Explanation of Flash Crash: Denial of Service Attack demonstrating new Cyber Weapons

Increasingly it would appear that a plausible explanation of the May 6th Flash Crash is what is being described by the Chicago data firm, Nanex, as a sharp acceleration in the frequency of orders being sent to exchanges that preceded the plunge in the stock market.

In a new analysis Nanex, has identified a crucial period before the market fell on May 6th when, buy and sell orders shot up markedly.  Creating a saturation in the quote traffic.  The aim and in this case the effect of this saturation is to slow down some markets so that traders can profit by arbitrage with other exchanges. This looks and feels very much like the kind of cyber-war Denial of Service Attacks launched against critical web infrastructure, which have caused so much concern in the National Security Community.  The platform is different but the tactic and implementation are the same.  Arguably though the result is more devastating.

As the Security and Exchange Commission and the Commodity Futures Trading Commission publish their long-awaited report on the flash crash (before the end of the month). It is unlikely that cyber-warfare issues will be placed at the forefront as they seek to re-assure markets and attempt to re-inject some sense of stability.  However, a new area of cyber-warfare has presented itself through investigations into the May 6th crash.  The rapid movement of data throughout the markets can be manipulated to cause, what is in essence a Denial of Service attack against a particular node in the financial network.  Traders are doing this in order to benefit from the arbitrage effect but this tactic could be applied by illicit actors to damage markets themselves.  This is most certainly a new form of cyber weapon, from which financial systems need to defend themselves.

What makes this tactic of greater concern and speaks to the overall problems with High Frequency Trading is that there is little or no security regulation governing who can connect into the financial system in this way. Companies such as Gravitas offer Turn Key technology solutions for High Frequency Traders allowing them high speed connections to all market data and trade execution networks (see relevant quote in red).  While there are financial risk controls in place, there are no published systems for due diligence towards the individuals or companies applying their algorithms into the markets.  So while the EU and USA spends much of its political airtime viciously debating immigration, nobody is looking at who is migrating into the financial markets to make use of new tactics and vulnerabilities.

Atlantic on HFT: Suggesting some activity is akin to cyber attack

This piece in the Atlantic examines data from the firm Nanex, which shows High Frequency Algorithm’s working in unexplained ways.  The conclusion of this piece is that the algorithm’s are acting in the same fashion as a Denial of Service Attack, by slowing down some exchanges in order to benefit elsewhere.

Market Data Firm Spots the Tracks of Bizarre Robot Traders

By Alexis Madrigal

Mysterious and possibly nefarious trading algorithms are operating every minute of every day in the nation’s stock exchanges.

What they do doesn’t show up in Google Finance, let alone in the pages of the Wall Street Journal. No one really knows how they operate or why. But over the past few weeks, Nanex, a data services firm has dragged some of the odder algorithm specimens into the light.

The trading bots visualized in the stock charts in this story aren’t doing anything that could be construed to help the market. Unknown entities for unknown reasons are sending thousands of orders a second through the electronic stock exchanges with no intent to actually trade. Often, the buy or sell prices that they are offering are so far from the market price that there’s no way they’d ever be part of a trade. The bots sketch out odd patterns with their orders, leaving patterns in the data that are largely invisible to market participants.

In fact, it’s hard to figure out exactly what they’re up to or gauge their impact. Are they doing something illicit? If so, what? Or do the patterns emerge spontaneously, a kind of mechanical accident? If so, why? No matter what the answers to these questions turn out to be, we’re witnessing a market phenomenon that is not easily explained. And it’s really bizarre.

It’s thanks to Nanex, the data services firm, that we know what their handiwork looks like at all. In the aftermath of the May 6 “flash crash,” which saw the Dow plunge nearly 1,000 points in just a few minutes, the company spent weeks digging into their market recordings, replaying the day’s trades and trying to understand what happened. Most stock charts show, at best, detail down to the one-minute scale, but Nanex’s data shows much finer slices of time. The company’s software engineer Jeffrey Donovan stared and stared at the data. He began to think that he could see odd patterns emerge from the numbers. He had a hunch that if he plotted the action around a stock sequentially at the millisecond range, he’d find something. When he tried it, he was blown away by the pattern. He called it “The Knife.” This is what he saw:

“When I pulled up that first chart, we saw ‘the knife,’ we said, that’s certainly algorithmic and that is weird. We continued to refine our software, honing the algorithms we use to find this stuff,” Donovan told me. Now that he knows where and how to look, he could spend all day for weeks just picking out these patterns in the market data. The examples that he posts online are just the ones that look the most interesting, but at any given moment, some kind of bot is making moves like this in the stock exchange.