15 ms·

I've read a few articles but I feel like I'm missing something. What's with the sensational quotes like "I had folks afraid that their own involvement in inves

by watty 9y ago

I've read a few articles but I feel like I'm missing something. What's with the sensational quotes like "I had folks afraid that their own involvement in investigating WannaCry would get them arrested."? Everything I've read points that he created banking Malware "Kronos" which was sold on various "underground forums" (whatever that means). What's with the WannaCry conspiracies? He wasn't arrested for being a security research, he was arrested for being a malware creator selling malware. Why is this "sending a chill through the security community"?

deleted 9y ago
[deleted]
hughes 9y ago
I think people who write malware to steal banking info should be prosecuted when possible. It will be interesting to see whether this goes to trial and if so how solid any evidence against him is. However, I do not doubt that a mix of fear & incompetence could have resulted in his arrest as much as any concrete evidence of his involvement in Kronos. I think there's (perhaps rightfully) a culture of distrust and paranoia around law enforcement's interaction with ethical hacking. It's difficult to detach from that when legitimate prosecution happens.
- bjpbakker 9y ago
  > people who write malware to steal banking info should be prosecuted I really disagree with you on this. The problem is not the person who researches different exploits (ie who may /write/ the malware) but with the people who /use/ the malware to do bad things. When we keep preventing white hat researchers from doing their job, there's no defense against black hats. If he actually sold Kronos for the sole purpose of stealing, I agree that he should be prosecuted. If he only used it for research purposes, this is a complete witch hunt.
  - Godel_unicode 9y ago
    There's a pretty significant difference between exploit research and banking trojan development.
  - djrogers 9y ago
    You can’t just conflate exploit research and trojan creation with some hand waving. They are two very different things - not just different words.
- criddell 9y ago
  > I think people who write malware to steal banking info should be prosecuted when possible. If I write a program that can steal banking info, what law have I broken? Isn't it only the actual theft that's a crime?
NateyJay 9y ago
The concern is that a lot of behaviour that a security researcher would do in the course of their research, taking over C&C server addresses such as with Wannacry, soliciting for samples of malware, such as Hutchins did with the Kronos trojan, and having contacts with black-hat hackers, might look to the DOJ as if he is the culprit who created the malware. People think that an innocent white hat hacker could get swept up in this kind of arrest, and there has been so little evidence released, nobody knows what actually happened.
- tptacek 9y ago
  Hutchins is accused of creating the Kronos trojan, and of working closely with someone who sold the trojan. The lines the DOJ is saying were crossed are pretty bright.
  - cargo8 9y ago
    If I write open source code for research, share it with the community, and someone wants to license it for "further research" and pays me – am I responsible if their adapted software is then used / stolen / re-applied to kill people or hack a bank? In this scenario I both wrote and explicitly sold the software with no idea of what the later applied tech would do. The computer laws referenced in the article seem to require direct knowledge of malicious intent of the software in the sale.
    - tptacek 9y ago
      If you know the person licensing it from you is going to use it to steal financial information, and the clear purpose of the tool you've built is to steal financial information, then I would say you should definitely make sure you have a criminal defense lawyer you trust and can afford.
      - uyhso8 9y ago
        I don't think anyone would disagree with what you just said, but given the way prosecutors deal with "intent" sometimes, I think it would be easy for them to cross a line. If you haven't already, listen to this podcast about Doug Williams and polygraphs: https://www.thisamericanlife.org/radio-archives/episode/618/mr-lie-detector https://www.thisamericanlife.org/radio-archives/episode/618/... There's a lot of parallels and how issues of intent can get very grey.
biggerfisch 9y ago
The quotes came from people who only knew him as a WannaCry researcher, due the fact that the DoJ took forever to say why they were arresting him. It's as if a prominent anti-spammer were to get arrested with no explanation. A naive guess would be that it was due to their anti-spam work. Even though this arrest wasn't related to his WannaCry, that was his most recent exposure to the public and I think assuming it was related to that can be forgiven
- deleted 9y ago
  [deleted]
celticninja 9y ago
You state he is a malware creator b cause the FBI and their indictment told you he is. The FBI claim he created the software in July 2014, the exact month that he asked on twitter for a copy of the software. Now I am not saying he is innocent but I am also not assuming his guilt because the FBI said he was guilty. What proof do you have that he is a malware creator selling malware?
tetrep 9y ago
> He's not a "hacker" who is doing security research, he's a malware creator selling malware. There's no reason he can't be both. We can both like him for stopping WannaCry, and dislike him for (if true) marketing/distributing malware based on Kronos. Although I agree with your general sentiment, I'm confused as to why the security community is chilled by this. The court case should be public, so we'll be able to judge the evidence ourselves.
- aphextron 9y ago
  >The court case should be public, so we'll be able to judge the evidence ourselves. Well this is still the United States, so by law it will be. People are blowing this way out of proportion as if he were disappeared by the secret police or something.
  - deleted 9y ago
    [deleted]
  - baudehlo 9y ago
    I think the worry here is that he now has no way of returning to the U.K. where he earns his income. He is stuck in jail in the US without reasonable access to a good lawyer (an appointed lawyer won't understand this case). His outcome looks bleak, guilty or innocent.
    - flurdy 9y ago
      Though as I understood it he was working remotely for a California based company. So not being in the UK is not the problem here. Though I am not sure even if on bail if has access to his computers?
  - mdpopescu 9y ago
    He is not a dangerous criminal, who is going to suddenly kill hundreds of people if he's released. He could have gone back to the UK and the US gov't could have requested his extradition. The fact that they didn't (and my natural tendency to consider governments evil) hint to me that they didn't have that strong a case.
manarth 9y ago
There's a tweet dating back to 2014 [1] where he asks for a sample of Kronos. A number of people have pointed out that would be taking the extremely ridiculously long game for an alibi - why would the author ask for a copy of his own code? There's also little/no published information to back up the statement that he ever sold Kronos. [1] https://twitter.com/MalwareTechBlog/status/488373794168254464 https://twitter.com/MalwareTechBlog/status/48837379416825446...
- snissn 9y ago
  If you wrote some malware and people were passing around copies of it, wouldn't you want to see the source of what they were passing around?
  - deleted 9y ago
    [deleted]
- tptacek 9y ago
  He's not personally accused of selling Kronos in the indictment; his unnamed co-conspirator is. (That co-conspirator is unnamed to us, but most probably is someone clearly known to the DOJ). The indictment itself is pretty bare. But an indictment isn't a trial; the DOJ will need to prove its charges to a jury with a considerable amount of evidence, and, as Orin Kerr pointed out last night, they have an uphill climb ahead of themselves, because the letter of the law is favorable to people who create and sell banking trojans.
  - notatoad 9y ago
    > most probably is someone clearly known to the DOJ not probably. the first line of the indictment is "Defendant [redacted] used the online aliases [redacted]. https://www.documentcloud.org/documents/3912549-MalwareTechBlog-Indictment.html https://www.documentcloud.org/documents/3912549-MalwareTechB...
- thefreeman 9y ago
  I would imagine when he allegedly sold the malware it wasn't named "Kronos". He could have had no idea at the time that the specific campaign was his code, or perhaps had a suspicion and wanted to confirm it.
syshum 9y ago
>>Why is this "sending a chill through the security community"? because a lot of legitimate security research when viewed through the myopic and cynical lens of a Federal Agent can be seen as illegal, this is an ongoing and ever present fear for people in the field. The FBI claims he is a malware creator and arrested him for it, you seem to believe fully this narrative of the FBI with no room for the FBI to view completely innocent actions as something else. No room for the FBI to be in error, no room for the FBI to be wrong. The government has routinely, time and time again, over extended and prosecuted several people wrongly under CFAA, which is a terrible and broad law that can be applied at will to many innocent every day computer actions.
- tptacek 9y ago
  What legitimate security research are we talking about? I work in vulnerability research and not malware research, but: can we name anyone who has been prosecuted for what turned out to clearly be benevolent research work?
  - comex 9y ago
    It depends how you define “research”. - Weev’s harvesting and publication of iPad owners’ email addresses was far from benevolent, but it also wasn’t exactly hardcore hacking; IIRC he just changed a URL parameter. As you know, it’s not that far from what white hats sometimes do, in terms of probing public websites - with the obvious exception that they’d usually responsibly disclose the vulnerability to the site owner, rather than publishing people’s data! - Barrett Brown was charged with (among other things) republishing a link to data someone else had leaked. That falls more into the category of journalism than research, and ultimately the charge was dropped, but it still fits a theme of overzealous use of <s>the CFAA</s>. edit: that wasn’t the CFAA, but same idea.
    - tptacek 9y ago
      I follow what you're saying, but look at these cases: Aurenheimer was confronted with IRC logs in which he discussed selling the information he got from the website, and Barrett Brown was accused of actively assisting the people who breached Stratfor. What ever you think of the actual prosecutions here, neither of those are cases of security research being mistaken for something else. The most you can say, for instance, about Brown is that he is not as closely connected to an extraordinarily serious crime as the DOJ believed he was.
edzc92 9y ago
Why is there a law against selling malware? Couldn't a comparison be made with regards to firearms? He created the malware but didn't deploy it live
- gruez 9y ago
  Not a good anology. What's a legitimate use for banking malware? A more apt analogy would be selling an IED.
  - andy_ppp 9y ago
    Hmmm. What are the legitimate uses for firearms again?
    - notzorbo3 9y ago
      Hunting, pest control, shooting sports, self-defense, various other rural stuff.
- zamalek 9y ago
  There are laws against selling weapons to criminals.
AndyMcConachie 9y ago
Writing malware is not a crime. Using it is. What gets me about this case is that, if I understand it correctly, he is being punished for writing software. I've read the indictment but we'll have to wait and see how the government argues its case when this comes to trial.
- djrogers 9y ago
  If you read the indictment then you’d know he was arrested for selling the trojan and conspiracy, not for writing it.
  - roblabla 9y ago
    If you read the indictment then you'd know he's arrested for writing the software as a step to conspiring, not for selling it.
brainfire 9y ago
People love a "lone hero" story and journalists/Twitter personalities are trying to squeeze as much milage as they can out of the genius who saved the entire world from malware.
sspiff 9y ago
As far as I've been able to figure out, he wrote an open source API hooking engine that was used as a key component of the Kronos malware. When he found his hooking code in a malware sample (presumably Kronos), he expressed his disappointment / frustration with this (ab)use of his work on twitter. Whether or not this is truthful or just public posturing remains to be seen. None of this is recent news - it played out in early 2016, so his arrest now is a little odd, unless the DOJ has uncovered new details that have not been publicly disclosed. If it turns out he is arrested for some of his public code in a piece of malware, it should worry both security researchers and open source developers a lot.

by watty 9y ago

deleted 9y ago

[deleted]

hughes 9y ago

I think people who write malware to steal banking info should be prosecuted when possible. It will be interesting to see whether this goes to trial and if so how solid any evidence against him is. However, I do not doubt that a mix of fear & incompetence could have resulted in his arrest as much as any concrete evidence of his involvement in Kronos. I think there's (perhaps rightfully) a culture of distrust and paranoia around law enforcement's interaction with ethical hacking. It's difficult to detach from that when legitimate prosecution happens.

bjpbakker 9y ago
> people who write malware to steal banking info should be prosecuted I really disagree with you on this. The problem is not the person who researches different exploits (ie who may /write/ the malware) but with the people who /use/ the malware to do bad things. When we keep preventing white hat researchers from doing their job, there's no defense against black hats. If he actually sold Kronos for the sole purpose of stealing, I agree that he should be prosecuted. If he only used it for research purposes, this is a complete witch hunt.
- Godel_unicode 9y ago
  There's a pretty significant difference between exploit research and banking trojan development.
- djrogers 9y ago
  You can’t just conflate exploit research and trojan creation with some hand waving. They are two very different things - not just different words.
criddell 9y ago
> I think people who write malware to steal banking info should be prosecuted when possible. If I write a program that can steal banking info, what law have I broken? Isn't it only the actual theft that's a crime?

NateyJay 9y ago

The concern is that a lot of behaviour that a security researcher would do in the course of their research, taking over C&C server addresses such as with Wannacry, soliciting for samples of malware, such as Hutchins did with the Kronos trojan, and having contacts with black-hat hackers, might look to the DOJ as if he is the culprit who created the malware. People think that an innocent white hat hacker could get swept up in this kind of arrest, and there has been so little evidence released, nobody knows what actually happened.

tptacek 9y ago
Hutchins is accused of creating the Kronos trojan, and of working closely with someone who sold the trojan. The lines the DOJ is saying were crossed are pretty bright.
- cargo8 9y ago
  If I write open source code for research, share it with the community, and someone wants to license it for "further research" and pays me – am I responsible if their adapted software is then used / stolen / re-applied to kill people or hack a bank? In this scenario I both wrote and explicitly sold the software with no idea of what the later applied tech would do. The computer laws referenced in the article seem to require direct knowledge of malicious intent of the software in the sale.
  - tptacek 9y ago
    If you know the person licensing it from you is going to use it to steal financial information, and the clear purpose of the tool you've built is to steal financial information, then I would say you should definitely make sure you have a criminal defense lawyer you trust and can afford.
    - uyhso8 9y ago
      I don't think anyone would disagree with what you just said, but given the way prosecutors deal with "intent" sometimes, I think it would be easy for them to cross a line. If you haven't already, listen to this podcast about Doug Williams and polygraphs: https://www.thisamericanlife.org/radio-archives/episode/618/mr-lie-detector https://www.thisamericanlife.org/radio-archives/episode/618/... There's a lot of parallels and how issues of intent can get very grey.

biggerfisch 9y ago

The quotes came from people who only knew him as a WannaCry researcher, due the fact that the DoJ took forever to say why they were arresting him. It's as if a prominent anti-spammer were to get arrested with no explanation. A naive guess would be that it was due to their anti-spam work. Even though this arrest wasn't related to his WannaCry, that was his most recent exposure to the public and I think assuming it was related to that can be forgiven

deleted 9y ago
[deleted]

celticninja 9y ago

You state he is a malware creator b cause the FBI and their indictment told you he is. The FBI claim he created the software in July 2014, the exact month that he asked on twitter for a copy of the software. Now I am not saying he is innocent but I am also not assuming his guilt because the FBI said he was guilty. What proof do you have that he is a malware creator selling malware?

tetrep 9y ago

> He's not a "hacker" who is doing security research, he's a malware creator selling malware. There's no reason he can't be both. We can both like him for stopping WannaCry, and dislike him for (if true) marketing/distributing malware based on Kronos. Although I agree with your general sentiment, I'm confused as to why the security community is chilled by this. The court case should be public, so we'll be able to judge the evidence ourselves.

aphextron 9y ago
>The court case should be public, so we'll be able to judge the evidence ourselves. Well this is still the United States, so by law it will be. People are blowing this way out of proportion as if he were disappeared by the secret police or something.
- deleted 9y ago
  [deleted]
- baudehlo 9y ago
  I think the worry here is that he now has no way of returning to the U.K. where he earns his income. He is stuck in jail in the US without reasonable access to a good lawyer (an appointed lawyer won't understand this case). His outcome looks bleak, guilty or innocent.
  - flurdy 9y ago
    Though as I understood it he was working remotely for a California based company. So not being in the UK is not the problem here. Though I am not sure even if on bail if has access to his computers?
- mdpopescu 9y ago
  He is not a dangerous criminal, who is going to suddenly kill hundreds of people if he's released. He could have gone back to the UK and the US gov't could have requested his extradition. The fact that they didn't (and my natural tendency to consider governments evil) hint to me that they didn't have that strong a case.

manarth 9y ago

There's a tweet dating back to 2014 [1] where he asks for a sample of Kronos. A number of people have pointed out that would be taking the extremely ridiculously long game for an alibi - why would the author ask for a copy of his own code? There's also little/no published information to back up the statement that he ever sold Kronos. [1] https://twitter.com/MalwareTechBlog/status/488373794168254464 https://twitter.com/MalwareTechBlog/status/48837379416825446...

snissn 9y ago
If you wrote some malware and people were passing around copies of it, wouldn't you want to see the source of what they were passing around?
- deleted 9y ago
  [deleted]
tptacek 9y ago
He's not personally accused of selling Kronos in the indictment; his unnamed co-conspirator is. (That co-conspirator is unnamed to us, but most probably is someone clearly known to the DOJ). The indictment itself is pretty bare. But an indictment isn't a trial; the DOJ will need to prove its charges to a jury with a considerable amount of evidence, and, as Orin Kerr pointed out last night, they have an uphill climb ahead of themselves, because the letter of the law is favorable to people who create and sell banking trojans.
- notatoad 9y ago
  > most probably is someone clearly known to the DOJ not probably. the first line of the indictment is "Defendant [redacted] used the online aliases [redacted]. https://www.documentcloud.org/documents/3912549-MalwareTechBlog-Indictment.html https://www.documentcloud.org/documents/3912549-MalwareTechB...
thefreeman 9y ago
I would imagine when he allegedly sold the malware it wasn't named "Kronos". He could have had no idea at the time that the specific campaign was his code, or perhaps had a suspicion and wanted to confirm it.

syshum 9y ago

>>Why is this "sending a chill through the security community"? because a lot of legitimate security research when viewed through the myopic and cynical lens of a Federal Agent can be seen as illegal, this is an ongoing and ever present fear for people in the field. The FBI claims he is a malware creator and arrested him for it, you seem to believe fully this narrative of the FBI with no room for the FBI to view completely innocent actions as something else. No room for the FBI to be in error, no room for the FBI to be wrong. The government has routinely, time and time again, over extended and prosecuted several people wrongly under CFAA, which is a terrible and broad law that can be applied at will to many innocent every day computer actions.

tptacek 9y ago
What legitimate security research are we talking about? I work in vulnerability research and not malware research, but: can we name anyone who has been prosecuted for what turned out to clearly be benevolent research work?
- comex 9y ago
  It depends how you define “research”. - Weev’s harvesting and publication of iPad owners’ email addresses was far from benevolent, but it also wasn’t exactly hardcore hacking; IIRC he just changed a URL parameter. As you know, it’s not that far from what white hats sometimes do, in terms of probing public websites - with the obvious exception that they’d usually responsibly disclose the vulnerability to the site owner, rather than publishing people’s data! - Barrett Brown was charged with (among other things) republishing a link to data someone else had leaked. That falls more into the category of journalism than research, and ultimately the charge was dropped, but it still fits a theme of overzealous use of <s>the CFAA</s>. edit: that wasn’t the CFAA, but same idea.
  - tptacek 9y ago
    I follow what you're saying, but look at these cases: Aurenheimer was confronted with IRC logs in which he discussed selling the information he got from the website, and Barrett Brown was accused of actively assisting the people who breached Stratfor. What ever you think of the actual prosecutions here, neither of those are cases of security research being mistaken for something else. The most you can say, for instance, about Brown is that he is not as closely connected to an extraordinarily serious crime as the DOJ believed he was.

edzc92 9y ago

Why is there a law against selling malware? Couldn't a comparison be made with regards to firearms? He created the malware but didn't deploy it live

gruez 9y ago
Not a good anology. What's a legitimate use for banking malware? A more apt analogy would be selling an IED.
- andy_ppp 9y ago
  Hmmm. What are the legitimate uses for firearms again?
  - notzorbo3 9y ago
    Hunting, pest control, shooting sports, self-defense, various other rural stuff.
zamalek 9y ago
There are laws against selling weapons to criminals.

AndyMcConachie 9y ago

Writing malware is not a crime. Using it is. What gets me about this case is that, if I understand it correctly, he is being punished for writing software. I've read the indictment but we'll have to wait and see how the government argues its case when this comes to trial.

djrogers 9y ago
If you read the indictment then you’d know he was arrested for selling the trojan and conspiracy, not for writing it.
- roblabla 9y ago
  If you read the indictment then you'd know he's arrested for writing the software as a step to conspiring, not for selling it.

brainfire 9y ago

People love a "lone hero" story and journalists/Twitter personalities are trying to squeeze as much milage as they can out of the genius who saved the entire world from malware.

sspiff 9y ago

As far as I've been able to figure out, he wrote an open source API hooking engine that was used as a key component of the Kronos malware. When he found his hooking code in a malware sample (presumably Kronos), he expressed his disappointment / frustration with this (ab)use of his work on twitter. Whether or not this is truthful or just public posturing remains to be seen. None of this is recent news - it played out in early 2016, so his arrest now is a little odd, unless the DOJ has uncovered new details that have not been publicly disclosed. If it turns out he is arrested for some of his public code in a piece of malware, it should worry both security researchers and open source developers a lot.