Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Software The Almighty Buck The Internet Bug Media Television Entertainment Games

CNBC Software Flaw Worth $1 Million? 151

Strudelkugel writes "BusinessWeek tells the story of one obsessive fan who unraveled a software glitch worth one million dollars. Jim Kraber was a regular CNBC viewer, and when the opportunity arose he took the 'Million Dollar Portfolio Challenge' very seriously. At one point, he was spending 12 hours a day on the contest, using three computers to trade 1,600 different portfolios in a theoretical stock game. His efforts got him into the top 20 finalists, but in the last round of trading he noticed some unusual patterns. 'One trader had a stream of near-perfect picks, consistently placing huge bets on shares that soared in after-hours trading. Kraber suspected the trader and perhaps others were getting help from someone who was changing their picks after the stocks' increases — and he quickly notified CNBC ... Kraber says CNBC rebuffed him at the time, but now it looks like he may have been right.'"
This discussion has been archived. No new comments can be posted.

CNBC Software Flaw Worth $1 Million?

Comments Filter:
  • He didn't go "all in" on Novell stock.
    • by elh_inny ( 557966 ) on Monday June 11, 2007 @03:32AM (#19462953) Homepage Journal
      I find that Marketing departments are completely unfit to provide a secure platform for fun & just competition.
      It usually is a very talented guy, who however has his focus on the looks, not the engine.
      I once, for curiosity's sake took part in one contest. Scoring poorly, I began to analyze the inner workings of that FLash site.
      I have quickly found that the answers to the trivia question were stored in plaintext in my browser cache!
      I notified the organizers, but no actions were taken, I also soon began to notice how people bagan to score more than it was possible according to the game's rules.
      Eventually, they didn't change a thing, except banning people beyond certain score, in the end all my friends got the prizes, CD players, cups etc.
      One year later there was a new contest, almost identical glitches, this time however I decided not to get my friends in trouble, just in case.
      • by MadCow42 ( 243108 ) on Monday June 11, 2007 @05:16AM (#19463253) Homepage
        Behind every Marketing person with an idea, there is a programmer that has to implement it. I don't think you can blame the technical issues you quoted on bad marketing... just poor programming.

        Yes, I'm in Marketing... and yes, I also program (semi-professionally). However, I realize that I am not the person best qualified for doing "mission-critical" projects like that (mission-critical to a Marketing program, in this case).

        MadCow.
        • I assure you that there can be plenty of stupidity in the requirements. If it really is bad, no amount of programming skill will overcome it.
        • Re: (Score:3, Insightful)

          by Duhavid ( 677874 )
          Lemme guess...

          The programmer probably needed about 3 months to put together the project,
          but Marketing had already set the dates, and he/she/it only had about 2 weeks
          to push it out.

          But it's not marketing's fault that they set a deadline without any knowledge,
          it is the programmer's.
        • by WombatDeath ( 681651 ) on Monday June 11, 2007 @10:29AM (#19465133)
          Behind every Marketing person with an idea, there is a programmer that has to implement it.

          Behind every Marketing person with an idea there's a project manager gritting his teeth, pulling on his knuckledusters and preparing equal doses of coffee and sedatives for the programmers. And he's probably speed-reading the old classic: "No, We're Not Going to Rewrite our Corporate Website Entirely in Flash, Because it's a Stupid Fucking Idea and You're Retarded For Suggesting it. Again."
        • by PhxBlue ( 562201 )

          I don't think you can blame the technical issues you quoted on bad marketing... just poor programming.

          A marketer who thinks technical issues are bad programming rather than bad marketing? Color me shocked. :)

          Seriously, you may be right on this one; but I couldn't let such an ironic statement go without some sort of comment.

      • by Fred_A ( 10934 ) <fred@NOspam.fredshome.org> on Monday June 11, 2007 @05:22AM (#19463271) Homepage

        I once, for curiosity's sake took part in one contest. Scoring poorly, I began to analyze the inner workings of that FLash site.
        I have quickly found that the answers to the trivia question were stored in plaintext in my browser cache!
        Did the same once in a game that was supposedly random, based on a Java applet, before Flash was popular. The applet ran a "one armed bandit" thingie. Locally. And then sent the result to the server which tallied points based on that. It was of course trivial to send whatever result you liked to the server in the applet's place since the communication channel was completely unsecured.
        I notified the game organisers but they didn't seem to mind much either. Oddly enough it didn't seem to have been abused at the time (it was a fairly high profile, although local, european site).
        • by mikael ( 484 )
          The same thing happened in a cable TV set-top box game - a cash prize was offered for anyone who could solve a 'nethack' type maze using the least numbers of weapons and moves in the shortest time. Pressing 'cancel' rather than 'yes' or 'no' for the submit score, bumped your score up by at least 200 points. Needless to say, the top two players always had scores this high - trying different moves would only cost +/- 1 point, so there was no other explanation.
        • When a casino doesn't want to make an issue about being cheated, it's because they're cheating so many other people that it doesn't matter (and it would ruin profits by drawing attention).
      • by montyzooooma ( 853414 ) on Monday June 11, 2007 @05:49AM (#19463365)
        Back in the days of Prestel ( http://en.wikipedia.org/wiki/Prestel [wikipedia.org] ) and Micronet I used to play the competitions they had. Prestel used a numbered pages system and competitions on it would charge, say, 20p per question with 10 questions so getting through to the last page with the prize claim would cost two quid or a bit more if you got a question or two wrong. I soon figured out that the prize claim page for this one company's games was almost always the same offset number from the initial question page number. Unfortunately my haul consisted of a lot of disposable cameras, sponges and money clips so the novelty soon wore off.
      • The de facto first programming lesson is creating output: "Hello, World!"

        The second lesson needs to be accepting, cleaning, and validating input: ";drop table;".
      • by Kaenneth ( 82978 )
        I once found an online game that allowed me to bet negative amounts, so I lost a lot.
        Until I bet negative one billion... and crashed it.
  • by Anonymous Coward on Monday June 11, 2007 @03:23AM (#19462939)
    Looks like Kraber wasted a lot of time, effort, and electricity and has nothing to show for it but 'TFA'.
    • by Chris Pimlott ( 16212 ) on Monday June 11, 2007 @03:33AM (#19462961)
      Not true - according to the article, he won $10,000 for winning one of the first round weekly games that got him into the final.
      • Re: (Score:2, Informative)

        The $10K was for making it to the final 20. The weekly prize was a bunch of stocks. So its more then just the $10k.
    • I smell "Obsessive-compulsive" here instead of a software problems.
    • Not really, if you read the article you'll see he won at least 10k during the preliminary contests before going on to the final round.
    • Everybody knows all the variables in poker though. It's hard to get an edge when the only real variable is whether your opponent is bluffing or not. The stock market and horse racing are the only two places I know of where your intelligence and the quality of your information can make a significant difference in your returns.
      • Not quite. Blackjack (21) is the only legal gambling game that retains state... so it is infinately gameable over the course of a large shoe of cards.

        That said - the stock market is the only game that isn't necisarily zero-sum.

      • by AuMatar ( 183847 )
        Well, this post proved you know nothing about poker.

        Lets take a simple game like holdem. There's a lot more to go by than wether you think he's bluffing or not.

        *What cards do you have?
        *What set of cards make sense with your opponents previous betting history and the way he's bet this hand?
        *What outs do you have? What percentage of the time will you hit them?
        *What pot odds are you being given to make the call?
        *What implied odds are you being given?
        *If you hit your outs, how much money can you extract from
  • by Plutonite ( 999141 ) on Monday June 11, 2007 @03:33AM (#19462957)
    Capitalizing on real software glitches is something that happens frequently on more volatile markets like the foreign exchange (fully automated since for retail brokers since 2000). Once the cat gets out of the bag however, the immense loss of the brokers (who usually automatically place orders opposite the sheeple, who are expected to lose on average) causes an alert. Nobody can fool the money markets on things like this for too long.

    On the other side, automated trading means that brokers can engage in dirty practices like sending incorrect data to a particular client connection to trigger a trade (they call this stop hunting). Again, this is found out when clients compare data streams from more than 1 broker.

    Dangerous stuff. If you are good, try to stay invisible.
    • by Plutonite ( 999141 ) on Monday June 11, 2007 @04:35AM (#19463175)
      Those interested in the volatility (and thus profitability of "glitches") of the forex markets should check this excellent article on the structuring of the currency markets.

      http://www.forexfactory.com/showthread.php?t=7484 [forexfactory.com]

      Glitches aside, forex is a great place for smart geeks to make (and lose!) money on the side. All you need now is an internet connection and a mini bank account, whereas 10 years ago this was the exclusive arena of millionaire hedge fund managers. Warning: addiction very probable. Try at your own risk.
      • A while back there was a discussion on stocks and someone pointed out a site where you could open an account, code up rules for stock trades, and then execute those trades based on your algorithm. You could do this either in a sandbox environment with play money, or pony up actual cash and make or lose big. A stock market API of sorts. I've been meaning to find that site again (likely there's a bunch) -- anyone have some URLs for sites like this?
         
        • by Plutonite ( 999141 ) on Monday June 11, 2007 @05:19AM (#19463257)
          All retail brokers for the forex market offer these services now, it's not just one site. Stocks are a different story.

          The most popular client platform is MetaTrader, and every broker has their own customized version which connects to their servers. There is an entire C-based language used to program your experts (they call them expert advisors) and you can indeed open multiple demo accounts at no cost. And the capabilities are so great you can easily download scripts that parse news events released real-time on websites and react accordingly with no input from you.

          Isn't it amazing what Turing machines can do? Word of warning though: you will never get rich on an black-box like an algorithm. Use the technology, but don't get carried away.
          • All retail brokers for the forex market offer these services now, it's not just one site. Stocks are a different story.

            The most popular client platform is MetaTrader...
            Thanks, that might have been the one I was thinking of. And for stocks? What's the different story?
             
            • by Thing 1 ( 178996 )

              And for stocks? What's the different story?

              I've been interested in trying out VectorVest [vectorvest.com] for a few years now. Anyone have any actual experience with it? Their marketing shows great returns, 90% a year.

            • Thanks, that might have been the one I was thinking of. And for stocks? What's the different story?

              Because any prediction algorithm running on publicly-available news will quickly be duplicated by the millions of other algorithm developers out there, cancelling out whatever legitimate edge it might have enjoyed for a few days or weeks.

              • Because any prediction algorithm running on publicly-available news will quickly be duplicated by the millions of other algorithm developers out there, cancelling out whatever legitimate edge it might have enjoyed for a few days or weeks.

                Assuming, of course, that they can reverse engineer the algorithm based solely on the trades. If it's an API where I can simply say "buy this", "sell that" and not have to upload the algorithm then that at least makes it difficult to duplicate.

        • by TopShelf ( 92521 )
          I know TD Ameritrade offers a tool called StrategyDesk which performs such tasks...
        • You might be thinking about Interactive Brokers - http://www.interactivebrokers.com/en/software/high lights/apiHighlights.php?ib_entity=llc [interactivebrokers.com] Every year they hold a university challenge where the winner gets something like $100,000 and a job with them for creating the most successful automated trading application.
        • by RandySC ( 9804 )
          Strategy Builder FX

          http://www.strategybuilderfx.com/ [strategybuilderfx.com]
    • "dirty practices like sending incorrect data to a particular client connection to trigger a trade"

      This *is* interesting. Do you have anymore detailed information as to how this is done. What technology is the data connection run on? How is it possible to fool.
      • It's nothing complicated, no "technology" at all: your client polls for data from the server every second or so, the malicious server knows who you are from your login credentials and sends you a price that is higher/lower than the actual market price on one such second. You have programmed your client to trigger a buy once the price rises to point X (this is a buy stop), so the single quote triggers you off, then the data falls back to the real (low) price and you have lost money. They have won. Evil world
  • Trading is nothing but a gamble most of the time.. He gambled his time and money, and like many lost out completely. And you never know, maybe the 'other trader' found an even more Efficient Market Hypothesis.
    • Re: (Score:1, Interesting)

      by Anonymous Coward

      Trading is nothing but a gamble most of the time.

      Only to those who usually lose at it. Would you go into a business with that attitude? Trading - and business ventures - should be a highly-calculated risk at the very least: Otherwise just throw your money away at the track and be done with it.
      • Re: (Score:3, Insightful)

        by hhcv ( 1094593 )
        The fact is, no matter how calculated a risk is... some people have more information at hand when doing the "calculations." Therein lies the profit making opportunity for the other trader, on the back of this first guy.
        • Re: (Score:3, Insightful)

          by BlueTrin ( 683373 )
          Even though some people have access to rumours earlier and have a better circle of friends, you can get yourself a Bloomberg [bloomberg.com] and Reuters [reuters.com] terminal and here you go you will have the same real-time news than the other traders !

          It often comes down to the fact that some people are better at spotting/evaluating opportunities ...
          • If you're in forex rather than stocks, you can get a very similar and rather high quality service for FREE by checking out www.forexfactory.com, which is very open source oriented (automated trading scripts) and which has a business model based on sane advertising from good brokers.

            They buy the news calender from a premium provider, and it includes expected values and impact, as well as a summary explaining each news item. It's all on the front page, and you can even wget their calender file in xml, or pars
    • by Rakishi ( 759894 )

      Trading is nothing but a gamble most of the time.. He gambled his time and money, and like many lost out completely. And you never know, maybe the 'other trader' found an even more Efficient Market Hypothesis.
      Now replace "trading" with "life" in your statement, amazing how well it fits.
  • by Anonymous Coward
    Looks like whoever created the CNBC datapool was only faking real time stock quotes. Most likely, they didn't build the infrastructure right and so that had to cache the quotes for a little while before they were available on the site. If others had access to the tick streams before the results were available from the cache, then they would have an advantage and essentially be able to rig the game. Seems like CNBC's claims about real time data could be throwing a lot of people off in their investing.
  • The glitch (Score:5, Informative)

    by niceone ( 992278 ) * on Monday June 11, 2007 @03:44AM (#19463007) Journal
    Here's 'the glitch' if you don't want to wade through the article:

    If you made the selection before the close of regular trading at 4 p.m. EST and left your Web browser open, you could execute those trades after hours and still receive the 4 p.m. closing price. ..... The allegation is that certain traders may have used the technique with companies that were reporting earnings and other important news after the market's close. They could select as many as 50 stocks and then execute trades for only the one or two best performers.
    • Its a surprising oversight for such a time sensitive activity and quite easy to stumble upon I would have though. It does point to a lack of end to end testing though or else the testers were just not paying attention as long as a trade was accepted.
  • Gaming the system? (Score:2, Insightful)

    by Anonymous Coward
    Seems Kraber was certainly violating the spirit of the contest, if not the letter. Relying on 1600 portfolios and the law of averages to "win"? Seems like he's pissed that somebody else found a better, easier way to cheat.
    • This was exactly my idea, he's a sour loser who did not cheat good enough. But well, all those cheaters should be disqualified. That software should have extensive logs about when people placed a bet. It is impossible they don't have a log about the exact betting time, even if it is only some firewall log (sure they need some intrusion defense). If they are relying only on the client data, the whole contest is a fake.
    • Seems Kraber was certainly violating the spirit of the contest, if not the letter. Relying on 1600 portfolios and the law of averages to "win"? Seems like he's pissed that somebody else found a better, easier way to cheat.

      Considering that someone could easily have 1600 portfolios and make use of the law of averages in real life (if they've got the cash for it), I wouldn't think of it as cheating.
      • Re: (Score:3, Informative)

        by timeOday ( 582209 )

        Considering that someone could easily have 1600 portfolios and make use of the law of averages in real life (if they've got the cash for it), I wouldn't think of it as cheating.
        Uh, no. In real life you can't just run a bunch of high-risk portfolios and welch on all but the best one; when you lose you have to pay. Kraber's tactic does nothing to increase returns on average.
      • It's a completely different game.

        If you were to do that in the real world, some of your portfolios would make money, and others would lose. The aforementioned law of averages suggests that you'd just about break even, minus the overhead costs and (massive) brokerage fees. Would having one extremely successful portfolio among those 1,600 make you a good investor? I don't think anyone would argue that it would.

        On the other hand, the CNBC game is designed to reward the person who makes the best picks. Th

  • by tygerstripes ( 832644 ) on Monday June 11, 2007 @07:55AM (#19463779)
    Remember playing Monopoly as a kid?

    "Imagine, right... nononono, listen, listen. Just imagine... if all this was real money!!!

    This has the same kind of feel to it.

    And I have to ask, if the guy's prepared to spend 12 hours a day doing this with "Monopoly money", even sacrificing his professional accreditation studies in the belief that he might end up as the best market-player in over 300,000 and win $1m... why the hell isn't he just playing the stock-market??

    • Re: (Score:2, Informative)

      by ZarfMouse ( 154055 )
      According to the artile, the only reason he believed he could win was because the contest allowed him to maintain over a thousand simultaneous portfolios and only the top scoring one mattered. His strategy was to take high risk knowing that most would lose but some would win big time.

      If he was using real money he'd lose out over all but in this contest he's guaranteed to have one great portfolio. He had a very high chance of winning $1m for his efforts if the game had been more secure but only because he un
      • Because he first has to get other people money to trade with. Else he is what is known as a day trader, a mug who bets his own money on the stock market. To see how the stock market is really run, take a look at Liars Poker [amazon.com].

        was Re:Fantasy stock markets.
    • by Raenex ( 947668 )

      why the hell isn't he just playing the stock-market?
      Try RTFA.
  • by IHC Navistar ( 967161 ) on Monday June 11, 2007 @07:56AM (#19463783)
    From: Mark Hoffman, CNBC, Inc.
              Steve Ballmer, CEO Microsoft Corp.
    To: Jim Kraber
    Re: Software Glitch

    Dear Mr. Kraber,

              I regret to inform you that, after a thorough investigation of the alleged trading irregularities by independent Microsoft software engineers, we have determined that the perceived trading irregularities were not the result of a software 'glitch' or 'bug', but were in fact security features.

    We sincerely apologize for any inconvenience this may have caused.

    -Mark Hoffman
      Steve Ballmer
  • by Anonymous Coward
    Wow. I'm surprised this could still happen. Back in the 90s, there was a mutual fund that got ripped off by the same practice. Basically they would let you buy into the fund after the market close, and still get that day's price. Well you can guess what happened. People would watch the stocks that were in the fund and if they went up, they'd buy into the fund at the old price. Of course that ended up costing someone real money since the fund would then have to buy those stocks the next day at the high
    • Wow. I'm surprised this could still happen. Back in the 90s, there was a mutual fund that got ripped off by the same practice. Basically they would let you buy into the fund after the market close, and still get that day's price. Well you can guess what happened. People would watch the stocks that were in the fund and if they went up, they'd buy into the fund at the old price. Of course that ended up costing someone real money since the fund would then have to buy those stocks the next day at the higher price.

      Our company has an employee stock option plan, which allows you to sell your options for the previous day's closing price. So you can pull similar shenanigans, in reverse.

  • by bhmit1 ( 2270 ) on Monday June 11, 2007 @08:17AM (#19463889) Homepage
    This reminds me of an old email/fax scam trick. You start sending 1600 messages to people on a stock that's going to have big news the next day, either very good or very bad, no one knows. To 800 of those people, you say it will be good, and the other 800, you tell them it will be bad. The next day, you take the 800 who you predicted the right answer for, take another stock with big news coming out, and 400 of those people will end up with the right answer. Then 200, and on the 4th day, 100. Now for those 100 remaining people, you send a message saying that you've been giving valuable stock picks for the past 4 days and how much would they be willing to pay for your tips. The moral, everyone is a winner when your losers don't count. If you were hoping to find a good stock trader from this contest, this wasn't the way.

    As for the bigger picture, I'm not a fan of "trading", though it does have it's place. I'd rather use the market for long term "investing" and doing something that provides value to the world with the rest of my time. But just like with power and politics, money corrupts, so we should expect that people will abuse the system and just do our best job ensuring we aren't the ones they are abusing.
    • This reminds me of an old email/fax scam trick. You start sending 1600 messages to people on a stock that's going to have big news the next day, either very good or very bad, no one knows. To 800 of those people, you say it will be good, and the other 800, you tell them it will be bad. The next day, you take the 800 who you predicted the right answer for, take another stock with big news coming out, and 400 of those people will end up with the right answer. Then 200, and on the 4th day, 100. Now for those 1

  • I have collected an assortment of market links re: daytrading, financial information exchange protocols, etc. [heybryan.org]. And if we can find any better links, that would be useful- the stock markets do not need to remain hidden from our eyes.
  • by jollyreaper ( 513215 ) on Monday June 11, 2007 @08:42AM (#19464001)
    42-years old and spending 12 hours a day playing a stock trading game. Wasn't there an MMO he could be applying himself to instead?
    • by shess ( 31691 )
      Great idea! There should be an MMO where you get to spend your day as a virtual trader!
  • Looked like it worked pretty well for the top players. Some of them may have collected 10K for the top slot on a particular week and almost ended up with a cool million. Save for the efforts of a few heads up players they might have gotten away with it.

    It's also worked pretty well for the Republicans.

    That doesn't make it right, but it's hard to argue with success.

  • by Budenny ( 888916 ) on Monday June 11, 2007 @09:32AM (#19464493)
    The Higher Criticism, which started out in Germany in the 19c with the aim of establishing a definitive chronology of Biblical events, laying out exactly what the historical evidence for them was, and to data all the various books, used this as a criterion. Scholars still do.

    The rule is that if some publicly dateable event is clearly forecast in a text, the text was written after it. How long after is a question. Hume made a similar point. Miracles are by definition violations of natural law. To the extent that they are miraculous, it must be more probable that the natural law held and that either experimental conditions were not correctly reported or the story is false. So they end up either not having happened, or not being miracles.

    Funny to see this stuff coming up in exactly the same reasoning about stock market predictions....
  • Where is Intellectual Weapons [slashdot.org] when you need them!
  • So the web programmer read out the current price and stored it in the browser until the user hits 'submit' and then uses the submitted price instead of rereading it?! I wonder if he could have spoofed form variable values and got everything at $0.01? But TFA says the trader would get the stock for whatever it was at closing, so maybe the app isn't re-passing the price. Anyway, if the programmer at least had enough of his head external to his ass to record a time stamp, they should be able to nix any trades
    • by pavera ( 320634 )
      You never picked or specified a price when purchasing stock in this game. You simply placed an order for a number of shares of symbol xyz, and if the order was placed before 4pm, you got the stock at the closing price on that day. If you submitted the form at 4:01pm the order was supposed to get queued up and not processed until closing on the next day (IE you'd get the stock for the next day's closing price). Apparently, through a cookie or something, if you started the order process before 4pm, you cou
  • "Turning the software back on historical records, he found out that Hillary Clinton's astounding record of 49 of 51 profitable IPO offerings were so statistically unlikely as to justify the Wall Street Journal's characterization as 'the likes of which God has never seen' as completely accurate. Did the traders just write down for her the profitable ones at the end of the day, and eat the losing ones themselves?"
  • by ishmalius ( 153450 ) on Monday June 11, 2007 @12:53PM (#19467097)
    Keep all of your decision-making on the server where it belongs. Let the client be a view to the server, and validate input. But don't trust the client with any control of the process. It only results in problems like this.
    • by Achoi77 ( 669484 )
      seriously. Every aspiring game developer thinking about an online gaming model has gone over this a million times. This is like fundamental game cheating tactics 101: there is absolutely no such thing is a trusted client.
  • My roomate found out at a certain sports book online they had a bet on the Kentucky Derby that paid some good odds, like 100-1 if you just clicked on the random selection button, instead of choosing horses. The trick was you just keep clicking it, sure you got some crappy horses, so he would obviously lose $20 on those cards, but just keep clicking it, eventually you would get one of the favorites, and instead of the regular 2-1 odds, you got the 100-1. So that $20 x 100, got him $2000, minus the crappy b
    • Doesn't this tell us that random betting works better than thought-true betting? Reminds me of the chimpansee with pencil and a newspaper way to invest in the stock market working better than professional investors.
      • This tells you that a bug in the software put 100:1 odds on a random selection, regardless of what the real odds were if you selected the exact same card. Nothing more, nothing less.

It is easier to write an incorrect program than understand a correct one.

Working...