15 ms·
Indictment of Marcus Hutchins aka "Malwaretech"
- Powerofmene 9y agoWhen a website is seized off the dark web by the government, you can bet that it is a treasure trove of information for new and existing investigations. This is probably just the first of many indictments that we will see connected to AlphaBay.
- jgalt212 9y agoCount 5 sounds a lot like Kite's Atom plug-in. > knowingly and inentionaly endeavored to intercept and procure certain electronic communications, namely computer keystrokes of others without the knowledge or consent of said others.
- PrimHelios 9y agoYou could argue that by installing an open source plugin, you consent to what ever it does. EDIT: Not that I like Kite, just bringing up plausible deniability
- ineedasername 9y agoI think that would be a tough sell, and open too many undesirable side effects to pass legal muster. It would provide any bad actor legal cover via open sourcing. With the validity of click-wrap license agreements, the water is muddied further: If users are responsible for complying with their terms, a case could be made that users are, for legal purposes, NOT responsible for being compliant or cognizant of anything not in those terms or other explicitly stated capabilities. For an open source package, that may only be a package digest or readme.md file. (and of course the distribution license e.g. GPL etc.)
- edoceo 9y agoEvery keyboard app for Android
- dang 9y agoPrevious related discussion: https://news.ycombinator.com/item?id=14921018 https://news.ycombinator.com/item?id=14921018.
- makomk 9y agoIt's an oddly uninformative document. It says that they believe he created the Kronos malware but gives absolutely no clue why they think that. All the other overt acts listed appear to have been carried out by his unnamed alleged co-conspirator alone. What makes this particularly bizarre is that he was begging on Twitter for a sample of the malware in question at around the same time: https://twitter.com/MalwareTechBlog/status/488373794168254464 https://twitter.com/MalwareTechBlog/status/48837379416825446...
- smitherfield 9y ago> What makes this particularly bizarre is that he was begging on Twitter for a sample of the malware in question at around the same time Or he was advertising / making a ham-handed attempt at misdirection.
- jwfxpr 9y agoImplausible deniability, perhaps?
- tptacek 9y agoAs "overt acts in furtherance of the conspiracy", the indictment alleges that Hutchins "created the Kronos malware". The rest of the overt actions appear to involve marketing and selling it.
- ShabbosGoy 9y ago[jumped to wrong conclusion]
- tptacek 9y agoIt's a trojan whose purpose is to be installed on large numbers of compromised end-user machines, and to inject fake web pages into browsers to collect credentials and credit card numbers. The DOJ prosecutes people who do that; see, for instance, the recent NanoCore case.
- danso 9y agoThe Guardian has some more context (for those of us not keeping track of previous events, such as AlphaBay's takedown a few weeks ago): https://www.theguardian.com/technology/2017/aug/03/researcher-who-stopped-wannacry-ransomware-detained-in-us https://www.theguardian.com/technology/2017/aug/03/researche...
- ballenf 9y agoI'm amazed and slightly confused at the idea that the act of writing a piece of software can in and of itself be illegal. Do the laws require distribution or showing of intent to harm or simply writing malware? Is there any precedent to democracies jailing a person over reducing to writing an idea or algorithm?
- brians 9y agoWriting even this software wouldn’t have been illegal. It’s mentioned in the indictment as a concrete act in furtherance of a conspiracy, part of the technical abstraction of prosecuting a conspiracy in US law. What is illegal is stealing from banks, and conspiring to steal from banks—and so they’ll show communication, an illegal agreement, and concrete acts in support of the conspiracy. If they weren’t pretty sure they could persuade a jury of those, they wouldn’t have gotten this far. There are also some devices it’s illegal to build—bombs, for example, and other devices whose only or nearly-only purpose is illegal. Some software is included there, including software whose only purpose is illegal wiretapping. That makes it legal to write and exchange proofs of concept for vulnerabilities, but you have to be really careful not to make the PoC too pointy.
- kbwt 9y agoIn Germany, even the act of writing[1] software whose purpose is to access data without authorization[2] or intercept data transmissions intended for someone else[3] is a felony. [1] https://dejure.org/gesetze/StGB/202c.html https://dejure.org/gesetze/StGB/202c.html [2] https://dejure.org/gesetze/StGB/202a.html https://dejure.org/gesetze/StGB/202a.html [3] https://dejure.org/gesetze/StGB/202b.html https://dejure.org/gesetze/StGB/202b.html
- PhasmaFelis 9y ago> The operation included the arrest on 5 July of of suspected AlphaBay founder Alexandre Cazes, a Canadian citizen detained on behalf of the US in Thailand. Cazes, 25, died a week later while in Thai custody. What's this about? The US told Thailand to arrest a Canadian tourist, who they subsequently murdered? People don't die by accident in police custody.
- twodave 9y agoAccording to this article, it was an apparent suicide: https://www.washingtonpost.com/news/morning-mix/wp/2017/07/18/suspected-alphabay-founder-dies-in-bangkok-jail-while-online-black-market-remains-closed/?utm_term=.b3106ad38170 https://www.washingtonpost.com/news/morning-mix/wp/2017/07/1...
- ineedasername 9y agoI imagine that, when you have been the mediator of a bunch of drug trade transactions, "getting caught" can be something of an indirect act of suicide.
- chmike 9y agoMaybe some people didn't want him to talk.
- grugq 9y agoFrom the pictures on Facebook there was no sign of a struggle, the woman in the cell next to him and the cop monitoring the cells both told the same story. It is unlikely that the Thai police would suicide someone for drug crimes that were committed outside the Kingdom. There is just no angle in it. The Thai Police were looking at huge publicity for arresting him. They would want him alive. Clearly he didn't have the connections he needed to be a rich criminal in the Kingdom otherwise he'd have evaded arrest (they had him under surveillance for a while.) I think it is likely that he chose suicide on his own terms over a lifetime sentence in a US jail. Given the lifestyle he was used to, facing a lifetime in US jail would be pretty depressing.
- icebraining 9y ago
- ngold 9y agoThis does not make a lot of sense since he has been in the public eye for awhile now. But who knows. I wonder if he had a presentation to give at Defcon. So far his actions have been very whitehat.
- ryanlol 9y agoOf course it does. He traveled to defcon repeatedly, last time they didn't have the indictment ready so they waited for the next. The US most certainly doesn't want to have another ongoing extradition battle for a British hacker in the UK.
- ineedasername 9y agoAnd we don't really know if names from sealed indictments like this are cross checked with passenger manifests or if Hutchins's recent attention in the media helped to trigger this. And I hate to go down a more "conspiracy theory" line of speculation, but if his history hasn't always been on the white-hat side of the line, then his Wanna Cry involvement looks more questionable as well.
- seesomesense 9y ago"Hours after Hutchins was arrested by the FBI, more than $130,000 (£100,000) of the bitcoin ransom taken by the creators of WannaCry was moved within the bitcoin network for the first time since the outbreak."
- sugersvoltet 9y agoWeren't you detained in a similar way when you traveled to the US to attend Defcon (without the arrest part)? Are you able to discuss how that all went down?
- ryanlol 9y agoHotel rooms searched before con by the FBI, seized some tech and left me alone. Pretended to arrest a "friend" who was with me. On my way back, switching planes at JFK there were a bunch of FBI agents waiting in the tube whom served me a subpoena and suggested that I'd be arrested if I tried to continue my trip. Ended up being dropped off at the courtyard Marriott in Newark by the FBI (after very little arguing they paid for it, rather strange). Stayed there overnight, got interviewed in the morning about things I knew little about. After the interview I got driven to JFK (maybe EWR, not sure) in a FBI car, with the agent at the wheel demonstrating some impressive skills in the heavy traffic, mostly going around it by driving on the shoulder. Never going to the US again I guess, not voluntarily nor involuntarily.
- ryanlol 9y agoDoJ press release: https://www.justice.gov/opa/pr/man-charged-his-role-creating-kronos-banking-trojan https://www.justice.gov/opa/pr/man-charged-his-role-creating...
- benevol 9y agoIt makes one wonder why anyone who has cyber dirt on their hands would step foot on US ground, after the Snowden/NSA revelations which made it clear to everybody on this planet that the NSA is literally everywhere.
- tptacek 9y agoBecause, really, who among us hasn't built and sold software used to harvest Amazon logins, bank account logins, and credit card numbers from botnets?
- jacquesm 9y agoOr crawled a webpage outside of the TOS, shared files through torrents, alerted some website that they had a security hole, ran a business legal abroad but illegal in the United States that had US customers, ran afoul of any one of the US laws without knowing about it and in places not normally under US jurisdiction and so on.
- tptacek 9y agoThat is a non-sequitur response, as this person has not been arrested for violating terms of service, sharing files through torrents, alerting people to security flaws, selling Canadian pharmaceuticals, or trafficking in undersized lobsters. They were arrested for building and selling software used to harvest Amazon logins, bank account logins, and credit card numbers from botnets. Your logic could just as easily be used to dismiss an indictment of any crime, from undersized lobsters to murdering someone with an undersized lobster.
- ChuckMcM 9y agoAs I read it, you Thomas were pointing out that the indictment contains a number of overt and recognizably 'bad' acts, and Jacques was pointing out that there are a number of actions that are arguably 'non bad' that could also get you in trouble. What I took away from this is that Marcus probably shouldn't have come to the US if there really were trails on a computer system tying him to malware. And that Jacques believes it will eventually be a bad idea to come to the US if you have done anything the US disapproves of, even if such things are both acceptable and legal where you did them and when. Me, I'm just trying to move my deck chair so that I can get a good look at the icebergs floating nearby away from all the screaming and panicing.
- imroot 9y agoEven for an indictment, this is...surprisingly bare. (For example, this is an Alphabay seller who was selling and distributing fentanyl in Cincinnati two months ago). https://www.dropbox.com/s/sbsiebzsd6r0f28/bozworth-grace-arrest.pdf?dl=0 https://www.dropbox.com/s/sbsiebzsd6r0f28/bozworth-grace-arr... It looks like they put together the minimum needed to indict, put together a grand jury, indicted and arrested. This was the prosecutor's "ham sandwich" of the week.
- stevecalifornia 9y agoFYI, that file has the name, social security number, and address of the person being indicted. It says it's supposed to be redacted-- but there it is.
- imroot 9y agoGood catch. I didn't see that when I downloaded the file from PACER. I've since uploaded a redacted version to dropbox.
- occams_chainsaw 9y agoso i can get the non-redacted version from pacer? thanks
- deleted 9y ago[deleted]
- gnu8 9y agoDefinitely a rush job when they found out he was coming to the US.
- cm2187 9y agoThe UK is one of the only countries I know that extradites its own citizens to the US. So I don't think he was out of their reach.
- 9y ago
- calafrax 9y agoInteresting that the WannaCry bitcoin account was emptied at about the same time. https://qz.com/1045270/wannacry-update-the-hackers-behind-ransomware-attack-finally-cashed-out-about-140000-in-bitcoin/ https://qz.com/1045270/wannacry-update-the-hackers-behind-ra... Makes me wonder about this guy's real connection to that.
- kakarot 9y agoI don't think he would have pulled the plug so early if he was making money from it. Probably just a coincidence or someone got spooked by everything going on.
- phyller 9y agoThe big stories at the time were that hospitals in the UK were getting shut down by it. If whoever did it lived in the UK they may have had a change of heart.
- calafrax 9y agoyeah, the thing about shutting down hospitals is that instead of looking at fraud and computer crimes that probably won't even be investigated you are potentially looking at manslaughter.
- ajarmst 9y agoGiven that the Alphabay takedown (and law enforcement's control of the servers for at least six weeks) was more than a month ago, Huthchins' blithely travelling to the States for Blackhat seems a level of confidence completely at odds with known facts and the apparent allegations of the indictment.
- Buge 9y agoI don't see why Alphabay getting taken down would really put him at risk. He wouldn't have put his bank account or credit card on the site. This isn't even like drugs where physical mailing addresses are involved. The worst would be the money in his account getting seized.
- ajarmst 9y agoNo, it could be much worse than that. Law enforcement didn't immediately shut Alphabay down---they let it run compromised for several weeks, gathering evidence. If Hutchins made transactions during that period, he was at signficant risk, especially if he was under surveilance at the time---simple traffic analysis would be enough to connect him to activity on the site. It's very hard to hide the content of a conversation from one of its participants.
- Buge 9y agoI would think that when operating any type of illegal online enterprise, you should always operate under the assumption that everyone you're talking to is a government agent. So you should never reveal anything about yourself. The government is obviously making many undercover purchases. Traffic analysis is a risk, but questionable. If it was used in this case, I want to follow this case closely to see more details. Because I haven't heard of a case of the government using traffic analysis to identify users except extremely basic stuff such as "we saw him walk into his house, then saw some Tor traffic, then saw a post appear on the forums".
- wepple 9y ago
- always_good 9y agoThis account kinda reeks of ryanlol. I'm supposed to believe that someone registered an account just to brag about ryanlol, their biggest fan?
- ryanlol 9y agoYou're a moron. If you really think so though, mailto:hn@ycombinator.com
- dang 9y agoPlease don't respond to someone else breaking the HN guidelines by breaking them yourself? We all need to take care of this place or it will get way less interesting and eventually not be worth preserving.
- sugersvoltet 9y agoNot him. I made a throwaway because of the nature of the discussion and to eliminate the very small chance he or someone else could infer who I might be. No point giving them my main account's history to help them guess. I'm not a fan of his at all. I do think he and his talents are interesting, and he's arguably one of the most notorious black hats of the past 5 years. I spoke nicely of him to counterbalance the listing of objectively very unethical crimes he committed against people and organizations. I did not mean "this guy stole credit cards" in an adulating way - I meant the opposite.
- dang 9y agoPlease don't accuse other users of astroturfing or shilling unless you have evidence. It degrades discussion, badly. In this case it even crosses into personal attack, which we ban people for, so please don't. We detached this subthread from https://news.ycombinator.com/item?id=14925431 https://news.ycombinator.com/item?id=14925431 and marked it off-topic.
- always_good 9y agoYeah, I was out of line.
- outworlder 9y agoWe can't know anything at this stage, but from the looks of it, it doesn't seem like the guy wasn't anything but a white hat. There's also this: > Hutchins’ employer, cybersecurity firm Kryptos Logic, had been working closely with the US authorities to help them investigate the WannaCry malware. Hutchins handed over information on the kill switch to the FBI the day after he discovered it, and the chief executive of the firm, Salim Neino, testified in from of the US House of Representatives Committee on Science, Space & Technology the following month. If true, then the guy would have to be incredibly stupid and naive to live such a double life. Not to mention traveling to the US. Anything is possible, of course. The problem is that the guy has become well-known, and retracting such a mistake would be politically costly. This guy will probably have the book thrown at him. It's also a very bad thing for cyber security if researchers cannot do their jobs out of fear.
- hota_mazi 9y ago> We can't know anything at this stage, but from the looks of it, it doesn't seem like the guy wasn't anything but a white hat. Yes, we can know. Did you even bother reading the indictment? He broke six US cyber laws in 2014, and that's why he was arrested. > If true, then the guy would have to be incredibly stupid and naive to live such a double life. Not to mention traveling to the US. Yes, I think you nailed that one. He's certainly not as smart as he thought for flying to the US after breaking US cyber laws just three years ago and thinking the US law enforcement would not notice. > It's also a very bad thing for cyber security if researchers cannot do their jobs out of fear. What are you talking about? He broke US law. Felonies don't go away just because you do one good deed.
- whipoodle 9y agoHe is alleged to have broken the law, we don't know if he did things he is indicted for.
- deleted 9y ago[deleted]
- 9y ago
- betagiraffe 9y agoIronic that some sources suspect he authored Kronos too, haha. That's the best joke I've heard all day. Keep in mind MT is the guy who made a blog article about HVNC and was like "yeah, sorry, can't release my own implementation because.. reasons.. (hehe winkface; tips black fedora)" and then links his GitHub, where a terrible example of CreateDesktop's usage can be found. This guy's profession is to open up IDA Pro and use the pseudo-C output plugin and then vaguely stay on-top of "threat intelligence". Here's my threat intelligence for these people: don't run with scissors. MT is a dreadful programmer. There's logs of MT in his IRC telling people "you can't use the -> operator on references in C++!". He also said he's been writing formgrabbers since before other members of the IRC were born (seriously, nonchalantly). He's barely a programmer at all; never mind a programmer capable of completing malware projects. MT's past is pretty shady. He's been mixed around with other skids for years with actual ill-intent and that's why this incident has happened. The fact people take MT, and people in his league like MalwareUnicorn, seriously is completely beyond me. They're all literal skids. It seems anyone with a twitter handle and the ability to retweet real researchers' work is an "infosec researcher". The 'profession' has devolved into something worthy of a meme. And before you try defend these people, just remember that the "whitepapers" people so often love to reference when defending such Twitter skids are literally just 5 page pamphlets where they advertise their employer and talk about things that were discovered in 2004. Next thing you know, LinkCabin will be giving his rundown of the events. Every moron likes to get involved when they know nothing of MT nor Also, as far as the "TouchMyMalware" alias is concerned: that alias was taken by someone else (who has no vested interests in malware) long after MT abandoned it. So, any recent activity you see relevant to that alias isn't MT. If you want MT's old aliases, you're gonna have to beat the real ones out of him. The state of information security is in total disarray. In 2017, security research is just unskilled skids on Twitter engaging in a giant circle-jerk. Shame, where did it all go wrong?
- banku_brougham 9y agoThe confusing part for me is I thought malware was an establish (albeit evil) business i which the US govt and many others did a brisk business. For example Gamma Group [1]. So is this just someone without the right connections? [1]: https://en.m.wikipedia.org/wiki/Gamma_Group https://en.m.wikipedia.org/wiki/Gamma_Group
- toyg 9y agoWhy is DEFCON still hold in the US? At this point it's basically the biggest IRL honeypot on the planet. It should probably be moved somewhere a bit safer, like Toronto, shouldn't it?
- zimpenfish 9y agoEven Toronto wouldn't necessarily be safe since a fair few people are going to have to transit the US to get there - a quick search on Hipmunk suggests at least 50-60% of the London to Toronto flights involve a US layover.
- toyg 9y agoI expect most DEFCON people would gladly accept the inconvenience of a smaller choice of flights, if it removed the possibility of being detained while ensuring the conference is still well-attended. You can't realistically move DEFCON too far, and the other options (Mexico, Caribbeans...) are not exactly a step forward in terms of liberal rule of law. I think the main problem will always be people who can't (or won't) cross the US border at all, no matter how easy it is. I expect this number is significant among the DEFCON crowd. Still, at some point, the organisers will have to consider whether keeping those types around is worth putting all their non-US guests at risk of draconian imprisonment.
- whipoodle 9y agoSeriously.
- r721 9y ago"This raises an interesting legal question: Is it a crime to create and sell malware? The indictment asserts that Hutchins created the malware and an unnamed co-conspirator took the lead in selling it. The indictment charges a slew of different crimes for that: (1) conspiracy to violate the Computer Fraud and Abuse Act; (2) three counts of violating 18 U.S.C. 2512, which prohibits selling and advertising wiretapping devices; (3) a count of wiretapping; and (4) a count of violating the Computer Fraud and Abuse Act through accomplice liability — basically, aiding and abetting a hacking crime. Do the charges hold up? Just based on a first look at the case, my sense is that the government’s theory of the case is fairly aggressive. It will lead to some significant legal challenges. It’s hard to say, at this point, how those challenges will play out. The indictment is pretty bare bones, and we don’t have all the facts or even what the government thinks are the facts. So while we can’t say that this indictment is clearly an overreach, we can say that the government is pushing the envelope in some ways and may or may not have the facts it needs to make its case. As always, we’ll have to stay tuned. Here’s an overview of the six counts in the indictment, together with my tentative thoughts on them." https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/08/03/the-kronos-indictment-it-a-crime-to-create-and-sell-malware/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...
- syshum 9y agoOutside of the clear concerns about if this person is falsely accused of creating malware for the purposes of victimizing people one concern I still have not seen addressed widely is the issue of US enforcing laws on an international level Even if all of the charges are true, these "crimes" would have taken place in the UK or where ever this person is living outside the US, so how then can the US justify charging them with violation of US law. I know this is not the first time this has happened, nor will it be the last time this happens, but it is increasingly concerning that crimes completely committed online are open to US Jurisdiction and sets a TERRIBLE precedent. As a US Citizen I do not want to be held to another nations laws, laws I may not be familiar with, because of my online activities. It is only a matter of time before a EU nation attempts to extradite or arrest a US Citizen traveling abroad for a hate speech law violation or some other violation that occurred online from the US which is not a violation of US law but is a violation of EU Law.
- mijoharas 9y ago> It is only a matter of time before a EU nation attempts to extradite or arrest a US Citizen traveling abroad for a hate speech law violation or some other violation that occurred online from the US which is not a violation of US law but is a violation of EU Law. Fingers crossed that it's Trump. ;)
- bitcharmer 9y agoWasn't it Obama's administration pushing this draconian policy across the globe in the first place?
- 9y ago
- UK-AL 9y agoMostly likely the US confusing investigation with being involved with the criminal activity. They probably didn't even know about his job or previous good deeds when they arrested him. It's probably a blanket arrest based on communication metadata and relationships between involved parties. They're probably trying save face right now.