How to Hack and Crash the Stock Market

“There can be few fields of human endeavor in which history counts for so little as in the world of finance. Past experience, to the extent that it is part of memory at all, is dismissed as the primitive refuge of those who do not have insight to appreciate the incredible wonders of the present.”

 John Kenneth Galbraith

Okay, I know economics is the dull science, if, in fact, it is a science at all. So, I’m going to really simplify things. Imagine that we have three people, Al, Bob, and you. Al and Bob work together.

Scenario #1: Bob has told Al that he is going to buy a lot of shares in a particular company. Al decides, since he is your friend, to give you this information. Since you know Bob is a big investor, you are pretty sure his investment in a company’s stock will affect the stock price. Therefore, before Bob actually buys the shares, you buy a bunch for yourself. Sure enough, as soon as Bob buys the shares, the stock price goes up. You can then sell your stocks at a good profit.

Scenario #2: Bob tells Al that he is going to sell some stocks. When Al gives you this information, you realize you had better sell your stocks in that company before Bob sells his shares. You know that, when Bob sells, the stock price will go down and you don’t want to lose money.

Now imagine that Al has many friends that he tells about Bob’s stock dealings. In scenario #1, so many people may buy the stock that, just before Bob buys it, the price has suddenly and, somewhat inexplicably, gone up. In scenario #2 a similar mass selling of the stock would cause the price Bob will get for his shares to suddenly fall. This may make Bob suspicious as it would seem to him that someone knew in advance what he was going to do, and the only person who knew such things would be Al.

Scenario #3: Bob threatens to report Al to the SEC for insider trading violations. Al, realizing that his future is in jeopardy, tells Bob he will do anything to make it up to him. So Bob has an idea. He has Al tell all of his friends that he is going to buy many shares in a certain company. Al does as he is told. Sure enough, the price in that stock goes up. And then, Bob changes his mind. He decides that instead of buying this stock, he is going to sell his shares in it. In fact, this is what he planned to do all the time, only now, with Al’s help, he has managed to get a far better price than he would have. Later, when he does the same with selling shares, he again changes his sell to a buy and gets a much lower price for the shares he wants to buy. Yes, Al’s friends are upset with him, but at least he’s not going to prison.

Oddly enough, these scenarios play themselves out on real stock markets everyday. Let’s just call Al by his full name, Algorithm. Algorithms are basically pattern recognizers. Their job is to spot patterns in stock trading and to act on those patterns in milliseconds. Before an order to buy is executed, these algorithms may step in and begin buying in the hopes they will later be able to sell the same stocks, seconds or minutes later, for a profit. It doesn’t even matter if the stock goes up by only a fraction of a cent, if you buy enough shares, you can make a respectable profit for a few minutes work. The only thing that is different between this and the original scenarios is that nothing the algorithm does is illegal. It’s just part of everyday life in the stock markets. In fact, at least 50% of stock market activity is performed by algorithms or robots. Much of these dealings are between robots trying to out maneuver other robots in milliseconds. Basically, they are on their own following rules built into their algorithms. Humans can’t make decisions this fast.

But relax, at least for the moment. As for now, under current market conditions, high frequency trading robots tend to cancel each other out and, with large amounts of money freely available for investment due to quantitative easing, momentum is ever upwards. Stocks simply cannot go down. This is basically because there’s nowhere else to put your money but into stocks and, to a lesser degree, property and art. In other words, the algorithms will tune into this investment fever and work with it as an undercurrent to keep stocks edging ever upwards. Sure, there may be a few downward trends caused by those pesky humans worrying about old-fashioned market fundamentals, but that makes no difference to algorithms. They could care less about why people are investing in certain stocks, they are only looking at numbers and wider patterns and those numbers and patterns are the result of overall human and other robot activity. In fact, the upward trend produced by algorithmic investment in itself adds to more upward momentum in a sort of self-perpetuating upward spiral. This can be underlined by the profits achieved by some high frequency firms. Virtu Financial Inc, for example, has had only one losing day in the last six years and profits are soaring. Unfortunately, all of this could change overnight if the monetary policies that produced quantitative easing begin to align more with market fundamentals. If downward pressures become widespread for a longer period of time, a similar spiral will occur, but in the opposite direction. This is where hackers, who might want to destabilize the market, could come in.

Now, if you were looking at these algorithms from the viewpoint of a hacker, they would look very much like hacking software. The mode of attack would look disturbingly close to a man-in-the-middle attack, in which information from one party is channeled through a third party on its way to its final destination. In fact, a number of stock market hacking attacks or attempted attacks have already occurred.

In January, charges were filed against three Russian spies who apparently had plans to use high frequency trading to destabilize the stock market. It was not clear how they planned to do this but, if their goal was to acquire a good algorithm, they should have been able to do it. This is because much of the high frequency trading code was written by Russian nationals living in the US. As a case in point, in May, Sergey Aleynikov, a dual Russian-American citizen who was employed as a programmer for Goldman-Sachs, was convicted of trying to steal their algorithm, or at least parts of its code, to set up his own company or to help another high frequency trading startup. A similar case of stolen code occurred at Quantlab in Houston. Indeed, if you were planning to hack the market, starting your own firm would be the best way to do it. This is because you could mask yourself as a legitimate company, operate legally for a while to evade cyber detection strategies, and, then, begin spoofing, as in scenario #3 above. Good spoofing could be used either to gain profits or to destabilize the market through massive fake buy orders. Most experts think it would be possible to hack the market but that any crashes would be short-lived and would be expensive to orchestrate. In order to use spoofing to completely destabilize the market and lead it into a downward spiral, attacks would have to be launched from many bases and be so-arranged that they occurred over an extended period of time, not allowing market recovery to normal levels.

But what about the insider trading angle? Isn’t there something unfair about a high frequency trader getting information before other traders do? You’d think so, but there is a small point about high frequency trading that few people know about. Stock exchanges will sell high frequency traders access to order information, so, technically, the traders are not breaking the law.

Now, in normal trading, a broker could do the same thing. If they have a client who is going to make a big deal, they could move in before the client places the order and take advantage of it themselves. This so-called, ‘front running’, is illegal when brokers do it but not when high frequency traders do the same thing. This is because the information they receive is not specifically from a client. Besides, it is not unusual to pay extra for certain privileges in life. I was recently sent my new passport with a notice that I could apply to be a special passenger and get certain security benefits like not having to remove my shoes or show that my laptop was functional. That sounded like a good deal to me until the fine print told me it would only cost me $100.  High frequency traders pay far more and stock exchanges make good money from them by selling them special access. They are, therefore, in no hurry to kill off this golden goose, no matter how much doing so would make the market a more even playing field.

Stock exchanges around the world have been repeatedly attacked in the past. There is little doubt that this will continue into the future. Why? Because the effects of a cyber attack that closes a stock exchange for even a day could bring devastating financial consequences. A hacker could try to gain access to a trading algorithm and alter the code to make it perform in a way that could cause disastrous consequences, but such an attack would have to be quite sophisticated. It is far easier to manipulate the stock market in a more legitimate way.

So how do you hack the stock market? Let’s assume your goal is to cause market chaos and force prices downward. In short, suppose your goal is to cause a market crash. Well, first of all, save your money. This kind of attack will require a lot of it, which is why it is best performed by a nation-state where adequate funding is available. It will cost you to get control of an algorithm that can be used on the market. This can be done in several ways. You can pay for online access to an algorithm, but this is not cheap. Although most prices on these algorithm-access sites aren’t stated up front and are arranged through negotiation based on sales volume, one website did state a cost of $25,000 plus various commission fees. Another way to get an algorithm would be to hire a mathematician or group of mathematicians who could develop one, but these people are highly paid and may cost you millions. Of course, in developing countries, the cost would be lower. Still, this approach would take time and you’d need to test out the algorithm somehow. A third way would be to steal code through a cyber attack or have some insider get it for you. As I noted above, this seems to be the most common approach. It does saves a lot of time.

Anyway, once you have your algorithm, you should start your own firm (or firms, if you have the money). Begin making legitimate trades, hire knowledgeable traders, fine tune your algorithm, and get involved in some ‘dark pools’. Dark pools are areas in which trading occurs outside of the normal stock exchanges. They are only open to special investors who do not want their trading behavior to be known and do not want to influence the market price with their large transactions. Dark pools lack transparency and so have acquired a somewhat shady reputation. If restrictions on trading volume are placed on high frequency traders, in order to control them, dark pools can be a way around these restrictions. However, in your case, in which you want to crash the market, you want your trades to be visible so that you can spoof the market into a downward trend. The only real reason for you to use dark pools would be to investigate market interest in particular stocks before you begin your actual attack.

Once you’ve established your legitimate presence in the market, you can begin your attacks. If your goal is to bring down the market, it would be best to concentrate on as many well-known stocks as possible. Always ping before a sale to check what the interest is in certain stocks. If you don’t know, pinging is the offering of small amounts of stock to see what interest exists. Remember, if your goal is bringing chaos to the market, you must force the market to the downside by a concerted sell effort. It would be best if these sales came from a number of sources to make it appear that there is a widespread negative sentiment at work. Too much action from one source is likely to trigger anti-spoofing algorithms. Keep in mind that this attack will not be a cheap proposition. However, you may be able to manipulate the market later to make up for some of your losses.

Now, given current market sentiment, these attacks would only have a temporary affect.  Since the market is pumped up by easy money, it would be difficult to force it to enter a long-term downward spiral after only one attack. It would be far better to time the attack after some announcement that indicated changes in the easy money policy were at hand. Timing the attack after an announcement by the Fed that interest rates would be raised, for example, would make increased selling more credible. The attack should extend for many days from a number of sites which could make investors believe that there was widespread negative sentiment. This would push the high frequency algorithms into interpreting the sales as a downward trend and they would automatically begin selling in order to protect investments. Once this was accomplished, the downward spiral would produce self-perpetuating negative sentiment and the market would, with the help of high frequency trading robots, enter a long period of decline and chaos. Your attack would have been successful… anyway, it’s something to think about.

About Steve Mierzejewski

Marketing consultant for InZero Systems, developer of the next generation in hardware-separated security, WorkPlay Technology. I've worked in Poland, Japan, Korea, China, and Afghanistan. I'm a writer, technical editor, and an educator. I also do some work as a test developer for Michigan State University.
This entry was posted in Uncategorized and tagged , , , . Bookmark the permalink.

One Response to How to Hack and Crash the Stock Market

  1. Pingback: An Assessment of the Six Main Cyber Security Predictions for 2016 | Secure Your Workplace Network

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s