Robert Len - (In)Outsider Trading – Hacking stocks using public information and (influence)

hello everyone can you hear me so yes welcome to my talk on in and outside of trading it sounds a little weird and confusing hopefully you will understand as we go along before I get started let's do the the obligatory who am I so my name is Robert Lynn I work as a security analyst for Tel space systems in Johannesburg I am originally from Cape Town perhaps my hair style and beard give it away things I'm into I love all things hacking I love retro video games and I love beating the system and it's that last point that really brings me on to this topic so before I start there are a couple text-heavy slides I will speak through

them and particularly this topic itself is not incredibly technical it's more conceptual and creative it's more like taking something we do as security analysts and applying it to another industry so to pay homage to the shower thoughts subreddit this is a fort by me one day in the shower try not to picture that as security professionals our mindset the way we work we're really always looking out for anomalies we're trying to spot outliers we're looking for weaknesses so why can't we apply that to the stalks why should all these guys in Ferraris and have all that you know sort of fancy nice stuff why can't we do it as a security analyst surely our minds are

trained for that so what's the point of it all I mean quite simply to beat the system and to make some money most definitely maybe spending some of tell spaces money investing in some random stocks I don't know so I'm just gonna go do a little bit of a brief talk about some stock market fundamentals not gonna bore you with it hopefully not and I'm no expert at it myself but these are just a couple of things that are relevant to the topic so you get something short-selling going short on a stock it basically means you're betting on it going down you borrow these stocks from your broker you believe that they're gonna be but the price is going

to drop so you borrow them from him with that hope and then you buy them when the price goes down as you hoped and you make some money the more that price goes down the more money you make the opposite of that is going long taking a long position that is something that's pretty generic you buy a stock and you hope it's going to go up and when it does you sell it and make a profit so the big question is what influences these prices that's all you really need to know is is the stock going to go up or is it going to go down because if you know that you can go long

or you can go short and you can make money of it so the main things that influence stock prices and there are lots and I do not know all of them but quarterly result announcements which happen by law for listed companies and big events a merger a horrible PR nightmare a product launch any of these can spike a price or dip a price so knowing these in advance that's the idea knowing something like this is going to happen if you know this price is going to go up or go down you can definitely make some money of it so these are some illegal stock manipulation methods and these will end you up in jail and it

will not be as good as it is in orange is the new black so a good example is Sony quite a few years ago Sony had a massive DDoS attack I think 77 million users were compromised and subsequently locked out and because of that their share price tumbled 6 percent due to this outage another example is the Bank of America so this one was a politically motivated hack or DDoS and took Bank of America side out for about 24 hours and the share price dropped 1% of its value in one day which is a lot the Hong Kong Stock Exchange had a similar sort of DDoS this one was really clever it wasn't actually the Hong Kong stock

exchange itself it was the new site where other stocks would announce their results so on this particular day that site was taken down and seven massive stocks such as HSBC and Cathay Pacific could not release results and as such couldn't trade for the rest of the day major losses incurred and no one really knows what the real point of it was now spearfishing I mean I certainly don't need to preach to the choir here about the dangers of spear fishing but taking a different look at it spear fishing can really be useful in terms of trading and manipulating a stock so the basic how-to would be you spear fish your CEO or CFO you hopefully get

access to those emails you read those emails and you understand what the company position is and instead of going further and trying to actually compromise his machine or hacklin you just read his emails and you just get an idea what's going on and then you trade on that stock that is insider trading and you will go to jail for it but it's it can easily be done now in terms of some of these big big phishing scams one of them was a double was known as the w2 phishing scam the w2 is a tax form requirement in the US and this year alone over 70 US companies were hit by this w2 phishing scam so the whole modus

operandi of it was the CEO or some other CFO sends an email to his HR and says right I need everybody's tax w-2 forms immediately and they send them on now the thing is with these these w-2 forms you can actually then take it and claim from tax and get rebates and get money for it some other poor people's tax rebates and it was really really successful but the thing is if a company wants a word of a phishing scam gets out it's never good for companies stocks get affected by that just like they do for DDoS attacks and particularly tech company when tech companies get compromised or fished it affects them badly so Seagate is a really good

example of what happened with the w2 phishing scam they got their whole 2015 all ex employees current employees all of their details were compromised and this stock dropped three and a half percent the day that the new scam broke so if you're thinking about it if your official you've got a double vector here for making money because you know the stocks are going to plummet after you release the octave of the news of it gets out and you know that you can use this information you've captured to get rebates so there's a two-pronged attack yet but these these are illegal these will get you in a lot of trouble but there are legal ways to do it so I

know Jordan Belfort is probably the not the best poster boy for legal trading but he definitely is for making a lot of money and there are guys out there making a lot of money and it's all about this information it's all about getting an idea is the stock gonna go up is the stock gonna go down and there's a lot of really really smart companies out there that are doing things to get this information so as we spoke about things like quarterly results mergers press releases these little hints once you know what's going on with these all you need is an indicator you can make a lot of cash so looking at some of these

companies that provide this data this is a there's quite a few and before I get into it I must just thank one of the researchers Nick Korolev it and the Wall Street Journal for releasing some of this data and reporting on some of these companies it's really interesting and really relevant to this talk so gents cape these guys are amazing they are you don't speak to them for under six figures they are super smart they've got satellites they've got artificial intelligence and they've got choppers with infrared cameras choppers with infrared cameras so what do they do with these choppers with infrared cameras they fly over Cushing Oklahoma which is where 80 to 90 percent of the us's

oil supply goes through and the u.s. consumes a lot of oil twelve million barrels of oil a day so these choppers with infrared cameras fly over the storage tanks every single day and they take storage levels and with that information they are able to gauge what the EIA will announce the EIA is a American energy agency that announced oil supplies every week so by being able to check the levels of oil they kind of know what the demand and the supply is and with that they can work out where the price is going and then they sell these reports to their clients their clients trade on it and then make huge cash another cool example what UBS

investment did Investment Research layer hired a company called remote sensing metrics now these guys are a satellite in analytics firm and what they did was they took photos of Walmart's parking lot about a hundred of them are sample size and every single day that would take photos of Walmart's parking lot and count the cause quite simply an over amount of time that could kind of work out with in mathematical regression whether or not there were more cars or less cars and more cars equals more sales and from that they had a report in the report was a hundred percent right sales were going up the stock was going up they sold that report to their

clients and they made money last year saw an e coli outbreak at Chipotle a US Mexican chain now obviously when your restaurant when you coli gets traced back to your restaurant it's not a good thing no she's not going to go up it's definitely going to go down but the question is would it recover and a company called second measure partnered with a anonymous bank and took a whole lot of credit card data sanitized credit card data so they said and this data what they could see with this data was that e coli sorry Chipotle was definitely not recovering they could see from the credit card sales that it was not recovering definitely not in fact it

was plummeting another's graph is a little horrible but basically at this point in time that's when the e-collar outbreak happened it continues to plummet there was no recovery so they knew to tell their clients to continue to short the share but not only that they could see where Chipotle's clients were now going so once again they had the two-pronged attack by the report will tell you keep shorting and will tell you which guys - now go long on so that's all good and wealth if you have six figures to spend on a report which I don't so how do we do it ourselves how do we take the information out there and apply it to any sort of company or any

sort of stock how do we get it without going to jail without spending a whole lot of money so as MacGyver would do it and he would blow up a tank with a ever caught Oh an ice pick and you've got to use what you have that's it we got it we've got to somehow use what we have and there is a lot of information out there we don't realize it and a lot of it in particular the stuff we deal with every day I mean if we look at the pen testing methodology it's nothing it's nothing new it's nothing fancy it's nothing they're two different but maybe our focus here is is wrong I mean for us

a discovery is just part of the process that gets us to the goldmine of exploit but maybe the discovery phase is actually where all the good information is maybe that information is is far more valuable and certainly in in finance and in stock it it is it is more valuable it's just a matter of how you use it so this information that we collect day-in day-out we're scanning we're probing we're searching all over the internet maybe this information can be used in another way and it definitely can there we go so before I get started on some of the ways I've been looking at doing this I'm gonna talk about some methods used by others so Foursquare I'm sure we're

all aware of it social media checking in and all of that the API has been used and abused for years by fund managers these guys have been loving this essentially you just check in all your take all the check-in data have a look at which retailers are getting more check-ins getting more chickens surely they're getting more customers stocks probably going up most of the time they were probably right 4-squared realized this and it since raised their price on the API usage massively and as they should another way is sites with auto incrementing user IDs I mean you could register a new user every week every month with that track how many users have registered over the last week

or month and then compare that with the expected results and see if it's up or down I know this was effectively used when the dobe shifted their model to the cloud-based system using the Creative Cloud very rare Tokra auto incrementing IDs and people were able to trade on it they had an idea they knew that adder but actually beaten therefore costs and based on that they went long on the share and they made a lot of money so now looking at some of the research that I've done over the past year or so so it's it's not really too easy it takes a lot of time and a lot of effort but the skills involved are actually

pretty simple it's stuff a security analyst that you do day in day out it's nothing really different it's just applying it in a different way so one of the ways is Google Trends which we'll go through another way is reverse who is and another option is DNS enumeration so Google Trends is nothing new people have been trading on it for a long time and successfully for a long time having a look at just a pretty simple graph here will show you i phone searches over the last three releases so I found five and this is for the search term Apple iPhone iPhone five had some good search a lot of searching going on iPhone six pretty

good iPhone seven dropped down a little bit so you've got to wonder I mean it lack of the less searches mean less purchases they do and if you'd looked at this graph and done this research at the time you would have seen that a month later either reports six weeks later when Apple released the report iPhone sales had dropped so simply looking at a Google Trends for a product can give you a pretty good indication that if search terms are down buying is often done and yeah Apple shares dropped to two point six percent on the news of the iPhone sales decreasing

looking at reverse who is it's something pretty innocuous something I'm sure a lot of us do day to day on on systems analysis and network analysis you want to basically see all the domains associated with a particular registrants details now if you're looking at a network you want to see exactly what other sites they've got registered perhaps it's a way in it's very useful and often new products if you're launching a new product you're gonna need a new domain name for it you can't take one that's already been taken so they are online services where you can continually monitor and check registering details I've got a certain email address I want to see what this

guy has registered you can pay for an API service monthly it's really not expensive based on some of the money you can make and you can continually check thousands of websites what new domains they're registering so I thought this is an interesting way I'm gonna have a look at this I'm gonna find a site or a few where I can track I can see what they're up to and I can make some investment choices so I looked at the NASDAQ and the Nasdaq is a very interesting place there's over 3,000 companies listed there but I particularly focused on the ones that sell a lot of products a lot of new merchandise a lot of items that

require new domain names and so I came across a really interesting one but I hadn't heard of called koti so Cote is one of the world's leading beauty companies with nine billion dollars in revenue and over seventy seven brands and what I didn't know also is that koti represent Katy Perry Katy Perry's perfume is published well at least released via Coty and Katy Perry sells a lot of perfume so looking at Coty and all their domains I picked up that Katy Perry Mad Love had been registered and as a Coty follower I'd notice for quite a few years that they'd released all of Katy Perry's perfumes and all of them had domain names and Katy Perry Mad Love

was released at the end of March 2016 so if you can't make money of this you can at least impress your girlfriend you can predict Katy Perry's new perfume name so I made a note of this and I set all my Google Alerts and all my - and I actively started looking for Katy Perry mad lovin there was nothing I couldn't find anything and eventually the social media campaign launched I got note of it straight away that Katy Perry's mad love was launching sending your selfies and Cody shares spikes on this news because Katy Perry sells a lot of perfume so I knew I had some sort of idea here that maybe maybe this can work I'd never in my life

thought I'd be interested in win Katy's new perfume was gonna be released but I found myself looking for it then I looking through the news and looking through everything I came across new Tendo and I saw that Nintendo launched a new game for iPhone Super Mario run and their shares spiked 18 percent that day 18 percent is a lot I was like damn it how did I miss this one man if you would have spotted this one coming man that's a that's a meal ticket man because Nintendo are interesting they share prices fluctuate often and massively they're they're a very interesting company to watch so how I mean I wasn't tracking Nintendo but I thought if I was would I've seen this

coming would I've been able to say damn it they've registered this there's a new domain name it's something big I'm gonna buy the shares and I'm gonna make a whole lot of money of it so Super Mario run is coming in December and I looked at the domain name and it was registered the day it was launched so it could be a coincidence oh it could be that some of the companies out there a little smarter and realized releasing things like this can cause leaks and can cause people to have an idea on what they're doing and where their share price is going so it's not all international it's not all overseas companies I did some local

looking as well on the JSC and I had a look at old spur spur a really interesting company as well very successful really good share and they make some really good acquisitions they bought rocker mamas they bought hussar grill some smart investments and they don't have a lot of domain names so they're not difficult to track and you know when something pops up on the spur that it's big and at the end of los ríos were registered Casa Bella pizzeria now I'd never heard of Casa Bella pizzeria nobody else did because it was then new branch a new venture a high-end pizza restaurant and when they made the announcement share prices increased you would have

made some money on that well I would have if I wasn't just tracking it and actually investing but that's next so the final way that I thought maybe I can make some money of this it's far more time consuming but definitely worth it it's about DNS enumeration something I'm sure we're all very familiar with so the Nasdaq is a massive scary place they are we are three thousand one hundred and fifty five companies I've looked at a lot of them of those four hundred and forty nine are categorized as technology companies so I wonder how many of those technology companies allow DNS zone transfers quite a few and I'm not going to go into any details here

because this is a little borderline if someone can inform you I don't know what the legalities are of zone transfers but I don't really want to mess with it and so you're gonna have to trust me on this one so imagine if one of the company is listed as a technology company that allowed certain transfers was an online software provider was any sort of online service and you can zone transfer them so then you couldn't conceivably zone transfer every week every month have a look at all the servers they're adding and if you can see those servers there and you can get an idea how many new customers they're getting and if those servers are I mean gift-wrapped

for you and sequentially numbered or names then it's amazing and sometimes if you're lucky some of them will even correlate to internal DNS records so now you know exactly what's going on and you know exactly how quick it's happening so you do this over a couple of months or over a year and you line these up with quarterly results announcements so I know in the first quarter announcement this company did not too bad and I could see exactly how many new servers they added next time I can track again how many new servers how much more money how much more and now no better announcements have they made in this particular company had a really good

last quarter really good the stock to jumped six percent on the news of this lots of new subscribers lots of new business and I knew this I saw this coming and that is exactly where the price increased so what happening so they're definitely finding it's all about finding this company it's all about finding the ones that you can track so to wrap it all up there's no guaranteed method on any sort of trading otherwise we'd all be millionaires and the same goes for Osen trading it's all about indicators it's all about finding the right company it's all about finding the one that you can track the one you get used to and finding their timings

and how they work doesn't apply to all clients most definitely not some are smaller than others but it's about picking your one and tracking it and that is my story [Applause]