DEFCON 17: Stealing Profits from Spammers or: How I learned to Stop Worrying and Love the Spam

before I get into the project itself I want to tell you a little bit about Who I am and who Kyle is as well so myself and Kyle vote you may recognize his name he's one of the founders of Justin dot TV that's what he does these days but at the time two years ago we were both students at MIT and clearly we had too much free time on our hands because we kept doing all kinds of bizarre projects one you might have seen online it got written up a few places was our safe cracking device that we built that cracked high-security safes but this is entirely different but a another good question to answer when dealing with something like this is who were we not we are not stock market experts or spammers or get-rich-quick scam people we are none of these things so everything that I say involving the stock market or a spam or anything involving that you know there's really no credentials to back any of that up so don't take any of that as fact okay first off quick spoiler alert everything will be seen through a soda straw there's because all of this was what we were looking at at the time while we were doing this project it was a very limited set of information that we were looking at we didn't have all the information about what botnets were operating what spammers were sending what you know we were literally just looking at the spam that was coming out and extrapolating from that so it's all from our point of view at the time we couldn't see the forces behind anything and everything is guesses and hypotheticals but you'll see that but from that what you're going to see and I'll give it away right now the moral of the story is a lot can be determined without the underlying information it's all about how you look at the information even the information that everyone else all has so how it all started October 2006 that was a time when everyone in the world was getting all of these ridiculous stock spam messages I'm sure everyone here seen it yeah everyone everyone's seen these yeah absolutely everyone was getting me stock spam messages October you know my friend Kyle he saw one of these right it advertised geki gold mark industries fantastic sounding stock and he said the stupidest thing I had ever heard ever he said there must be a way for us to make all these people trying to sell spam stocks I was like no I think it's the exact opposite and I said the obvious answer which is you're an idiot and that you know normally would have been that except for the fact that a lot of these discussions that we had that sound ridiculous at first one of us would go off and actually take a look at these things and kind of do the research and would come back and find out it's not so ridiculous so that's actually what happened and that's why I have a whole talk here so this is why I thought the cow must have been wrong right profit in markets is driven by asymmetric information if there was a perfectly liquid market and everyone knew every piece of possible information about it there would really be nothing to trade on no would be no one would be selling anything for a price that other people would want to buy it at right everything would be just fixed price it's all about that I might know something that you might not or you might know something that I don't everything that everyone already knows is already priced into the value of any given commodity and in this case my problem with it was well everyone gets the spam right what can we possibly know that everyone in the world you know hundreds of millions of people don't already see in their inbox every single morning what is what is the special information that we have that other people don't but first we'll get back to that in a second the real big question a lot of people ask is what are these people actually trying to do with all this spam you know it tells you to buy a stock or something and then I guess they do something I mean the plan is obvious right they phase one send stock spam phase three profit right that's they must be doing that so there's a little more details to it it's what's called a classic pump and dump scheme and these things are you know as old as markets themselves you know we'll go through it step by step so basically let's say that I am the scammer in question and I own 100 shares of worthless ink at $1 a share okay and we're right where the blue line is in time so I own this worthless stuff it's the kind of stock that nobody's buying this means it's garbage right so then I go on message boards and I tell everyone oh my god this stock is gonna go through the roof it's going to be the greatest thing ever you shall buy it and so then being the good people they are they go and they buy the stock and as they buy the stock I'm selling them a little bit so the price of the stock the value is going up going up and up and over time the price goes up is the demand increases and then I go and I sell all my 100 shares or whatever I have left at $2 a share so I just hit SEP 3 profit and I'm gone I have no more exposure to that stock whatsoever and then the next step happens which is that surge in demand that occurred was totally artificial there are no new buyers anymore people that did buy in when I sold them all those shares they now try to sell the shares back because they want to make a profit too but there's no one to sell them to there's there's no more people hearing that it's great there's nobody solitude so the price starts to drop and drop and drop and drop until eventually it ends up that they're getting rid of their shares at a price below what the shares started at back when I bought them when nobody was interested in the company and eventually you know as you see in this diagram and this this graph is an actual stock from 2006 it was a jnn e over the course of one day you see the it starts at market open it ends at market closed and you can see in the end it oscillates and ends up closing close to what it opened that but not a lot and when you look at these things over time eventually they recover to the initial kind of actual market value price but in the meantime I just created this huge fluctuation really from nothing you know just out of my own imagination and telling people that it was cool so when you look at the graph there's the size of my profits there's the size of everyone else's losses it's pretty straightforward that's a pump and dump all it is is its touting a stock it's you know just shouting from the rooftops the stock is awesome and you know making sure that people buy that concept is old you know word of mouth boiler rooms you know the classic people calling up old folks in Florida telling them of an amazing investment opportunity forums are big but spam really opened it up spam provided this huge inexpensive way to send that information to millions and millions of people and you know so as you saw profits are determined by when the tout sells out their mass block of shares the losses for the suckers are determined by how late they bought into the scam and when they try to sell out again you know obviously in that graph the people who bought in when it was near its peak they're screwed I mean there they are dropping all the way down and they're losing you know probably 10 percent 20 percent 50 percent of what they bought in for what kind of stocks are these you know what does this work on well they're what's called penny stocks they're not traded on big exchanges like Nasdaq or the New York Stock Exchange they're traded on little exchanges which are you know we use the term traded very very loosely they're barely traded you know a lot of these stocks you look on a day to day basis and their volume is zero practically they're not on major exchanges they're on things like the they're called over-the-counter they're traded on exchanges like the OTC bebe the OTC bulletin board and a market called Pink Sheets they're thinly traded like I said near zero near zero volume on most days and their high volatility the values these stocks they're generally under like five dollars many are under like one dollar so we're talking maybe like a 20 cent stock right so if that 20 cent stock goes up by 10 cents that's a 50% gain in value right so it's huge the volatility these things just jump all over the place because of that that's what makes these stocks particularly you know particularly possible for you to mess with them you could spam all day about a big New York Stock Exchange spam you know I could tell you all to go by Apple Computer tomorrow and well if the stock exchange or open tomorrow but I could tell you all to go by Apple Computer and all of you could all go by Apple computer and we would all collectively probably have no effect on that stock right because there's such a high volume of trading that already occurs on it so the bigger point here is it's very illegal you know the pump and dump scheme it's illegal the all changes in supply and demand of what's going on in the market it's all artificial it's all made up there's you know no actual information about the company that's changing the SEC frowns upon this so but really the real question is who is dumb enough to buy a stock because someone emailed you telling you to and and this was my problem the very beginning I look to Cal and I was like nobody buys these this is entirely impossible right I delete them you all in this room I'm sure deleted them but uh the problem is apparently somebody didn't delete them because we looked and what we found was a lot of people a lot of people bought these GDK I in that week that we first saw this we looked at it and it spiked 60% in value and the volume was over 600,000 shares so if you do the math for the spammer that was probably a quarter of a million dollar profit you know a quarter of a million dollar profit on like a $1 a share stock and we were kind of impressed by this this was a peculiar the if you look at this graph that I've got here you'll see and I can I'll highlight this for you but you'll see here this day right here this is the 20th of October this is a Friday that's when the spamming started you'll see that the the starting value of that stock the opening value the lo was about a dollar a little over $1 the closing value was like a dollar 30 you know it started to go up and then Monday huge spike in volume huge spike in price and then over the course of the rest of the week it started to just you know go back down over time and that value was lost but the interesting thing here is that the the email started on Friday they started before the market closed on Friday so there was an opportunity to buy shares early and that intrigued us we kind of saw something there so but even looking at that graph right quarter of a million dollars about quarter of a million dollars that's a lot turned out that was actually tiny tiny in these shares same stock couple months later this was a 300% increase over five days 10 million shares so possibly a 30 million dollar profit absolutely immense and these are the sorts of things we were seeing like on a regular basis and we were like wow this is ridiculous you know I don't know who's buying these but they're buying a lot of it so we looked at more of this and actually remember this particular chart later because I'll talk about an SEC investigation that involved this particular week of trading on this particular stock so we had our answer it did actually happen it did actually produce results for the spammers which was incredible so the next part what could we do about it what could we how could we participate I guess in a legal way but wait right so we look at this first week October 20th 27th of 2006 and we say you know not all of them were winners we received spam emails for 20 different stocks that week we followed all of the stocks and three of them produced profits the other 17 produced nearly nothing I mean practically no shares bought or sold in that week so a lot of people spamming a lot of people talking about a lot of stocks but only a couple actually being profitable and those couple that are profitable are suddenly wildly profitable so why is that what are the different characteristics here that allow us to decide which one is successful and which one isn't I don't know that's what we wanted to know so we looked at what we had right what data do we have well we have a lot of spam and that's mostly it we had about a thousand you know stock spam messages every single week and you know then other than that we were just looking at you know the freely available stock market information that was online you know big charts calm or whatever and just looking at what happened so we could look at the results of the previous week and we could in some way compare it to the you know huge mass of spam that we received about all these stocks so that's all we had I mean that's not anything special it's it's the same information that everyone else in the world had so what did other researchers see at this time there are two big papers that you'll find online by two different sets of researchers Freder and Zittrain and Hank and Hauser free transit rain is a big one that everyone mentions it says you know spam works and it's a very good paper you should actually check it out it was based on data from 2004-2005 so it was a little dated by the time that it got released you know at the speed that spam changes but it showed some interesting correlations it basically said that the more spam email that his family was able to put out the more effect it would have on that particular stock so this was pretty straightforward Hank and Houser found very similar correlation the funny thing was though we were watching us in fall 2006 in 2007 and there were a couple articles that came up about that time which said stock spam is dead and they said there was no longer any effect on the market due to stock spam and this really set us to scratching our heads because we were staring at this ourselves and we saw these huge effects and then we looked at the data sets that all of the various researchers were using and what they were doing was they were going through you know these large collections of noted spam email and they were searching for stock symbols they were searching by text right the problem is by fall 2006 any spam filter of any sort was good enough to filter out text right I mean text it's easy you know you look for four three or four letters that are all capitals and something that says bye boom filter it out right by 2006 there were a lot of spammers that were getting huge results in the market the problem was the only ones were get it they were getting any results were all graphical based spam they were all pictures so there were a lot of researchers that were missing huge portions of what was going on in the market at the time and here I explained exactly what I just said quote from free transit trans paper basically saying how they found their data which was they went through and they searched for stock symbols in the text of emails which for the dataset they were looking at 2004 2005 work did totally worked everything was still text back then graphics were just starting to come out in spam so no problem they found that correlation but others who followed their methods started to see nothing happening anymore so that becomes the question right you've got all this graphical spam you know that the graphical spam is what produces results in the market but you also know that as far as sorting it using any automated means the whole point of them doing the graphics the whole point of how they're formatting it is to prevent that it's to prevent spam filters from reading what it is in the message so how do you sort graphical spam anyone anyone by hand that's how you do it so we did we decided you know we play around with couple image recognition type programs a little bit and we decided to do it by hand so we did that's how you do it that's a you can see on the left side that's on my computer that's there's a folder which says week three and there's a whole bunch of folders that have stock symbols and in each folder there's hundreds and hundreds of emails and that's how we did it so we sorted it we followed it for 14 weeks we Kyle and I hand sorted about 50,000 spam emails and resulted in twelve thousand one hundred sixty-eight stock spam emails pretty good so so this allowed us to sort it in real time as we got them so what could we get out of this obviously we already said we know previous results of what happened but there's two things that we can infer from the data as we collected we can figure out the relative botnet power and we can identify the spammers unique signature and here's where the fun starts so let's talk about botnet power okay you sort the messages by the actual stock symbol and then you plot the total emails over time for each symbol pretty simple let's look at a graph so this is what we're looking at right now I understand it's a little hard to read but let me explain the y-axis here on the left side that's the total emails received for a particular stock symbol okay for a particular touted stock so each line each line that I've graphed represents one particular symbol you'll see I've identified GDK I that one that we tracked in the first week the x-axis is time the yellow lines are the divisions between days we start at market closed on Friday and we end at market closed on Friday again the other side so I've got green dotted lines that are vertical that show when the market opens red dotted lines that show when the market closed and you start to see some interesting things so you'll notice that when we already swear to said we already saw from the previous results the GDK I had the biggest impact on the market that week and then we graph it and we see oh they also sent out the most email that week ok interesting makes sense a lot of these other stocks you see at the bottom the little tiny line lines that kind of pop out and disappear and pop out and disappear all week long they got nothing right nobody bought their stocks nobody cared but another relevant fact you see if you look in the sections between market open and market closed a lot of times you see that there's no emails sent out during that time right there you see this is just these beautiful flat spots every time the market is open presumably the guys that are sending emails are probably busy trading at the time they're probably busy selling those stocks that may explain why they're not busy sending out emails at that time so that's interesting right GDK I that's and the real take-home from these you start to look at these a lot and you look at a lot of these graphs and you figure out that the slope of those lines the slope of those lines that's giving you the rate at which they're sending out these spam emails okay what you find is that the rate that you see on any particular spam email stays constant for a particular botnet that's sending spam what does this allow you to do it allows you to identify botnets or spammers whatever you you know one organization sending out email shall we say it allows you to identify them just by the slope of the graph between weeks and that's what we did next let me talk again about next the spammer signature spammer signature is just a fancy way of saying one guy's email kind of looks the same from week to week he's got his own particular style that he does everyone's got their own bag of tricks for evading the spam filters right and those are very kind of closely guarded style kind of secrets right so there's the layout the encoding of the email any type of CAPTCHA type obfuscation you know little squiggly things to make sure that it did a spam filter can't read the text and just generally their style it's kind of hard to quantify but it's really really easy when you're looking at 50,000 spam emails all the time it turns out you just recognize stuff really quickly so let's play the little game right here's an email from someone and it tells me to buy this stock SRL okay and we're in week n of watching these things and it turns out that s RR L ends up doing fantastically that week oh great you know but now the week's over so what does that do for us next week well next week we receive a bunch of spam emails and in weekend +1 which of these emails might be from the same spammer it's pretty obvious you know maybe it would take some work to make an algorithm that instantly identifies this but if you're a human and you're staring at these you see it you see it instantly you see at the very first email you get from this spammer you know who that spammer is and you know what his results were the previous week and the week before that and the week before that you know you become kind of intimately connected with these spammers you've been watching every single email that you get from them and you kind of feel like you know them after a while it's a little scary but um so that's their style right so then we connect the two we connect the style and the botnet power and then we look at the graphs now this is the graph you ready saw of week 1 we have Gd ki and then we look at week 2 okay here's week 2 can you spot the same spammer yeah he's like the exact same line right his his the slope of his line is exactly the same it's unchanged but it's a different stock symbol right it's s BN s ok now let's we go into our spam and we look at what s BN s that email looks like hey it looks exactly like the GD ki email ok great so we know that this is the same guy sending us this email so what does that tell us well we know that the week before he sent out a whole ton of emails and he got a huge result on the market so it doesn't take a rocket scientist at this point to kind of extrapolate and the results that we actually found because we watched this for a number of weeks you know without even considering buying any stock we looked at this and we found that the relative strength of any given botnet stayed relatively constant over time they were trying to send out at the maximum rate that they were able to achieve on their botnet and because of that they achieved a relatively fixed slope each time and then their style of their email was going to stay the same because they wanted to use their same set of tricks to evade the spam filters so another example right this is week 3 now we see srl there he's got the same slope he's the same spammer you go to these busy mail oh yeah he's the exact same guy okay but now we've got two other guys two other two other stocks popped up kind of out of nowhere week three and they've both got pretty good slopes the first one kind of Rises somewhat slowly but the second one is very very specific slope right it's very recognizable it's got a very fixed value the problem is you look at these stocks week three and you look the results on the market and what do you think results they had I mean they were sending out more stocks than the first guy what do you think they had nothing nothing at all like like zero volume right why was that okay well first you've got that srl okay looks like the same one now here's the other two what's the problem there it's text its text everybody filters out text so what do you have here these guys were pushing enormous ly powerful botnet you know the the strongest one we could track on any of our stuff but they were getting no results because they were just sending text and they didn't understand that because we kept seeing them week after week this week week four they start to mix it up we've got our same dependable guy pushing em PRG same results in the market every single week and then we've got these really really steep sloped lines right here as you can see you know blue orange pink blue they're all over the place they've got a huge steep slope they're sending tons and tons of emails really quick as fast as it can and they're getting no results and you know they try some different strategies right one week you see them and this week you see you can count it up right there they sent they touted five different stocks that week five different stocks and they got nothing on all five right they didn't quite understand what was going on but the other guy just touting one doing dependable simple botnet boom he's good once again there's our same guy doing a same dependable thing once again same botnet you can see the dependable guy going on and on and you can see the huge slope guys with their super-powerful botnets just crushing everyone with text-based email that no one is seeing and they got nothing right so these are the sorts of conclusions we're able to reach just from looking at the spam we were getting and and that's it right nothing so that's pretty much that right week five you know same thing the tech space guys getting nothing week six the tech space guys they go all out right they're done with switching stock symbols they're done with everything else man they are going to hit this one like nobody's business and they do you'll see the scale on my graph has changed it's no longer up to 300 it's now up to 900 they're crushing like everyone else in the world with this spam and this week they've still got no return just nothing the other guy still the same results now two interesting thing hat things happened in week six and this is where things actually got interesting for us because we had been watching the five previous weeks we had been seeing is ridiculously dependable returns and we had been able to predict them every single time right so we were like oh man let's let's get in this market as quick as possible this is awesome and then week six comes along and and week six that curve on W exe he sent out the same dependable amount of emails he they seemed to be the exact same thing going on and the results in the market were like nothing they were like nothing at all he was very weird and and the problem is we saw how much this guy bought into it it was about a two million dollar buy-in right because whenever we received these emails we would look at the stock and you would look at the few days before you received any emails about the stock and you could see and you could roughly approximate how much money that spammer had put into the stock to kind of buy in before trying to sell it off we estimated it was about two million dollars the problem is they weren't able to let go of like any of it I think I mean they let go of some of it right but it was at practically nothing so we estimated they lost about 1.2 million dollars that week and and then week seven they disappeared they were gone just gone we got like maybe one or two emails from that botnet the whole week and that was it poof you know you'll see on the scale of the graph nobody's going up to 300 anymore nobody's doing anything it's just the kind of little little spammers that weren't really producing any results right now and the one guy that was producing results he's gone and just disappeared so um as conflicted as we were about it we were a little sad actually it was kind of weird I'd never like felt sad about a spammer not sending spam but it turned out that was the case then weeks week seven week eight he was gone week nine he was just gone forever I think around week ten I saw some emails from that same botnet that was you know he had moved on to pushing some sweepstakes scam or something you know I guess greener pastures but um but in the meantime the text-based people that were just crushing the world with their text-based spam that nobody saw they kept spamming like crazy and they kept going and going and hyping emails week after week you know but in general you know here's them again pushing out nine hundred you know from our perspective nine hundred emails in a week everyone else is like below 100 they're nine times the power of everyone else and they're getting no results so then the next week I think they split it up again they you know the usual they flip between hyping one stock hyping five stocks week twelve once again just noting the whole market kind of fell out of the spam business in about January 2007 and we didn't really know why from our perspective and once again we were a little sad week thirteen the text-based people kind of lost their minds they spam fifteen different stocks that week just I mean I don't have the graph of that one because we kind of stopped graphing stuff at that point we gave up but I mean you're just talking about fifteen little spikes boom boom boom boom boom the whole week long and obviously no results they just think I don't know what happened but they couldn't seem to understand why they weren't producing results but we could because we saw everything right so what right what did all this analysis get well what it gave us was that it meant that when we saw a spam email hyping a stock we could predict the results in the future we knew what was going to happen so instead of waiting to see all the various researchers that you would have seen that we're talking about stock spam in 2006-2007 they were all talking after the fact you know it was all hindsight it was all this game of like well these results happened and these were this you know the emails that they sent out so oh great this is what happened none of them were predicting anything but what we were doing was predicting it every single week so any given week we would see one email come out we would see the very first email for a stock symbol and we would know what the result of that would be in the week so we could be basically the first ones to buy it so where does that put us we buy the stock there like right after the spammer bought his you know depending on the spammer but and then you know we could kind of just ride the whole game exactly like he would and you know just kind of take a piece of the pie of the touting that he had done without you know dirtying our hands in the world of illicit spam and whatnot that's what we did right the overall method that we did we sorted each week's worth of spam by ticker symbol we identified the spammer by the email style we matched them to their past results we identified the top spammer of that week and then when the first email from that top strem arrived for the next week spam we would buy that stock and then sell it eventually and you know step three profit etc so did it work yes and no no it didn't the method worked for a few weeks like I said we were watching it it was amazing we all had incredible dreams of millions of dollars and Lamborghinis and whatnot but then you know that week six seven the whole thing fell apart all these spammers just stopped getting results nothing was happening and you know that's it those guys whoever they were lost two million dollars or something and then disappeared never to be seen in that kind of game again and there was some speculation I read a Google article at the time that they were saying that the entire quantity of spam at that time had taken some huge hit nobody was quite sure whether it was some mix of you know botnet takedowns ISP shutdowns or software patches of various sorts but whatever the case the whole spam world was kind of took a hit at that time and so the stock spam people stopped making money also there was a major SEC crackdown at that time which they called cleverly operation Spamalot operations Spamalot in March of 2007 they started out by suspending trading on 35 of these penny stocks almost all 35 of which we had looked at and we had seen because you know these were the stocks happening to guys in Texas they were indicted for securities fraud they eventually reached a three point five million dollar settlement it was estimated that they had made a total of 4.6 million in profits but you know I mean all these are so speculative and even from the SEC standpoint it was hard for them to actually determine which stocks those people had been involved with you know they they nailed them on I think like 13 different stocks but uh you know who knows who knows what they were actually doing and as it says here the operation was actually started because an SEC attorney was getting that spam you know so that's the one thing you want to not do if you're a spammer I suppose um so the big question here you know maybe it didn't quite work out for us then but could it work again right I mean in theory if the botnets had still been able to push out there same level of spam and enough suckers had still been buying stock spam stocks for some reason our method we've continued to work so could it happen again could this whole thing come back maybe I don't know right so I went ahead and I looked before this talk you know back in April 2009 just a little while ago I sorted through all my spam once again I sorted through you know maybe 1000 2000 3000 spam emails and I sorted them by what type of spam they were and there was not a single stock spam I was actually a little hurt but we have drug scams watches diplomas sex books jobs and gambling but no stocks no stocks so clearly at least from what I can see of the spam and really what I can you know some people have asked me you know well you can't you can't really say that there's no stock spam happening there's no touting of these stocks well yeah that's true but if I can't see it happening then you all can't see it happening and you know Joe Schmoe out who wants to buy these stocks he can't see it happening and in that case it's not working so you know clearly whether or not there might be a couple of these guys trying to do it it's not working it's gone so will it happen again maybe how to know spammers have given up on stock manipulation for now if it starts again our method will probably work again or will it the question here now is you all know about this ok let's let's play this game so you know how to do this if you all go out and do this if spammers start settings again and and that they now have a pool of people who understand what's going on and who will clearly buy into this that'll produce increased liquidity which will probably increase the spammers initial profit but the other problem will be the stocks will they'll tank faster right because all of you you know that you need to get out as soon as possible and you know that you need to get out before the spammers and you know that you need to get out before other people like you so you're all going to buy in and get out really really fast so that timeframe on that little blip of what happens to the stock it starts getting shorter and shorter and shorter until eventually there's a tiny little blip and maybe it just crashes like crazy at that point and there's literally nobody buying it because the only suckers are you right there's nobody else buying the stock so it's kind of an artificial demand created by my talk hmm ok ok so we start there maybe it'll still work or maybe maybe I've created a new meta strategy to act on the fact that you know that I know that you know about this ok ok maybe maybe only time will tell so now I'm open for questions any questions sorry go ahead good question he was asking whether we checked the other markets European Asian etc no we didn't at the time we didn't look at any of those the biggest question there for us was that we considered these these issues but uh we didn't see that stock spam right and we don't read you know Korean or whatever so even if we were seeing them we don't know what that means but for instance I know you know I've got in my notes there was a German group that was doing this on the Frankfurt Stock Exchange in like late 2007 they had actually evolved from graphical based emails to PDF based emails that was their new way to get around it and they had big success they were also caught and prosecuted and all that good stuff but it does evolve and it does move to other markets I have no doubt that the Asian markets could see this I don't know if they've seen it yet so far next question right here right right um she's asking you know do we know anything about why it crashed there in week seven why those guys lost a ton of money we did the spam filters magically catch all their graphics I have no idea I I knew better like I said you know the scope of what we did is fairly limited to the view that we had at the time I've looked since then and I've tried to look back and find the various articles and SEC investigations to piece together which exact groups and the names of the people that were doing the various different botnets and stuff and you can find a couple but the coverage of you know penny stock fraud is is pretty limited as you might imagine next question right there right okay I'll answer that question real first real quick first he said what gave us the confidence to attempt to get a piece of this without thinking that maybe the essence SEC might investigate us to thinking that we were a part of it and yeah we we didn't know anything that's I mean yeah that could have probably happened I don't know the the biggest reason there that I think we yeah well the biggest reason was because the quantity of shares we would have been moving was miniscule compared to these large buyers right that was the biggest thing so they probably wouldn't care about us you know for college students it would have been like a ton of money but for these guys not much uh he asked did we think of writing the curve the other way and shorting it at the high the thing is these are thinly traded stocks so shorting doesn't really exist in that sense shorting does exist but it's we can't do it basically next person you're right there ah good that's a fantastic question the question was why did they do we know why they picked particular stocks there's a lot of possibilities and I've read about a number of possibilities in some cases they were inside jobs right the spammer basically offered to the company to take a portion of their stock at a low rate and hype it up and make profit for themselves in the company that happened there were other companies that just had no idea this was happening you know just one day they woke up and their stock was flying all over the place and they had no idea what was going on I think all types of this thing occurred actually one interesting thing when I talked to earlier about how we could look at a stock and look at the previous few days or the previous week or so before they had spammed about it and determine their size of their buy in sometimes you would look at a stock and you would see no Buy in hmm right what does that mean inside job right so you could see both types and to some extent you could guess at which type it was from looking at the previous week leading up to the span next question in the back right right uh so he's asking about what scale would we have to trade at from our little you know college students I'd to make up for the transaction costs of trading these shares because he's astutely pointing out that when you trade in these thinly traded stocks most brokers they're going to charge you some kind of larger fee than normal we found it wasn't a problem the even even buying a few thousand shares it totally made up for it because you know normally you have that problem with trading these short sorts of shares because trading these sorts of chair of shares in a legitimate context you would expect the changes in price to be like what like five percent you know something like that so you start getting close to your margin there but in this case we were looking at changes like 50% or doubling our money or tripling our money right in which case the you know 5% premium and they might charge on those shares didn't matter anymore yes uh yeah he's asking about did we look at more of the content of the emails for instance the content that these spammers were claiming you look at these emails and they say things like target prices and target you know date selective goggles cool insider information really we found that for the most part when we looked a little bit at it but it it was all noise to the best of our to the best of our judgment you know the target prices they did they were just arbitrary I mean you know even the example you can see right here on the screen the right side W exe that was that week where those guys were the target dates yeah the target dates didn't mean anything either the only thing that correlated with anything was the volume that they were able to send out you know because to the to the targeted user group right you expect that their view of it is not about what those what the date range is excuse me they just want to get into it as soon as possible right so everybody rushed in as soon as they decided that we didn't see any any correlation to these various things you know because it's not acting on real information right there is no press release coming out there's no product uh yeah from what we saw I don't think the duration of their spamming campaign ever actually correlated to what was going on sometimes you would see especially earlier on in 2006 you would see the spamming campaigns kind of the trading would last more than one day later on as you approach December 2006 January 2007 the trading was all done within one day if the the demand just couldn't put up with five days of trading next question right there right yeah okay so he's actually asking about repeat hits that would be a stock that's touted one week it does that full up-and-down like you saw and then it's touted again like the next week or a few weeks down the road yeah and we did see that we did see that with a number of stocks pretty well across the board the second third you know and number times they would do it each successive try would have worse results one thing that was kind of interesting though that you would start to see is some of these stocks like GD ki li TL a couple of these other things you would see it spammed about one week and not that it was spammed the previous week or the week before but if you looked some of these were hit like the year before or they were hit like you know eight months before a year and a half before some of these stocks were getting pounded like on a regular basis and how to know whether they were inside jobs or whether they were just really unlucky but uh some of these were really really getting thrown around all the time yeah yeah so he's asking about basically data analysis of all of the OTC or Pink Sheets stocks in order to see these things without even looking at the spam just seeing that one is starting to spike or that there's an abnormally large volume of by on a particular stock and then assuming that that will become you know a spam stock and you're right that's doable and you can do the data mining to try to look at the whole market to find these hits you do run into problems though because like I mentioned not all of the buy-ins from these people were successful so you might see an enormous volume buy-in and then you join into and nothing happens right maybe maybe they didn't even get any emails out that week and we actually we did a little bit of looking at this market where we looked at some stocks and we tried to we basically did exactly that we would look at the volumes and we saw some where it looked like there were buy ins and then we never saw a single email about that stock so it was kind of weird there were also some of the stocks I mean we you know once again soda straw of you we weren't seeing all the stocks that were touted some of the other websites around that we're kind of tracking this thing and you know building little fake portfolios around them they occasionally popped up with stock symbols that we didn't even see I mean we didn't even see a single email about them so we were still our very limited view so who knows yeah good question okay there's two questions there in that limited view where did our samples that come from it came from my email address at MIT that's where it came from myself and kyle's actually at that time we were getting tons and tons of tons of spam email part of the reason for that and I'll kind of let everyone know this now mit has a lot of mailing lists that the place runs on mailing lists so the spammers would get the the emails of these mailing lists and then so you would get multiple copies of emails you'd get it through all sorts of different sources how representative was our sample I don't know it's really tough for me to say it seemed representative enough to the sense that I mean we saw this happening but like I said there were certainly things that we were missing definitely all the way in the back there uh-huh true yeah yeah sure yeah so he's asking if we considered other factors such as you know hacked accounts and and things like that buying some of these and and moving up values like that yeah maybe uh if you if you look up this stuff there are examples of those sorts of things happening ours was mostly focused on the spam effect specifically because that was what we saw the most of you know all the time in our inbox but the other stuff did happen there were a number of you know there was some Russian organized crime group that had a botnet that was you know stealing passwords to whatever trading accounts and and buying up stocks through those zombie accounts and you know that all this stuff was happening but I think the biggest effect was just from spam and normal actual people buying it uh yes done I'm sorry can you repeat that of what gray listing yeah yeah um that's actually a good question um so gray listing right and I assume what you mean by that is when it gets like reported through to these various brokers and it says like hey stop having people trade these stocks right and that happened in fact that happened almost every time every time that we went to go buy a stock I had to call up um you know whatever online broker I was using and tell them over the phone to let me trade that stock because they wouldn't even let me trade it through my web interface it would say it was locked and that was like a you know an off limits talk that they didn't want to sell me any of so yeah but despite that fact despite the fact that I had to like jump through extra hoops to even touch any of these stocks a lot of people still bought them so that didn't really seem to have an effect and when we talk about things like operations Spamalot there were the SEC locked down thirty five of these stocks they lock those down in March of a seven right the spam on these stocks had stopped in January of oh seven they're locked down of these they're they're ceasing of trading and these had no effect on anything so you know take that for what it's worth I could take one more question right there great question everyone's covering every little extra thing that I wanted to cover which is great he asked did we look at other methods of hyping these stocks like forums and whatnot and yeah we did we actually saw forums people discussing these in forums as we were doing this in fact let me I got one right here there it is so yeah that's that's actually a forum in October to December of 2006 talking about exactly the stock we were looking at GDK I and that's people talking about you know this seems kind of too good to be true and other people you know there's one that's like what is it like need a nice clothes today you know like okay so yeah people were talking about these in a couple of those posts it was clear that these people were you know they were kind of pushing them themselves so that effect was there too but I think the massive amount of spam was the bigger driver of everything so with that that's all thank you you

Channel: Christiaan008

Views: 981,282

Keywords: spam, stock, emails

Id: ytDamqTjPwg

Length: 49min 42sec (2982 seconds)

Published: Fri Jan 14 2011

Reddit Comments

[u/so_crat_ic]

I like DEFCON

[u/[deleted]]

Saw this a couple of years ago, awesome idea. Probably the only guys who made profits from penny stocks.

I also still can't believe that people would actually buy stocks based on some random spam email, but hey