News for hackers. Stuff that matters.
Re:Robinhood Traders Discovered a Glitch That Gave Them ‘Inf... by tptacek on Tuesday November 05, 2019 @05:14PM (#21457342)
It doesn't seem, from the descriptions, to be possible to exploit this bug without knowing that you're doing it. It's not like they simply don't enforce margin limits; in fact, it looks like you have to apply the bug iteratively to do anything interesting with it. That being the case, it doesn't appear to me like the people exploiting it will have any way of talking their way out of the intentionality of their actions, at least not to a "reasonable person" standard that would be applied in civil court. It looks like cut-and-dried fraud. Am I wrong about that?
Re:Robinhood Traders Discovered a Glitch That Gave Them ‘Inf... by pnako on Tuesday November 05, 2019 @05:26PM (#21457437)
Oh, in that case it's definitely fraud because, as you pointed out, it's clearly intentional (you have to repeat the trick many times).

But the $8 billion question is: are we talking about an obscure bug, a missed case in an otherwise perfectly sound valuation and risk management model, or is it actually a case of dodgy valuation and risk modelling? Which implies that many well-meaning clients are also seeing the wrong portfolio value, and trading with invalid margins?

Again, I don't have the details so I don't want to speculate too much, but apparently they've had similar "bugs", so it's possible that their entire valuation and risk model is dodgy. It has happened to more reputable organizations.

Re:Robinhood Traders Discovered a Glitch That Gave Them ‘Inf... by lallysingh on Tuesday November 05, 2019 @09:06PM (#21459034)
Bugs in the software come from bugs in the process. They are showing their process in their inaction.

If their stuff was generally sound except for this, they would have shut down margin trading until the bug is fixed.

Re:Robinhood Traders Discovered a Glitch That Gave Them ‘Inf... by tptacek on Tuesday November 05, 2019 @09:53PM (#21459315)
It's hard to think of a bug or vulnerability that you couldn't compose an argument like this for. Does it matter? They left the back door unlocked; you'd still get in trouble for letting yourself inside.
Re:Robinhood Traders Discovered a Glitch That Gave Them ‘Inf... by lallysingh on Wednesday November 06, 2019 @08:50AM (#21462517)
They clearly don't take the issue very seriously, as they allow margin trading to continue. That is not normal. They're exposing customers to more risk than they should be, and that's a very serious no-no.

I don't think small bugs in high quality shops would fall under this argument.

Re:Robinhood Traders Discovered a Glitch That Gave Them ‘Inf... by tptacek on Wednesday November 06, 2019 @09:45AM (#21463041)
What's a "small bug"? What's a "high quality shop"? I've spent years doing software security assessments for much larger financial service firms than Robin Hood, and found far worse things than this.
Re:Robinhood Traders Discovered a Glitch That Gave Them ‘Inf... by lallysingh on Thursday November 07, 2019 @12:19PM (#21475085)
The broker/dealer I work for stops trading on bugs causing much smaller (even $0) material impact.

For brokers in particular, they are highly regulated and I can't imagine them not ending up with a nasty investigation+large fine from regulators over this.