I would not be shocked if Defcon moved out of the US.
To where?
Germany!
Arrest of WannaCry researcher sends chill through security community
61–70 of 353 posts
Re: Arrest of WannaCry researcher sends chill through security community
#62Realistically, DEF CON should move to the Caribbean. Marcus Hutchins is a British citizen. Extradition before the event was feasible and would have been a far more honorable path than the snatch and grab that transpired. British security experts might insist on Grand Cayman for any further conferences in the Americas.
You think the FBI is going to interdict a computer criminal before they spend a week in Las Vegas associating with computer security professionals, any of whom could be criminal co-conspirators?†
That would be exceptionally nice of them, but also extremely poor investigative practice.
I will say, though, as one of the many people in my field that is bone-tired of schlepping out to the worst place in the United States every damn year for these events, any other location in the world would be fine for me, and I endorse the actual suggestion you're making.
† (Yes, obviously, I know virtually nobody who attends Defcon is a criminal).
Re: Arrest of WannaCry researcher sends chill through security community
#63Earlier quoted context omitted.
I was just at this past DEF CON. The good majority of attendees were from the United States. It doesn't make sense to move it to the Caribbean. That would cause attendance to drop by a lot, and some other organization would just start another conference in the US, and most people would go to that one.
If our justice system behaves dishonorably, then the world's information security industry should certainly abandon the U.S. We can have our solo conferences, but we can't ask foreigners to risk incarceration for our convenience. The Bahamas might also be a reasonable choice, as they only declared independence from Britain in 1973.
There is already a similar huge convention held annually in Germany, the Chaos Communication Congress. It's quite well attended.
Re: Arrest of WannaCry researcher sends chill through security community
#64Earlier quoted context omitted.
If our justice system behaves dishonorably, then the world's information security industry should certainly abandon the U.S. We can have our solo conferences, but we can't ask foreigners to risk incarceration for our convenience. The Bahamas might also be a reasonable choice, as they only declared independence from Britain in 1973.
I might be misunderstanding your point but I don't understand what they did that was so dishonorable? I thought that this guy produced malware
We don't know whether he did or not. But if they have evidence to support arresting him,
the US has an extradition treaty with Britain; they should have shared it and asked British authorities to make the arrest. And there very well may be evidence, especially if the timing is related to something new obtained from the Alpha Bay takedown and it happening when he happened to visit the US for DEFCON was a coincidence.
But running a snatch and grab at a security research conference looks really bad, and is bound to have a much wider chilling effect on people's willingness to attend US conferences.
Re: Arrest of WannaCry researcher sends chill through security community
#65Earlier quoted context omitted.
>>Why is this "sending a chill through the security community"? because a lot of legitimate security research when viewed through the myopic and cynical lens of a Federal Agent can be seen as illegal, this is an ongoing and ever present fear for people in the field. The FBI claims he is a malware creator and arrested him for it, you seem to believe fully this narrative of the FBI with no room for the FBI to view comp…
But he wasn't arrested for any normal thing a security researcher would do - he's arrested for creating and selling malware... big difference. The FBI could be wrong and that'd suck. I'm just assuming that the FBI and their resources have enough evidence to reasonably believe he's the creator. And again, your last comment doesn't fit this article. They aren't overextending and arresting a security researcher (althoug…
The FBI claims he created malware, an unnamed co-conspirator is charged with selling it
So you generally believe people are guilty until proven innocent, and I always believe people are innocent until they are proven guilty. I never take the government word for anything, and generally assume the government is lying at all times. History supports my position.
I find it extremely alarming how quickly people just believe the FBI's assertions as fact with almost no actual evidence being presented
Re: Arrest of WannaCry researcher sends chill through security community
#66Earlier quoted context omitted.
There's a tweet dating back to 2014 [1] where he asks for a sample of Kronos. A number of people have pointed out that would be taking the extremely ridiculously long game for an alibi - why would the author ask for a copy of his own code? There's also little/no published information to back up the statement that he ever sold Kronos. [1] https://twitter.com/MalwareTechBlog/status/48837379416825446...
I would imagine when he allegedly sold the malware it wasn't named "Kronos". He could have had no idea at the time that the specific campaign was his code, or perhaps had a suspicion and wanted to confirm it.
There's a video demonstration of the tool we're talking about. Nobody who has watched it is going to for a moment entertain the idea that the author of this tool didn't understand its intention. Its purpose is extracting financial information from botnets.
Re: Arrest of WannaCry researcher sends chill through security community
#67Perhaps you are being deliberately obtuse I'm not sure. The point the poster was making is that the US happily arrests foreigners who set foot in the US and regardless of your guilt or innocence you get trapped in the US justice system which is essentially a system to tie you up in court and legal processes that you cannot afford so that you accept a plea deal, possibly for something you have not done, because otherw…
> The point the poster was making is that the US happily arrests foreigners who set foot in the US and regardless of your guilt or innocence you get trapped in the US justice system which is essentially a system to tie you up in court and legal processes that you cannot afford so that you accept a plea deal, possibly for something you have not done, because otherwise you face never seeing the outside world again.
Any country that you set foot in, that has reason to arrest you and acts on it, can trap you within their legal/justice system effectively indefinitely. This is not a matter of right or wrong, it's just a fact.
If Argentina has a reason to arrest me, and I go there, I shouldn't be surprised if they do. Germany would do it. Switzerland would do it. Literally every nation.
Now, my rights within those nations with respect to duration of arrest, access to legal guidance, etc. may vary, and some will be better than others. But that someone is arrested for violating US law by US authorities while they happen to be in the US should not be a big surprise to anyone.
Re: Arrest of WannaCry researcher sends chill through security community
#68Perhaps you are being deliberately obtuse I'm not sure. The point the poster was making is that the US happily arrests foreigners who set foot in the US and regardless of your guilt or innocence you get trapped in the US justice system which is essentially a system to tie you up in court and legal processes that you cannot afford so that you accept a plea deal, possibly for something you have not done, because otherw…
I guess I am obtuse. I see this as the FBI believes Marcus created and sold/conspired to sell malware. This is illegal. Now we will see evidence and a trial.
The responses are ridiculous.
- Muslim last names ??
- US happily arrests foreigners
- Plea deal or never see the outside world again
- White rich people are favoured
- Rich black people have a tough time
Seriously?
Re: Arrest of WannaCry researcher sends chill through security community
#69Earlier quoted context omitted.
>>Why is this "sending a chill through the security community"? because a lot of legitimate security research when viewed through the myopic and cynical lens of a Federal Agent can be seen as illegal, this is an ongoing and ever present fear for people in the field. The FBI claims he is a malware creator and arrested him for it, you seem to believe fully this narrative of the FBI with no room for the FBI to view comp…
What legitimate security research are we talking about? I work in vulnerability research and not malware research, but: can we name anyone who has been prosecuted for what turned out to clearly be benevolent research work?
It depends how you define “research”.
- Weev’s harvesting and publication of iPad owners’ email addresses was far from benevolent, but it also wasn’t exactly hardcore hacking; IIRC he just changed a URL parameter. As you know, it’s not that far from what white hats sometimes do, in terms of probing public websites - with the obvious exception that they’d usually responsibly disclose the vulnerability to the site owner, rather than publishing people’s data!
- Barrett Brown was charged with (among other things) republishing a link to data someone else had leaked. That falls more into the category of journalism than research, and ultimately the charge was dropped, but it still fits a theme of overzealous use of the CFAA.
edit: that wasn’t the CFAA, but same idea.
Re: Arrest of WannaCry researcher sends chill through security community
#70Im powerless to change the situation, but im proud enough to let logic triumph even in this situation.
I shall not write empty justifications for the willkür of those in power out of fear for my loved ones.
No matter how high the priorities, and the hope for the scyth to miss me if i bow low enough.
I shall not hide from reason within emotions.
I shall not prejudge.
I wont give in to hysteria or depression.
Nor shall i rejuvenate in youthfull fervour.
If the world has shown one thing, then it is, that even the most powerful government, is limited in its course of actions, by a thousand citizens voting with there daily actions and feets against them. The shall not bow my ways, the shall not change my actions. Long after there palace will fall, there shemes turn to bite the hands that fed them, my hut shall still stand on the river where they drift by.