Feeds

Hacker holds onto ill-gotten gains thanks to US courts

The Dorozhko Defense

Using blade systems to cut costs and sharpen efficiencies

This story was updated to correct an error in an earlier version. Dorozhko was never accused of breaking into networks belonging to IMS Health.

Oleksandr Dorozhko made almost $300,000 in stock-option trading by using insider information that was obtained after someone hacked into a financial network and stole confidential information concerning a company called IMS Health. Now, the Ukrainian resident is exploiting a loophole that may allow him to keep the ill-gotten gains for good.

That's because US securities laws, unlike those in Europe and elsewhere, define insiders as those with a fiduciary role with a company - say, a corporate executive, investment banker or attorney. As a mere hacker, or as an associate to a mere hacker, Dorozhko had no such function, so the laws cannot be used to seize the assets, a federal judge has ruled.

The strange tale, which was reported here by The New York Times, reads like a chapter out of Catch 22. According to evidence presented by the Securities and Exchange Commission, minutes after someone broke into a network of Thomson Financial and stole a gloomy IMS Health earnings report scheduled to go public a few hours later, Dorozhko invested a little more than $41,000 in put options that bet the company's share price would plunge.

And plunge it did. Dorozhko ended up pocketing more than $296,000 in the transaction. Not bad for a few hours work.

Just about everyone agrees he committed fraud and just about everyone agrees it was for the purpose of gaining an unfair advantage in trading shares of IMS Health. And yet, because the information was illegally obtained, US insider laws have no bearing, according to US District Judge Naomi Reice Buchwald, who ordered the SEC to turn over the money. Ironically, had the insider information been obtained legally, the SEC would most likely have been permitted to seize the funds.

Jeremiah Grossman, the CTO of WhiteHat Security, says here that the loophole, if left unclosed, could also aid hacks that technically don't require the bypassing of password requirements or other security measures. He notes that so-called predictable resource location hacks, in which a person guesses the location of a web document before it goes public, have already been used by Estonian stock traders.

Prosecutors with the Justice Department are probably free to file criminal charges against Dorozhko for computer hacking. But given his status as a Ukrainian, it's doubtful they'd succeed. And even if they did, it's even less likely they'd recover the proceeds.

So thanks to the arcana of US securities laws, illegal hacking does pay. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.