7 ms·

I'm curious what charges are being brought against him. For all we know, this detention is completely unrelated to WannaCry. We shall see.

christina_b 9y ago
I may be totally off base here but IIRC, before he ran MalwareTech and was a whitehat, he participated (and was an op) in fairly "shady" IRC channels, with his oldest nick I can recall being `Ntoskrnl`, dedicated to malware and malware development which even had a person (Edit3: As pointed out in this thread, that person was `BetaMonkey/TouchMe`) who was selling a variant of a botnet drone client builder. Edit2: From one of the comments below in this thread, the network on which he was present (and was an IRC operator of) was `irc.voidptr.cz` or a variation of that, I could not recall the name of the network at first but when someone mentioned it, I instantly recognized it. If he's who I think he is, I doubt his early background is that clean, despite him being a whitehat now. It is very much possible he is being held because of something related to that and not because of anything related to WannaCry. This was all before he even started running the MalwareTech blog, it's very much possible the FBI decided to look into his background or were already familiar with it prior to him arriving in or leaving the US. That being said, it's possible that I'm mistaking him for someone else in which case I do apologize. I edited the post a bit, to clarify, the first paragraph to the best of my knowledge is certainly true, second one is based on my own speculation so take it with a grain of salt.
- sbarre 9y ago
  Instead of apologizing for potentially spreading FUD and falsehoods, maybe you should refrain from posting until you have actual facts in hand?
  - plopz 9y ago
    Like the article itself?
  - strictnein 9y ago
    > maybe you should refrain from posting until you have actual facts in hand? Yeah, like the rest of the people commenting here, right? They have all the facts.
  - webkike 9y ago
    The grandparent is making a good point. It is entirely possible that the researcher is being prosecuted for something related to his past. It's not likely that he's being prosecuted for smuggling a small amount of drugs (for example), the FBI wouldn't be the one making the arrest. Even if all the activities he has done in the past are completely legal the FBI could still try to wring him for them.
  - hota_mazi 9y ago
    There's an equal number of FUD and speculation going the other way, e.g. that he was arrested for no reason or that he was "disappeared".
  - bdcravens 9y ago
    Kind of like the assumptions as to why he was arrested?
- ryanlol 9y ago
  I can confirm that christina_b is correct and sbarre can rest easy knowing that nobody is being defamed.
- GlobalServices 9y ago
  This is exactly right.
goatsi 9y ago
He ran a carding forum in the past, malkit.ws and then malkit.su. Virustotal passive DNS shows that it was hosted for a time on the same server as his old irc, irc.voidptr.cz https://www.virustotal.com/en/ip-address/188.190.99.148/information/ https://www.virustotal.com/en/ip-address/188.190.99.148/info...
- ryanlol 9y ago
  Was it him or BetaMonkey running this? If I recall correctly BM owned voidptr but both had admin access there? EDIT: Ah, found some old logs on google: http://www.exposedbotnets.com/2013/05/hf-elite-coding-team.html http://www.exposedbotnets.com/2013/05/hf-elite-coding-team.h... [08:08] <TouchMe> if i still owned this irc [08:09] <TouchMe> i would shut it down and start over
  - christina_b 9y ago
    BetaMonkey/TouchMe was in fact the person I was referring to who was providing support for his botnet drone builder until he dissapeared with no trace at a later date. Just could not recall the nick at the time of making my original post.
    - ryanlol 9y ago
      I always assumed the two to be different people. The log shows the two of them talking at the same time, and I remember the two of them having very different attitudes in general. I know TouchMe is malwaretech but would be inclined to assume that BetaMonkey isn't. TouchMe was still a malware developer though, and apparently used to run voidptr before handing it over to BetaMonkey.
      - christina_b 9y ago
        I was pretty sure TouchMe was BetaMonkey's new nick, I don't think it was Ntoskrnl (MalwareTech). From what I've heard TouchMe continued support of his drone's users until he dissapeared without a trace. This was so long ago and my memory isn't amazing.
gist 9y ago
> For all we know, this detention is completely unrelated to WannaCry. No everyone has already determined 'wow he did a good deed' and 'us law enforcement bad'. The fact is he is linked to this event and a person of interest who they want to get more info from. As such it makes total sense they would detain him for some questioning searches and so on. If you are someone who stops a crime you will also get questioned by the police. For all they know you are covering your own tracks and had a role in the crime. This is almost a cliche in movies and tv.
- bitJericho 9y ago
  Everyone's determined 'us law enforcement bad' because it doesn't matter what crime he may or may not have committed. He was arrested in the US, which means he may be tortured or murdered, and if he's sentenced he almost certainly will be tortured through means such as prisoner assaults, permanent solitary confinement or abuse, or god knows what else. And heaven forbid he's sent to a military prison. He will never come out again.
  - true_religion 9y ago
    If you believe the USA is so terrible then push for sanctions against them. Its better than wringing your hands anytime one of our longtime allies decides to arrest a alleged criminal.
- unityByFreedom 9y ago
  > If you are someone who stops a crime you will also get questioned by the police. For all they know you are covering your own tracks and had a role in the crime. This is almost a cliche in movies and tv. Yup. Law enforcement is not obliged to assume his innocence.
- GlobalServices 9y ago
  Exactly. Question to all those who think the USA is so bad...why don't you leave?
- chmike 9y ago
  I understand your point of view, but I don't share it. First, asking questions doesn't require to detain people. Second, that person is not an American citizen. Unless he committed crimes on the American soil, which might be the case, handling foreign visitors like that is puzzling to say the least.

christina_b 9y ago

I may be totally off base here but IIRC, before he ran MalwareTech and was a whitehat, he participated (and was an op) in fairly "shady" IRC channels, with his oldest nick I can recall being `Ntoskrnl`, dedicated to malware and malware development which even had a person (Edit3: As pointed out in this thread, that person was `BetaMonkey/TouchMe`) who was selling a variant of a botnet drone client builder. Edit2: From one of the comments below in this thread, the network on which he was present (and was an IRC operator of) was `irc.voidptr.cz` or a variation of that, I could not recall the name of the network at first but when someone mentioned it, I instantly recognized it. If he's who I think he is, I doubt his early background is that clean, despite him being a whitehat now. It is very much possible he is being held because of something related to that and not because of anything related to WannaCry. This was all before he even started running the MalwareTech blog, it's very much possible the FBI decided to look into his background or were already familiar with it prior to him arriving in or leaving the US. That being said, it's possible that I'm mistaking him for someone else in which case I do apologize. I edited the post a bit, to clarify, the first paragraph to the best of my knowledge is certainly true, second one is based on my own speculation so take it with a grain of salt.

sbarre 9y ago
Instead of apologizing for potentially spreading FUD and falsehoods, maybe you should refrain from posting until you have actual facts in hand?
- plopz 9y ago
  Like the article itself?
- strictnein 9y ago
  > maybe you should refrain from posting until you have actual facts in hand? Yeah, like the rest of the people commenting here, right? They have all the facts.
- webkike 9y ago
  The grandparent is making a good point. It is entirely possible that the researcher is being prosecuted for something related to his past. It's not likely that he's being prosecuted for smuggling a small amount of drugs (for example), the FBI wouldn't be the one making the arrest. Even if all the activities he has done in the past are completely legal the FBI could still try to wring him for them.
- hota_mazi 9y ago
  There's an equal number of FUD and speculation going the other way, e.g. that he was arrested for no reason or that he was "disappeared".
- bdcravens 9y ago
  Kind of like the assumptions as to why he was arrested?
ryanlol 9y ago
I can confirm that christina_b is correct and sbarre can rest easy knowing that nobody is being defamed.
GlobalServices 9y ago
This is exactly right.

goatsi 9y ago

He ran a carding forum in the past, malkit.ws and then malkit.su. Virustotal passive DNS shows that it was hosted for a time on the same server as his old irc, irc.voidptr.cz https://www.virustotal.com/en/ip-address/188.190.99.148/information/ https://www.virustotal.com/en/ip-address/188.190.99.148/info...

ryanlol 9y ago
Was it him or BetaMonkey running this? If I recall correctly BM owned voidptr but both had admin access there? EDIT: Ah, found some old logs on google: http://www.exposedbotnets.com/2013/05/hf-elite-coding-team.html http://www.exposedbotnets.com/2013/05/hf-elite-coding-team.h... [08:08] <TouchMe> if i still owned this irc [08:09] <TouchMe> i would shut it down and start over
- christina_b 9y ago
  BetaMonkey/TouchMe was in fact the person I was referring to who was providing support for his botnet drone builder until he dissapeared with no trace at a later date. Just could not recall the nick at the time of making my original post.
  - ryanlol 9y ago
    I always assumed the two to be different people. The log shows the two of them talking at the same time, and I remember the two of them having very different attitudes in general. I know TouchMe is malwaretech but would be inclined to assume that BetaMonkey isn't. TouchMe was still a malware developer though, and apparently used to run voidptr before handing it over to BetaMonkey.
    - christina_b 9y ago
      I was pretty sure TouchMe was BetaMonkey's new nick, I don't think it was Ntoskrnl (MalwareTech). From what I've heard TouchMe continued support of his drone's users until he dissapeared without a trace. This was so long ago and my memory isn't amazing.

gist 9y ago

> For all we know, this detention is completely unrelated to WannaCry. No everyone has already determined 'wow he did a good deed' and 'us law enforcement bad'. The fact is he is linked to this event and a person of interest who they want to get more info from. As such it makes total sense they would detain him for some questioning searches and so on. If you are someone who stops a crime you will also get questioned by the police. For all they know you are covering your own tracks and had a role in the crime. This is almost a cliche in movies and tv.

bitJericho 9y ago
Everyone's determined 'us law enforcement bad' because it doesn't matter what crime he may or may not have committed. He was arrested in the US, which means he may be tortured or murdered, and if he's sentenced he almost certainly will be tortured through means such as prisoner assaults, permanent solitary confinement or abuse, or god knows what else. And heaven forbid he's sent to a military prison. He will never come out again.
- true_religion 9y ago
  If you believe the USA is so terrible then push for sanctions against them. Its better than wringing your hands anytime one of our longtime allies decides to arrest a alleged criminal.
unityByFreedom 9y ago
> If you are someone who stops a crime you will also get questioned by the police. For all they know you are covering your own tracks and had a role in the crime. This is almost a cliche in movies and tv. Yup. Law enforcement is not obliged to assume his innocence.
GlobalServices 9y ago
Exactly. Question to all those who think the USA is so bad...why don't you leave?
chmike 9y ago
I understand your point of view, but I don't share it. First, asking questions doesn't require to detain people. Second, that person is not an American citizen. Unless he committed crimes on the American soil, which might be the case, handling foreign visitors like that is puzzling to say the least.