Is hacking the future of finance?

Hackers are often portrayed in the press as nefarious cyber-criminals. In reality, such computer "crackers" are just a marginal subsection of a much broader hacker subculture that shuns criminality.

A true hacker is someone who takes mischievous pleasure in exploring complex systems, seeking to understand the interconnected parts. 'Hacking', in turn, is the rebellious but creative attempt to experiment with, and rewire, those parts.

While hacking is associated with tech culture, it can equally be applied to other areas, such as urban exploration, and, I believe, the financial system.

Financial underworld

To many people, the financial industry appears like an opaque black box. We queue at the bank, passively waiting to be served by a faceless corporate structure peddling products that few understand. It bears much resemblance to the way we use the Windows interface of our computer without really knowing what lies beyond the screen. ATMs and bank branches, just like Microsoft Windows, are intermediary facades between us and a deeper economic hardware we seldom see.

This entrenched obscurity of the financial sector is partly what gives it immense political power. People rely on it for everything from basic payments services to insurance, and yet despite its systemic importance to our daily lives, few feel confident in making political demands on the sector. Financial firms employ armies of lobbyists to alter legislation, all the while insisting that people should 'leave finance to the experts'.

Indeed, we are always encouraged to think of finance as technical and inaccessible. If you are asked to imagine the financial system, what are the first images that jump into your head? Many people think of skyscrapers, complex mathematics, and aggressive brokers shouting into phones. The implicit message is this is a place for aggressive, elite whizz-kids, so stay away.

 

Hacking for good

Having worked as a financial broker myself, I have experienced this first hand. The system operates as a technocracy, and when combined with the immense wealth of financial institutions, and the phenomenon of Too-Big-Too-Fail, you have a recipe for the capture of democratic systems.

This brings us back to hackers. As journalist Steven Levy writes, "Hackers believe that essential lessons can be learned about the systems -- about the world -- from taking things apart, seeing how they work, and using this knowledge to create new and more interesting things". The democratic implications of this outlook are vital. Democracies rely on people actively keeping watch on powerful institutions, challenging them, and advancing new versions of them.

So, if you want to become a financial hacker, one has to move past the distracting surface images of finance, and actively pry under the surface.

What's in your pension?

It takes practice though. To take a simple example, let us imagine that you buy a share in the oil giant BP via a brokerage firm on the London Stock Exchange. What exactly have you bought? Search for 'BP share' in Google images and you mostly get pictures of abstract graphs of BPs share price, as if the financial instrument was merely a phantom existing in the world of numbers, spreadsheets and suits.

In reality though, a BP share is not something that can be captured in a spreadsheet. It is a conduit for financial investors to extract oily value from a network of gritty real world assets, owned by 1160 BP-controled companies across the world, from the Pharaonic Petroleum Company in Egypt to Cayman Islands companies holding rights to the Baku-Tbilisi-Ceyhan Pipeline in Azerbaijan. A BP share is a claim on real people exerting exhausting physical labor to extract fossilized zooplankton. This is not maths.

And what about the money in your pension fund? Is it helping to fund investments in companies benefiting from Sudanese atrocities? Is the mortgage you obtained going to be sold to an investment bank and packaged into a securitized mortgage product to be sold to a hedge fund speculator?

Systemic change 

It is only once we explore these dynamics that we can begin to take responsibility for our money, and to design campaigns -- such as MoveYourMoneyUK -- that demand more of the financial sector.

Exploring under the hood of the system is just the first step of financial hacking. Once you understand financial instruments, you can begin to use them for unorthodox ends. Take, for example, shareholder activism, where you use instruments like BP shares to advance causes that are close to your heart. And how about designing a subversive fund like Robin Hood Minor Asset Management?

Key to the hacker ethic though, is a creative do-it-yourself impulse, and this involves building your own alternatives to the financial mainstream. There is an emergent open source finance movement focused on building peer-driven finance, innovative social investments, and even experimenting with money itself, from transnational cryptocurrencies to local community timebanks.

Finance does not have to be a complex world of elites, so start hacking.

Molerat is back and biting government systems

SECURITY FIRM Fireye has warned organisations to be on the lookout for bucksome toothed Molerat attacks, having spotted phishing assaults in Europe.
Molerat made its presence felt earlier, and Fireeye said that it has spotted attacks in the Middle East and United States. It said that traditionally the attacks, which use the off-the-shelf Remote Access Tool (RAT) should not be linked to Chinese threat actors anymore.
"Previous research has linked these campaigns to Molerats," it said, "but with so much public attention focused on [advanced persistent threat] threat actors based in China, it's easy to lose track of targeted attacks carried out by other threat actor groups based elsewhere."
Fireeye said that the tools and tactics have been used to target organisations like the BBC, an unnamed "major US financial institution" and government departments in Israel, Turkey, Slovenia, Macedonia, New Zealand, Latvia, the US and the UK.
These attacks happened over the last five weeks, it added, and used a mix of new and recognisable tactics.
"Previous Molerats campaigns have used several garden-variety, freely available backdoors such as Cybergate and Bifrost, but, most recently, we have observed them making use of the PIVY and Xtreme RATs. Previous campaigns made use of at least one of three observed forged Microsoft certificates, allowing security researchers to accurately tie together separate attacks even if the attacks used different backdoors," it added.
"There also appears to be a habitual use of lures or decoy documents - in either English or Arabic-language - with content focusing on active conflicts in the Middle East. The lures come packaged with malicious files that drop the Molerats' flavor of the week, which happen to all be Xtreme RAT binaries in these most recent campaigns."
The end of May saw a malicious download URL sent to a well-known European government organisation. The shortened link offered "http://lovegame[.]us/ Photos[.]zip", and Fireye said that it was clicked on and downloaded by the victim.
Decoy files in the package give way to the installation of the Xtreme RAT binary into a temporary directory, and according to the security company that same URL has been clicked at least 225 times on a variety of hardware and software since then.
Other similar malicious files have been shared through shortened URLs, it added, and many are hidden within RAR files that are automatically extracted.
The attacks seem rather limited and Fireeye said that off-the-shelf tools are most often used. However, it added that the target network is widening, and the impact of this is "noteworthy".