Monthly Archives: June 2014

Stock market hacks for microsecond delays.

Cyber-swindling gets everywhere. Even the stock market. First, a bit of history…

The profession of stockbroker was once not only respected and honorable, but also extremely tough. Dealers in stocks and shares once toiled away on the packed floors of stock exchanges and worked silly hours a week, stressed to the limit by relentless high pressure decisions all day (and night). They bought and sold securities, stocks, bonds, derivatives, or whatever they’re called, always needing to do so at just the right moment while riding the waves of exchange rates and prices, all the while edging nearer and nearer to serious heart conditions or some other burn-out caused illness. Other times they simply jumped out of windows to bring a swift end to it all. In short – hardly the world’s best job.

Anyway, all that was long ago. All that hard manual labor has been replaced by automation. Now thinking hard, stressing and sweating aren’t needed: a large proportion of the work today is carried out by robots – special programs that automatically determine the very best moments to buy or sell. In other words, the profession of stockbroker has in large part been boiled down to the training of bots. And to these bots reaction times – to the microsecond – are vital to take advantage of this or that market swing. So speed literally depends on the quality of an Internet connection to the electronic stock exchange. That is, the nearer a robot is physically located to the exchange, the higher its chances of being the first with a bid. And vice versa – robots on the periphery will always be outsiders, just as will those not using the very latest progressive algorithms.

These critical reaction times were recently tampered with by unknown cyber-assailants. A hedge fund’s system was infected with malware to delay trading ability by a few hundred microseconds – which can – and probably did – make all the difference between clinching deals and losing them.

Read on: Your password for a Twix?…

Privyet everyone!

There are fascinating, beautiful sights to behold in the furthest corners of the globe, quite a few of which I tend to mention on this here blog from time to time. But sometimes spellbinding beauty can be found right on your doorstep…

Just the other day for example, towards evening the most amazing assortment of clouds appeared over the reservoir next to our Moscow HQ office. First there were pure white fluffy clouds basking in the bright sun, and then a thick thatch of dark and angry low cloud came along as if pushing the fluffy cumulus out of the way. Alas, by the time I’d fetched my camera most of the particularly unusual dark cloud had passed, but I did still manage to snap some of the proceedings…

Read on: Little Fluffy Clouds…

Patent trolls – continued.

Here, alas, passions are still running high, with the occasional fit of… passion. Indeed, the issues related to patent parasites haven’t gone away; it’s just that only the most interesting – ‘loudest’ – cases ever get heard about. But if you dig deeper, you eventually hit upon stuff that is interesting, just not paid attention to. Which is what we did – and found quite a bit on patent trolls worthy of the title of this blogpost. So, he we go…

The irony’s all too much.

For this item I didn’t have to dig all that deep actually – I just checked Ars Technica. There I found some rather familiar glorification of the patent aggregator RPX – made out to be a sweet and innocent protector of orphans, the poor, and princesses (from dragons). I just couldn’t believe what I was reading: “RPX works by selling memberships to companies that feel harangued by patent trolls, including Apple and many other tech companies. RPX basically buys up patents it believes will be used by trolls. By uniting the buying power of many companies, it can get the patents for a bargain price.”  Well, maybe I could believe it… I was just so rattled at being reminded of the hypocrisy.

WHAT? RPX is some kinda anti-troll? And trolls may fly…

Source

We first came across this so-called anti-troll in the year of its creation, and were one of the first to bite it back – successfully.

Read on: a simple arrangement…

Now, for any Moscow drivers who were held up one recent sunny afternoon by an army of retro-mobiles slowly edging along Leningradsky Shosse and Prospect – SORRY! It was us, KL, putting on some old-school Ritz for our highly valued partners from all over Western Europe.

The smiles are contagious…

‘State Duma’ [Parliament]

On June 15, 2004, at precisely 19:17 Moscow time something happened that started a new era in computer security. We discovered the first malware created for smartphones.

It was Cabir, which was infecting Symbian-powered Nokia devices by spreading via unsecured Bluetooth connections. With its discovery the world learned that there was now malware not just for computers – which everyone already knew too well about (save for the odd hermit or monk) – but also for smartphones. Yes, many were scratching their heads at first – “viruses infecting my phone? Yeah, pull the other leg” – but the simple truth of the matter did finally sink in sooner (= months) or later (= years a decade!) for most people (some still aren’t aware). Meantime, our analysts made it into the history books!

Why did we christen this malware Cabir? Why was a special screened secure room created at our Moscow HQ? And how did Cabir end up in the pocket of an F-Secure employee? These and other questions were recently put to Aleks Gostev, our chief security expert, in a interview for our Intranet, which I thought I’d share with you here; might as well have it from the horse’s woodpecker’s mouth…

Incidentally, the story started really running when we used these two devices to analyze the malware:

…but more about those below…

Read on: An unusual file n the inbox…

Back towards the end of the 1990s was when a KLer first had a child. My toast at the baby’s head-wetting went something like this: “At last we’ve assimilated viruses ourselves – and started to multiply!”

Since then we’ve been motivating employees in various ways to have more children! The more the merrier, I say. Yes, we’re quite family-friendly here at KL – kid-friendly even more so. It’s quite funny how the KL-kiddie situation has evolved: At first, every time a KL-cub entered this world we would all get together and not just wet, but fairly drench the poor little thing’s head :). A few years later, as the frequency went up dramatically we’d just chip in for a nice prezzie for the happy new mom and dad. Then, when the new-baby frequency moved from Hz to kHz, we’d simply get to hear the news at the water cooler. Seems a shame, but what can you do? We’ve a world to save too!

I don’t know how many KL-juniors we’ve got here now, but it’ll be a lot. With this in mind, as well as international child protection day in Russia (and many other countries) coming in early June, we organized a big children’s party at the office! Around 200 kids of our employees came to work with their mamas and papas to finally find out about the place one of their parents disappears to every week day, and to play, paint, eat, trampoline, and lots more besides.

Read on: chess, ice cream and viruses…

Summer. A bit of free time – more than usual. So here you are, something for the weekend, sirs and madams…

1. My book recommendation

I’m always hearing funny – not ha-ha – comments about modern-day China, including those related to the incredibly strong rise of its economy, or about how many bowls of rice the worker of modern China is prepared to work for. But Wikipedia is good on China, as are plenty of textbooks, plus this, this and this are interesting too (on per capita GDP China comes 121^st in the world – between Tunisia and the Dominican Republic).

But for those REALLY interested in China, I REALLY recommend reading this fat book on China by none other than Henry Kissinger.

In it you’ll learn all sorts of new-to-you knowledge and curiosities about the country’s ancient history, its economy and more. There’s the estimation that the GDP of medieaval China was something like a third of world GDP, there’s all the treachery of the opium wars, there’s the communist past, and the country’s renaissance. As I say, I strongly recommend it. But here’s a warning: there’s a TON of detail in there. Some pages I just scanned. All the same, on the 25^th anniversary of Tiananmen Square, it feels like the right time to give it a read.

2. My film recommendation

Check it out if you haven’t already, or watch it again: You Only Live Twice – Sean strutting his stuff as Bond, James Bond; shaken, not stirred.

Turns out GoPro appeared 47 years ago (see the pic below)!! You see, I’m going through the whole series of Bond films – from Dr. No to Skyfall. I’ve got them all in my laptop which I watch while on the treadmill in the gym. Amazing how enjoyable running on the spot can be :).

3. My music recommendation

No words needed. It’s music. To be heard and felt, not talked about. Enjoy!

That’s all folks. Hope you’re enjoying your summer. Godspeed!…

True to my word, herewith, the second installment of my new weekly (or so) series, ‘dark news from the cyber-side’, or something like that…

Today the main topic will be about the security of critical infrastructure; in particular, about the problems and dangers to be on the watch for regarding it. Things like attacks on manufacturing & nuclear installations, transportation, power grid and other industrial control systems (ICS).

Actually, it’s not quite ‘news’ here, just kinda news – from last week: fortunately critical infrastructure security issues don’t crop up on a weekly basis – at least, not the really juicy bits worthy of a mention. But then, the reason for that is that probably that most issues are kept secret (understandable, but worrying all the same) or simply no one is aware of them (attacks can be carried out on the quiet – even more worrying).

So, below, a collection of curious facts to demonstrate the current situation and trends as regards critical infrastructure security issues, and pointers to what needs to be done in face of the corresponding threats.

Turns out there are plenty of reasons to be bowled over by critical infrastructure issues…

The motto of engineers who make and install ICS  is ‘ensure stable, constant operation, and leave the heck alone!’ So if a vulnerability in the controller is found through which a hacker can seize control of the system, or the system is connected to the Internet, or the password is actually, really, seriously… 12345678 – they don’t care! They only care about the system still running constantly and smoothly and at the same temperature!

After all, patching or some other interference can and does cause systems to stop working for a time, and this is just anathema to ICS engineers. Yep, that’s still today just the way it is with critical infrastructure – no seeing the gray between the black and the white. Or is it having heads firmly stuck in the sand?

In September last year we set up a honeypot, which we connected to the Internet and pretended was an industrial system on duty. The result? In one month it was successfully breached 422 times, and several times the cyber-baddies got as far as the Programmable Logical Controllers (PLC) inside, with one bright spark even reprogramming them (like Stuxnet). What our honeypot experiment showed was that if ICS is connected to the Internet, that comes with an almost 100% guarantee of its being hacked on the first day. And what can be done with hacked ICS… yes, it’s fairly OMG. Like a Hollywood action movie script. And ICS comes in many different shapes and sizes. For example, the following:

Nuclear malware

Source

Read on: absence of light will only be the result of burned out bulbs and nothing else…