Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“NASDAQ is owned.” Five men charged in largest financial hack ever

arstechnica.com

Post reply on HN
Print view View original

71–80 of 143 posts

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#71

Post by gohrt »

jbert wrote: post #48
nonchalance wrote: post #11

Earlier quoted context omitted.

The matching engine and the ring of servers around it are not accessible via internet. You can only connect to them if you have a server collocated in Carteret, and even then the NASDAQ machines only expose the ports relevant to order entry and feed data. They could have hacked a customer (say, citigroup) and entered that way, but all they really could do is incur losses for the customer.

> but all they really could do is incur losses for the customer. If they could inject "incorrect" trades, could they put themselves on the other side of those trades via normal means and so benefit from such losses?

Surely.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#72

Post by larrys »

tptacek wrote: post #43
kevinalexbrown wrote: post #41

Is anyone aware of a) whether other security auditors or services could have identified these vulnerabilities and b) what it takes to sell to these exploited firms? My understanding of security is fairly small, but it seems to me that there's a market to be had here ... If the expertise exists to dramatically reduce exposure, it's a question of sales or ease of use. If the expertise doesn't exist yet, someone smart m…

There is a market here.

Someone who does security work for me on the side (for about 12 years works now) manages a team that does this at a large consulting company.

I can't remember exactly, but he told me what they bill him out for and it sounded like NY senior attorney level rates.

He travels overseas regularly on longer term assignments. I told him he should go out on his own but he's not entrepreneurial. He also said that a few of the "sales guys" at the firm already did that with some of the other security people last year.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#73

Post by enraged_camel »

devcpp wrote: post #56
2pasc wrote: post #22

Earlier quoted context omitted.

In Israel, military service is compulsory for all men when they are 18 years old. The best hackers in the country are detected and lured into cyberwarfare positions where they need to be the best cyber attackers in the world for 3 years. You bet that these guys are among the best in the world.

The IDF's ICT unit also has a very large budget (it's actually the only unit with an increasing budget despite a 2 billion overall budget drop), and with access to all kinds of technologies that only a government can afford. When the engineers get out of there, they know things that few people know about.

Yep. This is why many people believe that Stuxnet was developed by Israel - it was so advanced that only a country like that could have done it.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#76

Post by dgroves »

jordanthoms wrote: post #67
NegativeK wrote: post #59

Earlier quoted context omitted.

This would be a perfect example of why SQL injections are so common: toolchains aren't secure (or even securish) by default -- and it isn't clear that this is the case.

Anyone not using prepared statements in 2013 is just being stupid - there is no reason to ever be vulnerable to a SQL injection, barring a bug in the database or driver you are using. It's totally unacceptable.

to be fair of the hundreds of comments I have read, you are the only person who has the correct advice for mitigating the risk of SQL injection.

Everybody else should read the [OWASP SQL Injection cheat sheet](https://www.owasp.org/index.php/SQL_Injection_Prevention_Che...) before giving advice. ;-)

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#77

Post by AsymetricCom »

driverdan wrote: post #37
AsymetricCom wrote: post #31

Doesn't NASDAQ have some responsibility for this hack? Doesn't NASDAQ have serious security reputation issues now?

Blaming the victim? Nice.

I can see it now. NASDAQ brass participating in it's own "slut walk" for "sloppy-seconds" developers and IT managers. "Just because I cut contracts for the lowest bidder doesn't mean I deserve to be penetrated!"

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#78

Post by oddx »

agravier wrote: post #25
notphilatall wrote: post #19

Earlier quoted context omitted.

I've always figured (at least for former soviet states) that it's a combination of: + a rigorous STEM curriculum + limited conventional job prospects + a social/business environment in which exploit-selling is a respectable profession

Can you tell why you know that? Is that knowledge from personal experience?

From my personal experience I can confirm p. 1, totally disagree with p.2 (there are plenty of good and well payed jobs for IT specialists in xUSSR countries). About p.3 - exploit-selling is not a respectable profession, but in recent 20 years people have seen too many examples of people becoming rich by illegal and dirty ways and this definitely did bad influence.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#79

Post by crag »

2pasc wrote: post #22
austenallred wrote: post #10

I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.

In Israel, military service is compulsory for all men when they are 18 years old. The best hackers in the country are detected and lured into cyberwarfare positions where they need to be the best cyber attackers in the world for 3 years. You bet that these guys are among the best in the world.

"military service is compulsory for all men when they are 18 years old."

Not correct. All men (and women) except those in a Yeshiva (religious school). As I understated it, they can post-pone their enlistment indefinitely.

I also understand this is a touchy subject in Israel right now.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#80

Post by alexjeffrey »

thesis wrote: post #55
alexjeffrey wrote: post #44

the idea that NASDAQ might've been hacked using an SQL injection is pretty scary, as it's a pretty trivial attack to protect against in most cases (mysql_real_escape_string?) - is security in stock exchanges really so lax?

mysql_real_escape_string isn't secure. AT ALL.

it is when used correctly within quotes (and used with common charsets, but that's a different story altogether). There is no publicly known way to inject the following when the database is encoded in ISO-8859-1 or UTF-8:

"SELECT ... WHERE `field_name` = '" . mysql_real_escape_string($string_value) . "'";

Post reply on HN