Arrest of WannaCry researcher sends chill through security community
1–10 of 353 posts
Re: Arrest of WannaCry researcher sends chill through security community
#2> The indictment does not say Hutchins designed Kronos or sold Kronos. Rather, it says that he provided computer code to a second party to update Kronos.
> Overt Acts in Furtherance of the Conspiracy
> a. Defendant MARCUS HUTCHINS created the Kronos malware.
https://www.documentcloud.org/documents/3912524-Kronos-Indic...
Re: Arrest of WannaCry researcher sends chill through security community
#3Realistically, DEF CON should move to the Caribbean.
Marcus Hutchins is a British citizen. Extradition before the event was feasible and would have been a far more honorable path than the snatch and grab that transpired.
British security experts might insist on Grand Cayman for any further conferences in the Americas.
Re: Arrest of WannaCry researcher sends chill through security community
#4Is it me or the DOJ so the flight manifest and then went to a grand jury to indict? He did what he did in 2014-2015 and the charges were filed in July 2017, a couple of weeks before Defcon...
Re: Arrest of WannaCry researcher sends chill through security community
#5Realistically, DEF CON should move to the Caribbean. Marcus Hutchins is a British citizen. Extradition before the event was feasible and would have been a far more honorable path than the snatch and grab that transpired. British security experts might insist on Grand Cayman for any further conferences in the Americas.
Maybe Sir Richard Branson could host it on Neckar and stream it live on Virgin.com -- I'm only slightly kidding.
Re: Arrest of WannaCry researcher sends chill through security community
#6Realistically, DEF CON should move to the Caribbean. Marcus Hutchins is a British citizen. Extradition before the event was feasible and would have been a far more honorable path than the snatch and grab that transpired. British security experts might insist on Grand Cayman for any further conferences in the Americas.
Extradition needn't have come into it. The US authorities could have sent their evidence to the UK police to deal with (assuming the UK police didn't have it to start with).
If we want justice to be seen to be done, we shouldn't encourage "forum-shopping" by law-enforcement, letting them bring prosecutions in a country where the defendent will be artificially disadvantaged.
Re: Arrest of WannaCry researcher sends chill through security community
#7> It is unclear from the indictment if Hutchins would have been aware his work was being used maliciously
The indictment specifically states he sold the malware. Unless he was completely convinced the buyers of Kronos were using it for research into browser malware, it's pretty damned obvious.
I'd be interested to talk to malware researchers that are genuinely scared about this.
Re: Arrest of WannaCry researcher sends chill through security community
#8Realistically, DEF CON should move to the Caribbean. Marcus Hutchins is a British citizen. Extradition before the event was feasible and would have been a far more honorable path than the snatch and grab that transpired. British security experts might insist on Grand Cayman for any further conferences in the Americas.
Extradition needn't have come into it. The US authorities could have sent their evidence to the UK police to deal with (assuming the UK police didn't have it to start with). If we want justice to be seen to be done, we shouldn't encourage "forum-shopping" by law-enforcement, letting them bring prosecutions in a country where the defendent will be artificially disadvantaged.
Having said that, if the unidentified co-conspirator is from the US and they're going to be tried together, it wouldn't be so unreasonable.
Re: Arrest of WannaCry researcher sends chill through security community
#9Realistically, DEF CON should move to the Caribbean. Marcus Hutchins is a British citizen. Extradition before the event was feasible and would have been a far more honorable path than the snatch and grab that transpired. British security experts might insist on Grand Cayman for any further conferences in the Americas.
I was just at this past DEF CON. The good majority of attendees were from the United States.
It doesn't make sense to move it to the Caribbean. That would cause attendance to drop by a lot, and some other organization would just start another conference in the US, and most people would go to that one.
Re: Arrest of WannaCry researcher sends chill through security community
#10Sad to see it confirmed that it's not worth the risk going to America to visit DEFCON. I hope they'll host it in Europe someday.. To see no statement by DEFCON on this whole thing is almost equally sad.