How the SEC Almost Shut Down Wall Street (and not in a good way)

[No Elephants]

Column by ADAM LEVIN, Credit.com
Nov. 18, 2012

Here's a fun fact: Hackers, just like bankers, real estate agents and collectors of Star Trek memorabilia, attend conferences. Even better: they play games at the conferences. One of the games they play has attendees aggressively competing to access any device in the hall, thereby demonstrating prowess in obtaining sensitive information. The goal is to exploit any vulnerability, or crack that which is perceived to be impenetrable, and share details for both educational purposes and bragging rights. This is the kind of thing you'd expect at a Black Hat hacker conference and why people with sensitive information on computers probably shouldn't bring them to the party. Especially employees of the Securities and Exchange Commission Trading and Markets division. And they really shouldn't have brought their computers with them. Except they did. Yes. This really happened.

Computers owned by the Securities and Exchange Commission Trading and Markets division were brought by SEC staffers to a hacker convention. They contained unencrypted, step-by-step instructions to shut down our financial trading system. Essentially: A Hacker's Guide to our Financial Universe.

Consider for a moment the kind of information that was hanging out in these computers, according to a recent Reuters story:

How the computers and networks inside massive stock exchanges including NASDAQ and the New York Stock Exchange are linked together.
How, in the event of a terrorist attack or natural disaster, what are the specific steps required to shut down the entire American stock exchange system, and how, after the disaster, we safely turn those systems back on.
What specific security measures have the exchanges implemented to secure their systems against accidental data breaches and determined hackers.

<snip>

The fact that S.E.C. employees brought Wall Street's blueprints to a Black Hat hackers' conference is both terrifyingly dumb and dumbfounding, despite the fact it appears, according to Reuters, that no data was breached. Nevertheless, it is hard to conceive of a less secure venue than this get-together where computer security experts and government intelligence leaders swap notes with all stripes of cyber-ninjas.

Very long story at: http://abcnews.go.com/Business/sec-shut-wall-street/story?id=17730628#.UKj6ZoYhTrc


:banghead: