Hacker News Reader

I heard that story from a quant friend. However, the way I heard the story, the targeted firm found out about their rival's attempt to game their strategy, and faked a bunch of activity. The rival's algorithm acted on the activity and placed a large market order...in the wrong direction.

This is called spoofing and is illegal.

From a place of total ignorance, why would telegraphing a particular false strategy to your competitor in order to get them to respond in a way that is profitable to you be illegal?

Also, how would you ever prove it?

Because you’re not just telegraphing it to your competitor, you’re moving the entire market and affecting the bid/ask and price transparency for all its participants. That affects liquidity, derivatives, a lot of downstream negatives.

That said, there are narrow instances where you can place less-than-real orders in a market [0]... it just has to be a market that is nearly and completely illiquid.

[0] https://www.bloomberg.com/opinion/articles/2018-12-04/trying...

No it isn't, spoofing is feigning trading behaviour.

Providing data that another company illegitimately bases their trades on isn't trading.

Yes it is. Placing orders you don't intend to be executed is spoofing. From the OP: "faked a bunch of activity"

I assume they mean phone network activity, not market trading activity.

Sorry, should have been more specific. As I understand it, no trades were made--they just spoofed whatever activity their competitor was looking at, so it wasn't illegal (but then again, I was hearing the story second-hand).

Can someone dumb this down a bit and explain? Why would you want to generate the random seed using your company name?

https://news.ycombinator.com/item?id=19515490

I'm assuming that they used the company name for their RNG seed out of laziness or ignorance...very few people would expect that line of attack.

Sounds smart, but also sounds quite like an urban legend.

>taking a number from the firm's name

I'm lost as to what is meant here by "number". Are you saying the target firm was randomizing its iceberg order's component order sizes using the same seed? If yes, how could the target firm's usage of that seed be known by the "attacker" here?

The target firm had a number in their name, kinda like a16z or Office365. The attacking quant knew the target was using iceberg orders which split up and randomize parts of large orders. Attacking quant took a guess at an RNG seed by guessing they used the number in the target firm's name, and then somehow fit the resulting random number stream to order chunk sizes, and was able to confirm they used that number as a seed. From then on, using that information, they would identify (I'm assuming probabilitistically) when the target firm was executing a large iceberg order, and then front run the remainder of their order.

It sounds ridiculous on its face, but the industry is known for going to extremes, and that sort of problem solving isn't unheard of in other domains (like cryptography for example). I'm way out of my depth with understanding it, and it could be complete bullshit, but it isn't outside the realm of what I've seen proven in the past, which is why I'm hoping someone someday will confirm it.

That... sounds amateurish. Everyone just uses a hardware RNG for random number seeds.

It would be amateurish if it were cryptography for sure. But I would never expect that sort of attack vector as a quant. Most quants are worried about alpha loss, not having your order flow fingerprinted.

Well it's nice for testing to have something repeatable. But still sounds like an urban legend.

Nowadays yes but I suspect this story is from decades ago, before hardware RNGs and good cryptographically secure algorithms were commonplace.

It's just like how HFTs can make massive amounts of money just by making transactions milliseconds faster than the people next door.

Stuff is insane