Feeds

Hacker holds onto ill-gotten gains thanks to US courts

The Dorozhko Defense

Beginner's guide to SSL certificates

This story was updated to correct an error in an earlier version. Dorozhko was never accused of breaking into networks belonging to IMS Health.

Oleksandr Dorozhko made almost $300,000 in stock-option trading by using insider information that was obtained after someone hacked into a financial network and stole confidential information concerning a company called IMS Health. Now, the Ukrainian resident is exploiting a loophole that may allow him to keep the ill-gotten gains for good.

That's because US securities laws, unlike those in Europe and elsewhere, define insiders as those with a fiduciary role with a company - say, a corporate executive, investment banker or attorney. As a mere hacker, or as an associate to a mere hacker, Dorozhko had no such function, so the laws cannot be used to seize the assets, a federal judge has ruled.

The strange tale, which was reported here by The New York Times, reads like a chapter out of Catch 22. According to evidence presented by the Securities and Exchange Commission, minutes after someone broke into a network of Thomson Financial and stole a gloomy IMS Health earnings report scheduled to go public a few hours later, Dorozhko invested a little more than $41,000 in put options that bet the company's share price would plunge.

And plunge it did. Dorozhko ended up pocketing more than $296,000 in the transaction. Not bad for a few hours work.

Just about everyone agrees he committed fraud and just about everyone agrees it was for the purpose of gaining an unfair advantage in trading shares of IMS Health. And yet, because the information was illegally obtained, US insider laws have no bearing, according to US District Judge Naomi Reice Buchwald, who ordered the SEC to turn over the money. Ironically, had the insider information been obtained legally, the SEC would most likely have been permitted to seize the funds.

Jeremiah Grossman, the CTO of WhiteHat Security, says here that the loophole, if left unclosed, could also aid hacks that technically don't require the bypassing of password requirements or other security measures. He notes that so-called predictable resource location hacks, in which a person guesses the location of a web document before it goes public, have already been used by Estonian stock traders.

Prosecutors with the Justice Department are probably free to file criminal charges against Dorozhko for computer hacking. But given his status as a Ukrainian, it's doubtful they'd succeed. And even if they did, it's even less likely they'd recover the proceeds.

So thanks to the arcana of US securities laws, illegal hacking does pay. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.