7 ms·

A white hat is being accused of black hat behaviour. There is no indication that the government is seeking to charge him with any activities related to behavio

A white hat is being accused of black hat behaviour. There is no indication that the government is seeking to charge him with any activities related to behaviour that could be interpreted as "white hat" in any way. He's accused of creating and distributing malware. He may be found innocent of that, but the crimes he is accused of are very definitely crimes, and he shouldn't get a pass just because he's been publicly acting as a white hat. If the government has evidence, he should be charged and tried. And that appears to be what's happening here.

tptacek 9y ago
Well. They're probably crimes. The law behind building and selling banking trojans is pretty hazy.
- AlexCoventry 9y ago
  You're kidding, right? Looks like slam dunk aiding and abetting wire fraud.
  - tptacek 9y ago
    I am not kidding, but rather parroting Orin Kerr, an expert on this subject, who does not think this case is a slam dunk. (Not because the evidence for Hutchins' involvement is thin, but because the law here is hazy.)
    - AlexCoventry 9y ago
      Thanks for the cite. Interesting.
    - theEXTORTCIST 9y ago
      Link to the Orin Kerr article: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/08/03/the-kronos-indictment-it-a-crime-to-create-and-sell-malware/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... Orin Kerr's analysis is excellent and made me consider the accused party's intent and the difference between selling code versus using code.
      - meowface 9y ago
        He makes great points, but I intuitively feel like certain acts of creating and selling malware should be illegal, even if only by the spirit and not the letter of the law. If someone manufactures guns, doesn't register them, and knowingly sells them to street gangs, it kind of seems like they're aiding and abetting illegal activities for profit. Of course there are instances of selling malware you created to parties who generally won't use it illegally, but that's not what's alleged here. Whether Hutchins truly violated the law, I don't know, but if the allegations are true then he did something very unethical and something I feel should be illegal.
        Piskvorrr 9y ago
        Some malware uses libcurl. Does that make its creator a criminal?
        tptacek 9y ago
        Obviously not.
        meowface 9y ago
        You're comparing apples and orangutans.
- ShabbosGoy 9y ago
  Do you think there should be a market for building/selling malware? I feel like it would aid in zero day disclosures. But it could also incentivize black hats.
  - tptacek 9y ago
    Fuck no. Malware and exploits are not the same thing. Anyone can write malware; you just have to have the stones and a broken enough moral compass to make money by immiserating strangers. There is an infinite amount of malware; we don't benefit from its "disclosure".
  - qaq 9y ago
    There is a market already, the only diff. from this case is who is the end buyer. If you are building a rootkit for Sony Entertainment to use on it's customers none minds much.
natch 9y ago
Again, no contradiction here. There is a fear that a white hat is being accused of black hat behavior. Not a claim. A fear. And a reality that a person (maybe white hat, maybe black hat, we don't know) is being accused of black hat behavior. Nothing surprising here. He may, or may not, be a black hat. The fear of unjust accusation is still valid. We will have to see if the DOJ will share the evidence, and what that evidence says.
- hueving 9y ago
  >The fear of unjust accusation is still valid. Then why isn't there a chill sent every time anyone is arrested on accusations of black hat crimes? If a cop is arrested under accusation of dealing drugs on the side, it doesn't suddenly send a chill through the law enforcement community that works to take down drug dealers.
  - tptacek 9y ago
    I think it was just a lazy way to write a headline about how everyone in the security community is talking about this case --- which they are. It's a lot more interesting for readers if something important is at stake --- which I think really nothing is.
  - throwaway122916 9y ago
    > If a cop is arrested under accusation of dealing drugs on the side, it doesn't suddenly send a chill through the law enforcement community that works to take down drug dealers. How do you know that it doesn't? White hats are counterintel agents effectively. If a counterintel agent is arrested for doing something that could be deemed as part of his job, why wouldn't it 'send a chill' through the community?
    - tptacek 9y ago
      No they aren't.
  - milesvp 9y ago
    You're not quite making the right analogous scenario. It's more like if a neighbor you know who has some strong vocal opinions agaist the current regime suddenly gets arrested on some charges like conspiracy to incite revolt. I would be rightful to be afraid of being charged similarly if I had similar beliefs and had knew I'd had similar conversations as my neighbor.
mattnewton 9y ago
The "chill" comes from legal activities potentially getting you detained and brought up on charges. That's a real cost, even assuming a perfect justice system that can tell they made a mistake. For an analogy, suppose you wanted to rehabilitate some drug addicts in a bad part of town, and as a result, frequented that part of town, and bought books on drug dosages. If that could get you arrested because the cops couldn't tell the difference between you wanting to help drug addicts and being a drug dealer, and arrested you based on frequently being in the wrong part of town and showing an interest in drug literature, then it would send a clear message to go no where near these people in need. And that would be a shame.
- notatoad 9y ago
  >the cops couldn't tell the difference is there any indication that's the case here? the FBI isn't a bunch of complete incompetents. He could be found innocent, but what makes this case different than the presumption of innocence that every person charged with a crime is supposed to be given?
  - mattnewton 9y ago
    There is evidence that he was a white hat hacker now, and that is enough for current white hat hackers to be worried.
    - tptacek 9y ago
      I don't know what these terms even mean. "White hat hacker"? Is that what we call "everyone who does anything in infosec but doesn't sell stolen financial information obtained from botnets"? The attempt to divide the whole world into "people irrationally attacking 'hackers' and 'the good kind of hackers'" isn't doing anyone any favors. If Hutchins has nothing to do with a criminal conspiracy to profit from a truly awful banking trojan, then his arrest and indictment is a travesty. But if he does have something to do with it, then his status as any kind of "hacker" should have nothing to do with anybody's take on the situation. I'm not sure how much lower you can go than deliberately making money by stealing bank logins from ordinary people, which is what he's accused of doing. People love to talk about how the FBI has a history of framing people --- and in other fields they might. But there is no track record I'm aware of for the FBI to make up a story like this out of whole cloth. In every case like it, from NanoCore to Albert Gonzales and Stephen Watt, there's been a basis for the charges.
AnthonyMouse 9y ago
> There is no indication that the government is seeking to charge him with any activities related to behaviour that could be interpreted as "white hat" in any way. There is only the thinnest of lines between the two. White hats have to traffic in malware and exploits because it's necessary to understand a threat in order to defend against it, and in order to test that your defenses are effective. In may even be necessary to infiltrate black hat collectives. The clearest way to tell the difference is that a real black hat will be breaking some other law. Committing credit card fraud or misappropriation of trade secrets or something like that. But that doesn't appear to be the case here. And the fear is that because the law around this is so uncertain, if the government is going to use it in cases like this without any independent bad acts then nobody knows where the line is supposed to be.
- tptacek 9y ago
  "White hats" do not in fact routinely sell software intended almost solely to harvest financial information from botnets. People on this thread have a lot of strange ideas about what infosec people do in their jobs.
  - AnthonyMouse 9y ago
    > "White hats" do not in fact routinely sell software intended almost solely to harvest financial information from botnets. The indictment doesn't allege that the defendant sold it, only that he wrote it and someone else sold it. And as you know, white hats create proof of concept code all the time. And give it to various people (including, in the end, anyone) for various meritorious reasons.
    - tptacek 9y ago
      For the Nth time in this thread: watch the video of the software we're talking about. "White hats" do not build things like that all the time.
      - natch 9y ago
tripzilch 9y ago
What about, say, Brian Krebs? According to his blog posts, he hangs out a lot on blackhat/cybercrime forums, particularly Eastern European and Russian (?) ones. He has contact with people there, posing as another blackhat, to lure information from them. It's possible, perhaps, that he also leaves out certain interactions that might cross further into a legal grey area (I'm not saying that he has), benign to his research. That's bound to set off some alarm bells, somewhere some day, at some agency or bureau. Now, Krebs keeps a relatively high profile pertaining to his work, so it's not improbable that they think twice when they read who he is, and see he's one of the "good guys" obviously. But there's a lot of white hat researchers who aren't Internet-famous (in the tech world, not just security). Quite a few by choice, too. So now they're worried if there's anything they might have done in the past that could get them into this kind of trouble. That is, being charged with something over having done (perhaps legally grey) security research. And yes they'll be given a fair trial, except that it seems that in the US proving one's innocence also depends on whether you have sufficient funds (I feel like I'm stereotyping here, but I see so many people casually mention these scenarios as if it's a given). And then, being one of the "good guys"--by, say, single-handedly stopping the first wave of a global ransomware epidemic--doesn't seem to warrant a bit more considerate and less aggressive approach any more, either. So now they're worried!

tptacek 9y ago

Well. They're probably crimes. The law behind building and selling banking trojans is pretty hazy.

AlexCoventry 9y ago
You're kidding, right? Looks like slam dunk aiding and abetting wire fraud.
- tptacek 9y ago
  I am not kidding, but rather parroting Orin Kerr, an expert on this subject, who does not think this case is a slam dunk. (Not because the evidence for Hutchins' involvement is thin, but because the law here is hazy.)
  - AlexCoventry 9y ago
    Thanks for the cite. Interesting.
  - theEXTORTCIST 9y ago
    Link to the Orin Kerr article: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/08/03/the-kronos-indictment-it-a-crime-to-create-and-sell-malware/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... Orin Kerr's analysis is excellent and made me consider the accused party's intent and the difference between selling code versus using code.
    - meowface 9y ago
      He makes great points, but I intuitively feel like certain acts of creating and selling malware should be illegal, even if only by the spirit and not the letter of the law. If someone manufactures guns, doesn't register them, and knowingly sells them to street gangs, it kind of seems like they're aiding and abetting illegal activities for profit. Of course there are instances of selling malware you created to parties who generally won't use it illegally, but that's not what's alleged here. Whether Hutchins truly violated the law, I don't know, but if the allegations are true then he did something very unethical and something I feel should be illegal.
      - Piskvorrr 9y ago
        Some malware uses libcurl. Does that make its creator a criminal?
        tptacek 9y ago
        Obviously not.
        meowface 9y ago
        You're comparing apples and orangutans.
ShabbosGoy 9y ago
Do you think there should be a market for building/selling malware? I feel like it would aid in zero day disclosures. But it could also incentivize black hats.
- tptacek 9y ago
  Fuck no. Malware and exploits are not the same thing. Anyone can write malware; you just have to have the stones and a broken enough moral compass to make money by immiserating strangers. There is an infinite amount of malware; we don't benefit from its "disclosure".
- qaq 9y ago
  There is a market already, the only diff. from this case is who is the end buyer. If you are building a rootkit for Sony Entertainment to use on it's customers none minds much.

natch 9y ago

Again, no contradiction here. There is a fear that a white hat is being accused of black hat behavior. Not a claim. A fear. And a reality that a person (maybe white hat, maybe black hat, we don't know) is being accused of black hat behavior. Nothing surprising here. He may, or may not, be a black hat. The fear of unjust accusation is still valid. We will have to see if the DOJ will share the evidence, and what that evidence says.

hueving 9y ago
>The fear of unjust accusation is still valid. Then why isn't there a chill sent every time anyone is arrested on accusations of black hat crimes? If a cop is arrested under accusation of dealing drugs on the side, it doesn't suddenly send a chill through the law enforcement community that works to take down drug dealers.
- tptacek 9y ago
  I think it was just a lazy way to write a headline about how everyone in the security community is talking about this case --- which they are. It's a lot more interesting for readers if something important is at stake --- which I think really nothing is.
- throwaway122916 9y ago
  > If a cop is arrested under accusation of dealing drugs on the side, it doesn't suddenly send a chill through the law enforcement community that works to take down drug dealers. How do you know that it doesn't? White hats are counterintel agents effectively. If a counterintel agent is arrested for doing something that could be deemed as part of his job, why wouldn't it 'send a chill' through the community?
  - tptacek 9y ago
    No they aren't.
- milesvp 9y ago
  You're not quite making the right analogous scenario. It's more like if a neighbor you know who has some strong vocal opinions agaist the current regime suddenly gets arrested on some charges like conspiracy to incite revolt. I would be rightful to be afraid of being charged similarly if I had similar beliefs and had knew I'd had similar conversations as my neighbor.

mattnewton 9y ago

The "chill" comes from legal activities potentially getting you detained and brought up on charges. That's a real cost, even assuming a perfect justice system that can tell they made a mistake. For an analogy, suppose you wanted to rehabilitate some drug addicts in a bad part of town, and as a result, frequented that part of town, and bought books on drug dosages. If that could get you arrested because the cops couldn't tell the difference between you wanting to help drug addicts and being a drug dealer, and arrested you based on frequently being in the wrong part of town and showing an interest in drug literature, then it would send a clear message to go no where near these people in need. And that would be a shame.

notatoad 9y ago
>the cops couldn't tell the difference is there any indication that's the case here? the FBI isn't a bunch of complete incompetents. He could be found innocent, but what makes this case different than the presumption of innocence that every person charged with a crime is supposed to be given?
- mattnewton 9y ago
  There is evidence that he was a white hat hacker now, and that is enough for current white hat hackers to be worried.
  - tptacek 9y ago
    I don't know what these terms even mean. "White hat hacker"? Is that what we call "everyone who does anything in infosec but doesn't sell stolen financial information obtained from botnets"? The attempt to divide the whole world into "people irrationally attacking 'hackers' and 'the good kind of hackers'" isn't doing anyone any favors. If Hutchins has nothing to do with a criminal conspiracy to profit from a truly awful banking trojan, then his arrest and indictment is a travesty. But if he does have something to do with it, then his status as any kind of "hacker" should have nothing to do with anybody's take on the situation. I'm not sure how much lower you can go than deliberately making money by stealing bank logins from ordinary people, which is what he's accused of doing. People love to talk about how the FBI has a history of framing people --- and in other fields they might. But there is no track record I'm aware of for the FBI to make up a story like this out of whole cloth. In every case like it, from NanoCore to Albert Gonzales and Stephen Watt, there's been a basis for the charges.

AnthonyMouse 9y ago

> There is no indication that the government is seeking to charge him with any activities related to behaviour that could be interpreted as "white hat" in any way. There is only the thinnest of lines between the two. White hats have to traffic in malware and exploits because it's necessary to understand a threat in order to defend against it, and in order to test that your defenses are effective. In may even be necessary to infiltrate black hat collectives. The clearest way to tell the difference is that a real black hat will be breaking some other law. Committing credit card fraud or misappropriation of trade secrets or something like that. But that doesn't appear to be the case here. And the fear is that because the law around this is so uncertain, if the government is going to use it in cases like this without any independent bad acts then nobody knows where the line is supposed to be.

tptacek 9y ago
"White hats" do not in fact routinely sell software intended almost solely to harvest financial information from botnets. People on this thread have a lot of strange ideas about what infosec people do in their jobs.
- AnthonyMouse 9y ago
  > "White hats" do not in fact routinely sell software intended almost solely to harvest financial information from botnets. The indictment doesn't allege that the defendant sold it, only that he wrote it and someone else sold it. And as you know, white hats create proof of concept code all the time. And give it to various people (including, in the end, anyone) for various meritorious reasons.
  - tptacek 9y ago
    For the Nth time in this thread: watch the video of the software we're talking about. "White hats" do not build things like that all the time.
    - natch 9y ago

tripzilch 9y ago

What about, say, Brian Krebs? According to his blog posts, he hangs out a lot on blackhat/cybercrime forums, particularly Eastern European and Russian (?) ones. He has contact with people there, posing as another blackhat, to lure information from them. It's possible, perhaps, that he also leaves out certain interactions that might cross further into a legal grey area (I'm not saying that he has), benign to his research. That's bound to set off some alarm bells, somewhere some day, at some agency or bureau. Now, Krebs keeps a relatively high profile pertaining to his work, so it's not improbable that they think twice when they read who he is, and see he's one of the "good guys" obviously. But there's a lot of white hat researchers who aren't Internet-famous (in the tech world, not just security). Quite a few by choice, too. So now they're worried if there's anything they might have done in the past that could get them into this kind of trouble. That is, being charged with something over having done (perhaps legally grey) security research. And yes they'll be given a fair trial, except that it seems that in the US proving one's innocence also depends on whether you have sufficient funds (I feel like I'm stereotyping here, but I see so many people casually mention these scenarios as if it's a given). And then, being one of the "good guys"--by, say, single-handedly stopping the first wave of a global ransomware epidemic--doesn't seem to warrant a bit more considerate and less aggressive approach any more, either. So now they're worried!