Arrest of WannaCry researcher sends chill through security community

Post by loeg » Fri, Aug 04, 2017, 8:25 PM UTC

tptacek wrote: post #47

NateyJay wrote: post #28

Earlier quoted context omitted.

The concern is that a lot of behaviour that a security researcher would do in the course of their research, taking over C&C server addresses such as with Wannacry, soliciting for samples of malware, such as Hutchins did with the Kronos trojan, and having contacts with black-hat hackers, might look to the DOJ as if he is the culprit who created the malware. People think that an innocent white hat hacker could get swep…

Hutchins is accused of creating the Kronos trojan, and of working closely with someone who sold the trojan. The lines the DOJ is saying were crossed are pretty bright.

Post by tptacek » Fri, Aug 04, 2017, 8:26 PM UTC

zippy wrote: post #83

tptacek wrote: post #54

Earlier quoted context omitted.

What legitimate security research are we talking about? I work in vulnerability research and not malware research, but: can we name anyone who has been prosecuted for what turned out to clearly be benevolent research work?

"can we name anyone who has been prosecuted for what turned out to clearly be benevolent research work?" Randal Schwartz https://en.wikipedia.org/wiki/Randal_L._Schwartz

Post by watty » Fri, Aug 04, 2017, 8:27 PM UTC

jxcole wrote: post #71

mnarayan01 wrote: post #51

As someone who's not sure where I stand on this, I feel like Hutchins supporters are doing themselves a disservice by overly-conflating this with WannaCry. I think there's potentially a good argument to be made along the lines of "Hutchins good work w.r.t. WannaCry is the only reason that anyone (including law enforcement) is aware of semi-historical Kronos, so going after him for Kronos is equivalent to going after…

I don't think that's what these researchers are saying. I think they are saying more along the lines of: "Hutchins has shown that he is a security researcher through his work on wannacry. As a security researcher, he probably has researched other problems as well, possibly including Kronos. The fact that he was arrested with little to no evidence could be showing that the DOJ is willing to arrest people who have copi…

Post by wildmusings » Fri, Aug 04, 2017, 8:27 PM UTC

tptacek wrote: post #94

wildmusings wrote: post #90

Earlier quoted context omitted.

As to your first example, there seems to be this pervasive idea in tech culture that something shouldn't be a serious crime or tort because it is so easy to do. I see the argument very often in cases of unauthorized access and copyright infringement. Murder is also rather easy, and we execute people for it.

That's not what he's saying. He's saying that independent of how easy it is to do, it's also something that professional security people do routinely. And he's right. But that's not the basis of the charge against Aurenheimer.

Post by tptacek » Fri, Aug 04, 2017, 8:28 PM UTC

wildmusings wrote: post #97

tptacek wrote: post #94

Earlier quoted context omitted.

That's not what he's saying. He's saying that independent of how easy it is to do, it's also something that professional security people do routinely. And he's right. But that's not the basis of the charge against Aurenheimer.

> That's not what he's saying. He's saying that independent of how easy it is to do, it's also something that professional security people do routinely. And he's right. But that's not the basis of the charge against Aurenheimer. It's certainly part of what he said: > but it also wasn’t exactly hardcore hacking; IIRC he just changed a URL parameter. The difficulty of carrying out an action is completely irrelevant to…