders in the i-banking community. My guess is former i-bankers who got laid off at some point, but it could also be i-bankers who are using the information to fuel their trading behavior for their firm.
I didn't think the methods for gaming the US stock market were secret.
Generally they are well known and these days it's called high volume, high frequency trading... What's not so well known are the rules used by various companies when automating these trades. If you know the rules being used, one can project how entitles will trade. If you are good at guessing (because you know their rules) you have the advantage.
These days, all is so well known that the latency of the connection to the trading platform starts to become important and shaving off a few milliseconds amounts to a lot of money for traders. They've even gone so far as to physically shorten network links and use old analog transmission equipment to shave off fractions of seconds... It's a crazy world.
Not that an individual trader in Timbuktu cannot actually make money day trading... That is still possible. It's just that method is paying off less and other methods are more reliable income producers.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Usually the computer crime you read about is little better than simple theft, this seems much smarter -- rather than steal credit cards or scam merchants for pennies, why not steal information that can be used to make a profit elsewhere in a way that would otherwise seem totally legitimate?
If you stop and think about it it seems totally obvious that this is a much smarter way to commit computer crime, but then the question is who else has been doing this? Have any of those stock market reports on the days winners and losers been the result of these kinds of inside information?
Security experts have had this option of monetizing an attack long since in their sights. The only surprise is that it apparently took so long.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
What were the names of these companies and how exactly did hacking email accounts lead to a compromise of the Operating System?
When I saw "Cyber Ring Stole Secrets...", for some reason I read it as there was some super cool ring that somebody used to spy on traders. Then I thought, "I want this Cyber Ring. Where can I get one?" Then I realized they weren't talking about something James Bond might wear, and the entire story just isn't very interesting anymore.
I sometimes ask revealing, often ignorant-seeming questions. Maybe they're harder to answer than you think.
What were the names of these companies and how exactly did hacking email accounts lead to a compromise of the Operating System?
Announcing their names would cost the companies billions of dollars and get the victims of the fraud fired and possibly make them unhireable.
And Reuters would get sued by all of them.
It would probably win, but it would still be expensive.
In addition there is almost certainly an ongoing investigation.
Isn't the point of the Stock Market to game it for fun and profit? I applaud these guys for their wise investment research!
Weedon suspects the hackers were trained at Western investment banks, giving them the know-how to identify their targets and draft convincing phishing emails.
I have a hard time seeing investment bankers as "victims"
Which has more power: the hammer, or the anvil?