The Register® — Biting the hand that feeds IT

Feeds

Low-tech hack was behind $7.2bn SocGen fraud

FSA warns City on risks

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

The French software developer turned rogue trader who cost French bank Société Générale an estimated €4.9bn ($7.2bn) used co-workers' access codes to set up fraudulent transactions.

Jerome Kerviel used his colleagues' access codes and sent fraudulent email in order to create fictitious accounts to take risky positions in the derivatives market, resulting in huge losses as stock markets across Europe fell. He used his five years' experience in helping to develop the bank's trading systems to remove limits on his personal trading positions, and faked customer accounts to balance the books.

He also used hacking techniques to turn off warning systems that could have alerted his bank about anomalous trading patterns, The Daily Telegraph reports. This sounds complicated, but could have been as simple as manipulating the production of Excel spreadsheets that are used to provide trading updates to bosses, according to City experts.

A copy of Kerviel's CV found circulating on the net - which lists Microsoft Office and Microsoft Visual Basic as his only IT-related skills - supports the theory that the rogue trader carried out a low-tech hack, Information Week adds.

The alarming SocGen debacle ought to galvanise the UK's investment banks, spurring efforts to tighten up trading controls, according to City regulator the Financial Services Authority.

The watchdog warns that the scandal has emerged at a time when the global credit crunch is putting pressure on dealers, thereby creating an environment where some are more likely to be tempted into cutting corners while firms are tempted to divert resources away from security controls. The scenario was one of five key threats to the financial system detailed in the regulator's annual Financial Risk Outlook report.

Specifically, it warned that "tighter economic conditions could increase the incidence or discovery of some types of financial crime or lead to firms’ resources being diverted away from tackling financial crime".

Another key risk identified in the report is that "increased financial pressures may lead to financial firms shifting their efforts away from focusing on conduct-of-business requirements and from maintaining and strengthening business-as-usual processes, such as stress testing and credit derivative trade confirmations".

The report goes on to talk about the strain imposed on back-office systems by the rapid expansion of the credit derivatives markets.

"If firms are not able to keep up with this growth, they could face operational and legal risks. In general, credit derivative trade confirmation backlogs have been reduced while deal volume has grown rapidly but despite improvements back-office operations were unable to manage the increases in volumes during periods of heightened market volatility."

If anything, reporting problems are worse in the equity derivatives market, the scene of the SocGen meltdown. The FSA's analysis of IT-related risks in the market bears repeating in full:

The equity derivatives market faces a different set of challenges compared with the credit derivatives market. These include a lack of standardised master confirmations, a more diverse client base with far fewer interbank trades and multiple electronic confirmation platform providers (which have been under utilised).

The industry has made some progress in addressing these issues, but there is still much progress to be made before equity derivative confirmation processes may be considered fully scalable. Currently less than 20 per cent of equity derivative trades are electronically confirmed compared with 90 per cent of credit derivatives.

Lack of (rapid) electronic confirmation may have been a factor exploited by Kerviel to hide his transactions, or rack up a huge debt before he was discovered. Until a full investigation is carried out, it's hard to know. City regulators are sure to take a close look at the results of the Société Générale investigation, which is been led by the French authorities.

"This [the SocGen rogue trader scandal] has been a wake-up call for our firms," said the FSA's head of risk Lyndon Nelson, The Daily Telegraph reports. "We have obviously been liaising with our French colleagues and other authorities here in the UK, and we are looking for lessons to learn." ®

Agentless Backup is Not a Myth

Latest Comments
Anonymous Coward

citations and evidence please ..

Dear John, do you have citations or any evidence for the following:

01. Jérome Kerviel was a software developer

02. used co-workers' access codes to set up fraudulent transactions

03. sent fraudulent email

04. helped to develop the bank's trading systems

05. disabled warning system

-------

Since when did a certificate in Visual Basic make you a software developer .. :)

"could have been as simple as manipulating the production of Excel spreadsheets that are used to provide trading updates to bosses, according to City experts.

What was the name of these 'experts'. How does allegidly faking data in a spreadsheet translate into hacking, using access codes and sending fraudulent email. Do you have any samples of these emails?

"A copy of Kerviel's CV found circulating on the net"

http://www.thedeal.com/dealscape/2008/01/sg_traders_resume.php

EDUCATION MASTERS in Finance .. Bachelor Degree in Finance

University of Nantes, 1996 1999

SKILLS Microsoft Office Packge - Visual Basic

-------

"The photos of you and the girl will be recycled for proletarian use", 1984

0
0

ID KEY system will deter all fraud crimes.

Fraud crimes will continue to grow until the government and banks exploit ID KEY system described on website www.xwave.co.uk which will make both signature and PIN systems reliable and foolproof.

Current signature and PIN systems are the root cause of the problem because fake documents have made signature system unreliable while skimmers and pin-hole cameras have made PIN system unreliable.

It is obvious that it is virtually impossible to stop fraudsters from obtaining our personal details and hence the need to deter fraudsters from misusing these stolen details via use of ID KEY system is a must to deter fraud crimes.

Proposed ID KEY can be treated as a reliable international ID card because it will personalise signature and PIN number to only the right individuals.

0
0

Lone hacker... oh really

The story in yesterday's Independent is more believable - it suggested that his bosses knew what he was doing but because he was making shedloads of money they turned a blind eye.

0
0

More from The Register

 breaking news
Number of cops abusing Police National Computer access on the rise
Only a telegram from the Queen can get you off it
 breaking news
NSA PRISM snoop-gate: Won't someone think of the children, wails Apple
10,000 things probed, mostly about missing kids, Alzheimer patients, we're told
Flash flaw potentially makes every webcam or laptop a PEEPHOLE
But it's a Google problem - Chrome only, insists Adobe
 breaking news
NSA PRISM-gate: Relax, GCHQ spooks 'keep us safe', says Cameron
Whatever they are up to, it's all above board, we're told
PRISM snitch claims NSA hacked Chinese targets since 2009
Snowden suddenly looks safer in Hong Kong after revelations
 breaking news
US chief spook: Look, we only want to spy on 6.66 BEELLLION of you
Americans assured they are not in the NSA's sights
Speech-to-text drives motorists to distraction
Will talking to you mean I crash into that car up ahead, Siri?
DHS warns of vulns in hospital medical equipment
Has your doctor's anasthesia machine been hacked?
 breaking news
'BadNews is malware' says outfit that found it
Google says code harmless but Lookout says code base is evolving
Panda-peddlers cuffed for chess gambling gambit
More porridge on the menu for Chinese coders after second offence