Free Rogue Code by Mark Russinovich

Stenton held last week’s report from the Chicago office. An IT operations manager there, Vince Piscopia, had forwarded a report to his superior, which then landed on Stenton’s desk. As director of the Trading Platform IT Security for NYSE Euronext, he was in charge of this issue, but so far he wasn’t certain how to respond. The day after receiving it, he’d copied the report to all his senior staff and his key analysts, requesting input.
    What he didn’t tell anyone, what he scarcely allowed himself to think, was that perhaps all these issues were connected.
    What the IT manager in Chicago had reported was a file concealed within the core of their system, software outside the directory listing command. He’d been unable to access the file or determine what it did. What he’d been confident of was that it was not part of the legitimate function of the Exchange.
    The IT manager, Piscopia, had speculated that it might be a bit of legacy code left over from one of the periodic updates of the system. Unnecessary code was left behind from time to time, but never before had it been hidden, and there was no way to know if it was harmless or somehow interfering with operations. In the same report, he stated that he’d also uncovered trades that were not properly registering and speculated that they were related to the code. This raised the same possibility in the mind of the Chicago IT manager as it had in Stenton’s.
    Impossible as he found it to accept, just maybe they’d been hacked.
    Stenton shivered at the thought. He was at the helm. If the Exchange had been hacked and clients were experiencing losses as a consequence, his career was finished. In the worst-case scenario, one that in his fear he deemed possible, he might go to prison.
    This possibility had come to his attention since Jeff Aiken had been hired and started his penetration test. Stenton had considered alerting the consultant but decided instead to see what Aiken and his man came up with on their own. Also, alerting them would leave a record of his suspicions, which so far existed only in his thoughts. It was his hope that Red Zoya not only stumbled onto what Chicago had described but also figured out what it was in the process. That was his safest course of action.
    Just then, a tech poked his head into Stenton’s doorway. “I’m Marc,” he said. “You asked to see me?”
    Stenton recalled that Marc Campos worked on the core trading platform team on one of the trading modules at the heart of the matching engines. There was no more sensitive operation in NYSE Euronext. He was one of the techs who attempted to trace a suspect trade a financial institution had reported to Stenton.
    “Yes, come in. What do you have?”
    Campos was over six feet tall, thirty-three years old, with dark skin and average looks, though his eyes bulged slightly. Originally from Portugal, he’d worked for the NYSE for the past five years, and his performance had been outstanding. He spoke near colloquial English with just the trace of his native accent. He was one of the handful of techs with unfettered access to the core of the Exchange’s trading system. This was the first time Stenton had met with him alone though he’d seen Campos from time to time in staff meetings.
    For several minutes, Campos described the steps he’d taken in tracing a reported $8.7 million loss in a transaction by one of the smaller financial institutions that had lodged a complaint. The referral had come directly to Stenton from a broker he’d known for years, a very reasonable man who was more perplexed than angry at what had taken place. When Campos finished, he smiled and made a dismissive gesture. “I worked on it until the trade just vanished. There was nothing I could do.”
    “Have you seen this before?” Stenton asked.
    “Sure, but not often. Some of these offshore funds like to remain off the radar, you know? They don’t like anyone knowing what they’re doing. They go to great