7 ms·

Better yet: Short their stock, then write a scary blog post about the problem.

goda90 9y ago
I feel like someone would try to sue over such an action, but would they have any ground to stand on?
got2surf 9y ago
Just curious, what would the legal implications of something like that be? It seems like you're still benefitting from criminal activity that you enable, but what would the specific charge (if any) be? And any examples where people have tried this? Although I guess it could help align customer and business goals, since no one wants to lose money
- dragontamer 9y ago
  The Lumber Liquidators short-seller is quite a famous example of this strategy being executed. Before writing his blog-post, he short-sold a bunch of Lumber Liquidator stock and made tons of money during the fallout.
  - artursapek 9y ago
    Martin Shkreli claims to have made a lot of money by shorting pharma companies ahead of their FDA results - he would read their studies and make reasonably accurate predictions as to the outcome.
    - JackFr 9y ago
      Shkrelli has shuttered two hedge funds (Elea Capital Management & MSMB Capital Management) when he was unable to cover shorts and put options when the stock price moved away from him. He is also currently awaiting trial for securities fraud. So I would take his comments with a grain of salt.
      - artursapek 9y ago
        This is why I said "claims". He no doubt failed at some of his shorts. On a livestream he said he made all the money he still has on his companies, not trading. The strategy is still relevant to the discussion, though.
- artursapek 9y ago
  Attempted stock manipulation, probably
- CocaKoala 9y ago
  I posted this downstream, but it's happened and there weren't charges filed. http://www.pcworld.com/article/3155990/security/stock-tanking-in-st-jude-medical-security-disclosure-might-have-legs.html http://www.pcworld.com/article/3155990/security/stock-tankin...
  - got2surf 9y ago
    Great link, thanks for sharing. The quote that stood out to me was “My issue was that patient safety wasn’t front and center.” I don't have a problem with MedSec making money by shorting St. Jude's stock (that seems to align incentives to take care of security issues as early as possible). But if MedSec publicly disclosed specific, exploitable vulnerabilities (I'm not sure about specifics from the article), they shouldn't be able to hide behind the "doing what is best for the consumer" argument. It's definitely a clever business hack, and that's alright, but the fake sense of moral superiority isn't.
- andreyf 9y ago
  Not at all. You're making bets based on public information only you have realized is meaningful before informing the rest of the public to make money off that discovery. Quite a few folks make a lot of money this way and (nearly) everyone benefits: https://www.bloomberg.com/news/articles/2015-03-04/how-a-25-year-old-investor-spurred-lumber-liquidators-plunge https://www.bloomberg.com/news/articles/2015-03-04/how-a-25-...
  - emodendroket 9y ago
    Maybe but I, personally, would not want to take the risk that I might need to defend that proposition in court.
    - L_Rahman 9y ago
      IANAL but there is no risk that you may have to defend that proposition in court as long as you don't actually exploit the vulnerability and simply point it out. It's public information. Now if someone who works at the bank had told you about it, you'd be in a lot of trouble.
      - emodendroket 9y ago
        That's not really true; anybody can sue you if they want, whether or not you're in the right.
      - cookiecaper 9y ago
        IANAL either but my understanding is that you can be prosecuted under U.S. law for poking around on servers in any unconventional way. The text of the CFAA forbids "unauthorized access" or "exceeding authorized access". I'll admit that viewing the source code and noticing this link would be a stretch, but I wouldn't necessarily expect it to be a slam dunk for the researcher, especially if he had assented to the site's ToS (and since he had an account, it seems that he had). At this point, I imagine he could be in all sorts of (primarily civil) trouble for the disclosure that he just made. He may be protected under some type of financial whistleblower law, but I wouldn't hold my breath.
- jimlawruk 9y ago
  https://www.quora.com/Is-it-legal-to-short-a-companys-stock-before-publishing-information-that-damages-the-company https://www.quora.com/Is-it-legal-to-short-a-companys-stock-...
- downandout 9y ago
  There are law firms working with hedge funds that specialize in doing exactly this when they are about to file a class-action suit. It's possible to be criminally charged if you know that the information you are spreading is false. But other than that limited circumstance, you are free to trade on any information you have about a company that you did not illegally obtain from an insider. Even in the case that the information was obtained from an insider, to convict you, the government must be able to prove that you knew that the insider both a) received a benefit (usually money) in exchange for the information, and b) breached their fiduciary duty by disclosing the information. That said, technical glitches tend to not affect the fortunes of companies nearly as much as we (the HN crowd) think. Tradeking had the glaring vulnerability outlined in this article for years, and they are doing just fine.
  - got2surf 9y ago
    Great point, I think the tech crowd may overestimate the cost of glitches, relative to everything else at play in a business. I think the point I'm getting hung up on is that the bank's stock price could drop for two reasons: bad PR due to the glitch, and/or falling financials due to fraud perpetrated as part of the glitch. I can completely understand a hedge fund trading and making money off the bad PR. But if (hypothetically) the bank lost a ton of money by hackers liquidating user accounts or, worse, making leveraged bets [before everyone checked for that sort of thing ;)], and the hedge fund knew there was a reasonable chance that the malicious activity would occur based on the newly disclosed information, would they have liability there? (from the theft/fraud perpetrated against the bank, not the drop in stock price)
    - downandout 9y ago
      I believe that responsible disclosure is a courtesy to the vendor and its customers. Afaik, there is nothing in the law that requires it. Exploiting vulnerabilities like the one you are discussing here yourself certainly would be illegal, and you could possibly be implicated in a conspiracy if you disclosed the vulnerability solely to one person or group that you knew would exploit it (so "I told my Russian hacker friend about this..let's short the stock before he nails them with it!" would probably be a conspiracy case, whereas a press release or HN posting would not be). But general public disclosure of a vulnerability, and/or trading on the anticipated effects of public disclosure, is not illegal. It likely won't win you friends in the IT community, but it falls short of an indictable offense.
CocaKoala 9y ago
This has been done! http://www.pcworld.com/article/3155990/security/stock-tanking-in-st-jude-medical-security-disclosure-might-have-legs.html http://www.pcworld.com/article/3155990/security/stock-tankin... A company discovered vulnerabilities in some medical devices, then shorted the stock of the company before disclosing them.
77pt77 9y ago
And get sued for libel and market manipulation.
nickpsecurity 9y ago
Alternatively, publish it in an obscure place online, get proof you published it in archived medium (eg Gmail or Archive.org), short the stock based on that now-public information, and then reveal it again in a way that will get stock-smashing attention. That's my hypothetical model I came up with when trying to figure out how to incentivize apathetic, but public companies, to care about security a bit. You can even follow up offering them security consulting but don't expect a yes haha.

I feel like someone would try to sue over such an action, but would they have any ground to stand on?

Just curious, what would the legal implications of something like that be? It seems like you're still benefitting from criminal activity that you enable, but what would the specific charge (if any) be? And any examples where people have tried this? Although I guess it could help align customer and business goals, since no one wants to lose money

dragontamer 9y ago
The Lumber Liquidators short-seller is quite a famous example of this strategy being executed. Before writing his blog-post, he short-sold a bunch of Lumber Liquidator stock and made tons of money during the fallout.
- artursapek 9y ago
  Martin Shkreli claims to have made a lot of money by shorting pharma companies ahead of their FDA results - he would read their studies and make reasonably accurate predictions as to the outcome.
  - JackFr 9y ago
    Shkrelli has shuttered two hedge funds (Elea Capital Management & MSMB Capital Management) when he was unable to cover shorts and put options when the stock price moved away from him. He is also currently awaiting trial for securities fraud. So I would take his comments with a grain of salt.
    - artursapek 9y ago
      This is why I said "claims". He no doubt failed at some of his shorts. On a livestream he said he made all the money he still has on his companies, not trading. The strategy is still relevant to the discussion, though.
artursapek 9y ago
Attempted stock manipulation, probably
CocaKoala 9y ago
I posted this downstream, but it's happened and there weren't charges filed. http://www.pcworld.com/article/3155990/security/stock-tanking-in-st-jude-medical-security-disclosure-might-have-legs.html http://www.pcworld.com/article/3155990/security/stock-tankin...
- got2surf 9y ago
  Great link, thanks for sharing. The quote that stood out to me was “My issue was that patient safety wasn’t front and center.” I don't have a problem with MedSec making money by shorting St. Jude's stock (that seems to align incentives to take care of security issues as early as possible). But if MedSec publicly disclosed specific, exploitable vulnerabilities (I'm not sure about specifics from the article), they shouldn't be able to hide behind the "doing what is best for the consumer" argument. It's definitely a clever business hack, and that's alright, but the fake sense of moral superiority isn't.
andreyf 9y ago
Not at all. You're making bets based on public information only you have realized is meaningful before informing the rest of the public to make money off that discovery. Quite a few folks make a lot of money this way and (nearly) everyone benefits: https://www.bloomberg.com/news/articles/2015-03-04/how-a-25-year-old-investor-spurred-lumber-liquidators-plunge https://www.bloomberg.com/news/articles/2015-03-04/how-a-25-...
- emodendroket 9y ago
  Maybe but I, personally, would not want to take the risk that I might need to defend that proposition in court.
  - L_Rahman 9y ago
    IANAL but there is no risk that you may have to defend that proposition in court as long as you don't actually exploit the vulnerability and simply point it out. It's public information. Now if someone who works at the bank had told you about it, you'd be in a lot of trouble.
    - emodendroket 9y ago
      That's not really true; anybody can sue you if they want, whether or not you're in the right.
    - cookiecaper 9y ago
      IANAL either but my understanding is that you can be prosecuted under U.S. law for poking around on servers in any unconventional way. The text of the CFAA forbids "unauthorized access" or "exceeding authorized access". I'll admit that viewing the source code and noticing this link would be a stretch, but I wouldn't necessarily expect it to be a slam dunk for the researcher, especially if he had assented to the site's ToS (and since he had an account, it seems that he had). At this point, I imagine he could be in all sorts of (primarily civil) trouble for the disclosure that he just made. He may be protected under some type of financial whistleblower law, but I wouldn't hold my breath.
jimlawruk 9y ago
https://www.quora.com/Is-it-legal-to-short-a-companys-stock-before-publishing-information-that-damages-the-company https://www.quora.com/Is-it-legal-to-short-a-companys-stock-...
downandout 9y ago
There are law firms working with hedge funds that specialize in doing exactly this when they are about to file a class-action suit. It's possible to be criminally charged if you know that the information you are spreading is false. But other than that limited circumstance, you are free to trade on any information you have about a company that you did not illegally obtain from an insider. Even in the case that the information was obtained from an insider, to convict you, the government must be able to prove that you knew that the insider both a) received a benefit (usually money) in exchange for the information, and b) breached their fiduciary duty by disclosing the information. That said, technical glitches tend to not affect the fortunes of companies nearly as much as we (the HN crowd) think. Tradeking had the glaring vulnerability outlined in this article for years, and they are doing just fine.
- got2surf 9y ago
  Great point, I think the tech crowd may overestimate the cost of glitches, relative to everything else at play in a business. I think the point I'm getting hung up on is that the bank's stock price could drop for two reasons: bad PR due to the glitch, and/or falling financials due to fraud perpetrated as part of the glitch. I can completely understand a hedge fund trading and making money off the bad PR. But if (hypothetically) the bank lost a ton of money by hackers liquidating user accounts or, worse, making leveraged bets [before everyone checked for that sort of thing ;)], and the hedge fund knew there was a reasonable chance that the malicious activity would occur based on the newly disclosed information, would they have liability there? (from the theft/fraud perpetrated against the bank, not the drop in stock price)
  - downandout 9y ago
    I believe that responsible disclosure is a courtesy to the vendor and its customers. Afaik, there is nothing in the law that requires it. Exploiting vulnerabilities like the one you are discussing here yourself certainly would be illegal, and you could possibly be implicated in a conspiracy if you disclosed the vulnerability solely to one person or group that you knew would exploit it (so "I told my Russian hacker friend about this..let's short the stock before he nails them with it!" would probably be a conspiracy case, whereas a press release or HN posting would not be). But general public disclosure of a vulnerability, and/or trading on the anticipated effects of public disclosure, is not illegal. It likely won't win you friends in the IT community, but it falls short of an indictable offense.

CocaKoala 9y ago

This has been done! http://www.pcworld.com/article/3155990/security/stock-tanking-in-st-jude-medical-security-disclosure-might-have-legs.html http://www.pcworld.com/article/3155990/security/stock-tankin... A company discovered vulnerabilities in some medical devices, then shorted the stock of the company before disclosing them.

77pt77 9y ago

And get sued for libel and market manipulation.

nickpsecurity 9y ago

Alternatively, publish it in an obscure place online, get proof you published it in archived medium (eg Gmail or Archive.org), short the stock based on that now-public information, and then reveal it again in a way that will get stock-smashing attention. That's my hypothetical model I came up with when trying to figure out how to incentivize apathetic, but public companies, to care about security a bit. You can even follow up offering them security consulting but don't expect a yes haha.