4 ms·

There's a tweet dating back to 2014 [1] where he asks for a sample of Kronos. A number of people have pointed out that would be taking the extremely ridiculous

There's a tweet dating back to 2014 [1] where he asks for a sample of Kronos. A number of people have pointed out that would be taking the extremely ridiculously long game for an alibi - why would the author ask for a copy of his own code? There's also little/no published information to back up the statement that he ever sold Kronos. [1] https://twitter.com/MalwareTechBlog/status/488373794168254464 https://twitter.com/MalwareTechBlog/status/48837379416825446...

snissn 9y ago
If you wrote some malware and people were passing around copies of it, wouldn't you want to see the source of what they were passing around?
- deleted 9y ago
  [deleted]
tptacek 9y ago
He's not personally accused of selling Kronos in the indictment; his unnamed co-conspirator is. (That co-conspirator is unnamed to us, but most probably is someone clearly known to the DOJ). The indictment itself is pretty bare. But an indictment isn't a trial; the DOJ will need to prove its charges to a jury with a considerable amount of evidence, and, as Orin Kerr pointed out last night, they have an uphill climb ahead of themselves, because the letter of the law is favorable to people who create and sell banking trojans.
- notatoad 9y ago
  > most probably is someone clearly known to the DOJ not probably. the first line of the indictment is "Defendant [redacted] used the online aliases [redacted]. https://www.documentcloud.org/documents/3912549-MalwareTechBlog-Indictment.html https://www.documentcloud.org/documents/3912549-MalwareTechB...
thefreeman 9y ago
I would imagine when he allegedly sold the malware it wasn't named "Kronos". He could have had no idea at the time that the specific campaign was his code, or perhaps had a suspicion and wanted to confirm it.
- tptacek 9y ago
  There's a video demonstration of the tool we're talking about. Nobody who has watched it is going to for a moment entertain the idea that the author of this tool didn't understand its intention. Its purpose is extracting financial information from botnets.
  - randallsquared 9y ago
    That doesn't seem to be a reply to GP's post.
arca_vorago 9y ago
My personal opinion, until shown evidence otherwise, is this is the real author/seller being turned into an informant, and part of that process, the first step, is to protect the informant and smear another. MTB's high profile on the issue may mean he was a target of opportunity. Of course I could be wrong, so time will tell. A good future indicator of this will be if the case is dropped as quietly as possible.
usrusr 9y ago
> A number of people have pointed out that would be taking the extremely ridiculously long game for an alibi - why would the author ask for a copy of his own code? If I was greedy and in the security field, with identities (or middlemen) on both sides of the game, I would be terribly tempted to play those identities to support each other. For example when blackhat-me would be selling an exploit, whitehat-me could create buzz by talking about it. Later, when the exploit's market value drops towards zero (ip enforcement is weak on the darknet), whitehat-me could reap the glory of discovering all the details about the exploit, maybe even using some "mistakes" blackhat-me left in the code to facilitate plausible parallel construction. What are all those ifs having to do with the WannaCry situation? Probably nothing, hopefully nothing. Or maybe hopefully a lot, because it would mean that the FBI did not lock up the wrong guy?
- numbsafari 9y ago
  I feel like you just described the business model of every anti-virus company ever.
  - golergka 9y ago
    Are they petty enough to sell exploits? Kaspersky, for example, is so deep in bed with FSB that it's hard to tell exactly where one ends and the other starts; I really doubt FSB would bother selling exploits to anyone.
fastball 9y ago
Anecdotal, but I did things that were a lot more paranoid than "tweeting myself" when I was doing questionably legal things on the internet as a 13 year old. So to me, tweeting "I want a sample of Kronos" is indicative of nothing.

snissn 9y ago

If you wrote some malware and people were passing around copies of it, wouldn't you want to see the source of what they were passing around?

deleted 9y ago
[deleted]

tptacek 9y ago

He's not personally accused of selling Kronos in the indictment; his unnamed co-conspirator is. (That co-conspirator is unnamed to us, but most probably is someone clearly known to the DOJ). The indictment itself is pretty bare. But an indictment isn't a trial; the DOJ will need to prove its charges to a jury with a considerable amount of evidence, and, as Orin Kerr pointed out last night, they have an uphill climb ahead of themselves, because the letter of the law is favorable to people who create and sell banking trojans.

notatoad 9y ago
> most probably is someone clearly known to the DOJ not probably. the first line of the indictment is "Defendant [redacted] used the online aliases [redacted]. https://www.documentcloud.org/documents/3912549-MalwareTechBlog-Indictment.html https://www.documentcloud.org/documents/3912549-MalwareTechB...

thefreeman 9y ago

I would imagine when he allegedly sold the malware it wasn't named "Kronos". He could have had no idea at the time that the specific campaign was his code, or perhaps had a suspicion and wanted to confirm it.

tptacek 9y ago
There's a video demonstration of the tool we're talking about. Nobody who has watched it is going to for a moment entertain the idea that the author of this tool didn't understand its intention. Its purpose is extracting financial information from botnets.
- randallsquared 9y ago
  That doesn't seem to be a reply to GP's post.

arca_vorago 9y ago

My personal opinion, until shown evidence otherwise, is this is the real author/seller being turned into an informant, and part of that process, the first step, is to protect the informant and smear another. MTB's high profile on the issue may mean he was a target of opportunity. Of course I could be wrong, so time will tell. A good future indicator of this will be if the case is dropped as quietly as possible.

usrusr 9y ago

> A number of people have pointed out that would be taking the extremely ridiculously long game for an alibi - why would the author ask for a copy of his own code? If I was greedy and in the security field, with identities (or middlemen) on both sides of the game, I would be terribly tempted to play those identities to support each other. For example when blackhat-me would be selling an exploit, whitehat-me could create buzz by talking about it. Later, when the exploit's market value drops towards zero (ip enforcement is weak on the darknet), whitehat-me could reap the glory of discovering all the details about the exploit, maybe even using some "mistakes" blackhat-me left in the code to facilitate plausible parallel construction. What are all those ifs having to do with the WannaCry situation? Probably nothing, hopefully nothing. Or maybe hopefully a lot, because it would mean that the FBI did not lock up the wrong guy?

numbsafari 9y ago
I feel like you just described the business model of every anti-virus company ever.
- golergka 9y ago
  Are they petty enough to sell exploits? Kaspersky, for example, is so deep in bed with FSB that it's hard to tell exactly where one ends and the other starts; I really doubt FSB would bother selling exploits to anyone.

fastball 9y ago

Anecdotal, but I did things that were a lot more paranoid than "tweeting myself" when I was doing questionably legal things on the internet as a 13 year old. So to me, tweeting "I want a sample of Kronos" is indicative of nothing.