1. Stealing Profits from Stock Market Spammers How I learned to Stop Worrying and Love the Spam DEFCON 17 ( 2009 ) Grant Jordan, Massachusetts Institute of Technology, MA Kyle Vogt, Massachusetts Institute of Technology, MA

2. Agenda 2  About this research…  Assumption  Some essentials  What we did?  Conclusion

3. About this research… 3  It’s all from researchers’ point  Differ from any other research that based on spam text analysis  How they come up with this?

4. About this research… (cont.) 4  It’s all from researchers’ point  Differ from any other research that based on spam text analysis  How they come up with this? Fig. 1: The epochal stock spam

5. Assumption 5

6. Assumption (cont.) 6  Lots of guesses

7. Assumption (cont.) 7  Lots of guesses  Lots of hypotheses

8. Assumption (cont.) 8  Lots of guesses  Lots of hypotheses  But of course, some economic theory

9. Some essentials 9 Fig. 2: The supply and demand curve

10. Some essentials (cont.) 10  But everyone get the spam  What is this spam trying to do? Send spam ??? Get profits Fig. 2: The supply and demand curve

11. Some essentials (cont.) 11 Fig. 3: How spammer get profits step 1

12. Some essentials (cont.) 12 Fig. 4: How spammer get profits step 2

13. Some essentials (cont.) 13 Fig. 5: How spammer get profits step 3

14. Some essentials (cont.) 14 Fig. 6: How spammer get profits step 4

15. Some essentials (cont.) 15 Fig. 7: How spammer get profits step 5

16. Some essentials (cont.) 16 Fig. 8: How spammer get profits step 6

17. Some essentials (cont.) 17 Fig. 9: How spammer get profits step 7

18. Some essentials (cont.) 18  What kind of stocks are these? Penny stocks Over The Counter (OTC) ▪ Not traded on a major exchange ▪ Thinly Traded: Near zero volume most days ▪ High Volatility: Since price is so low (often $1/share), even small changes in price can produce huge % change

19. Some essentials (cont.) 19  However, who is dumb enough to trust those spam?

20. Some essentials (cont.) 20  However, who is dumb enough to trust those spam? There are many idiots indeed… Fig. 10: Evidence of such spam work 1Fig. 11: Evidence of such spam work 2

21. What we did? 21  Numerous researchers claimed that by Fall 2006, stock spam was dead  But they are wrong!

22. What we did? (cont.) 22  Numerous researchers claimed that by Fall 2006, stock spam was dead  But they are wrong! Because all previous works are based on text- analysis About 2006, almost 100% of stock spam are graphs  So? How could we analyze those graphs?

23. What we did? (cont.) 23 Fig. 12: It's easy to sort them by hands

24. What we did? (cont.) 24  When you’re looking at every email with your own eyes, it’s easy…  Our data 14 weeks More than 50,000 spam emails 12,168 stock spam  Information extracted from them Previous results Relative botnet power Identify spammer’s unique signature

25. What we did? (cont.) 25 Fig. 14: Spam size of SRRLFig. 13: Stock spam of SRRL

26. What we did? (cont.) 26 Fig. 16: Spam size of MRPGFig. 15: Stock spam of MRPG

27. What we did? (cont.) 27  Jordan-Vogt method Sort week’s worth of spam by ticker symbol Identify spammer by email style Compare each spammer’s past results Identify top spammer When first email from top spammer arrives… buy the stock Sell out  To sum up, choose the successful spammer; when the best spammer sends out his first email about a stock, we know to buy

28. What we did? (cont.) 28 Fig. 17: Buy it when got first spam from the best spammer

29. Conclusion 29  Did it work? Yes  Method worked for a few weeks

30. Conclusion (cont.) 30  Did it work? Yes, and No!  Method worked for a few weeks, but… The best spammer had a bad week (lost ~$2M) then disappeared Major botnet takedowns (?) Major SEC crackdown (“Operation Spamalot”) ▪ Suspended trading on 35 stocks ▪ Indicted two men in Texas for securities fraud. Eventual $3.8M settlement ▪ Because an SEC attorney was getting the spam

31. Conclusion (cont.) 31  Could it work again? Maybe Spam goes in cycles… botnet come and go… Fig. 18: Recent spam in April 2009