CybersecurityCritical cyber vulnerabilities found in financial system

A recent report released by cPacket Networks found critical weaknesses in automated high-frequency trading systems that hackers could exploit to make money or simply wreak havoc on the financial system.

Based on tests in its labs, cPacket believes that hackers could stealthily create variations in how financial market data is received by computers running high-frequency trading programs.

These slight variations could manipulate the automated systems giving hackers an unfair trading advantage or disrupt systems all together.

High-frequency trading is a technique that uses high powered computers that analyze market data to buy and sell various stocks in fractions of seconds to take advantage of micro-fluctuations in price.

This technique relies upon speed and powerful computers and eschews traditional investing practices of analyzing companies for their long term potential or broader market trends.

Dr. Rony Kay, CEO of cPacket, says, “We have been able to create micro-behaviors that could be used to target specific market data and trades feeding into automatic trading systems. We believe that such techniques pose a substantial risk of creating unfair trading, if used by the wrong people.”

cPacket calls these cyber attacks a “side channel attack,” because these micro-variations are introduced “under-the-radar” and undetected by network monitoring tools.

Kay says that, “In the current environment, these side channel attacks could go unnoticed until it is too late.”

cPacket discovered this weakness in high-frequency trading systems as it focuses on providing monitoring systems that detect discrepancies and micro-fluctuations in data packets travelling through high speed networks.

cPacket believes that it has the ability to detect these stealthy intrusions and prevent high-frequency traders from unknowingly losing money to hackers.

“It is critical that financial executives become aware of the minutest details of their data transfers to avoid problems,” said Kay.

cPacket is using its expertise in employing algorithms to inspect every bit of every data packet to advise senior financial and technology executives on how to optimize high frequency trading systems.

Jessica Herrera-Flanigan, a contributor for Nextgov, points to the flaws in focusing too much effort on securing access controls rather than securing the foundation of the system itself.

She writes, “Very often in computer security, too much trust is put in access controls — passwords, identification cards, biometrics, and so on — and not enough thought is given to limiting the consequences if those controls are defeated and unauthorized access occurs.”

Kay echoes this sentiment, saying, “Automatic trading platforms that use sophisticated algorithmic trading techniques and the traders that operate them must monitor network latency with the same diligence that they monitor market prices, trends, and news.”

As evidence of an attack’s potentially disastrous effects, she points to the “flash crash” that occurred last May when the Dow dropped nearly 1,000 points over the span of several minutes.

While the exact cause is difficult to pinpoint, many analysts believe that crash was unintentionally set in motion by automated high-frequency trading systems.

Regulators and financial institutions are building more safety measures into these high-frequency trading and other automated trading systems to prevent future crashes or attacks.