Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arrest of WannaCry researcher sends chill through security community

thehill.com

Post reply on HN
Print view View original

111–120 of 353 posts

Re: Arrest of WannaCry researcher sends chill through security community

#111

Post by ggggtez »

tptacek wrote: post #96
loeg wrote: post #91

Earlier quoted context omitted.

Yes, that's what they're saying. Consider the source.

I'm not convicting him, and if you put a gun to my head and forced me to render a verdict based on what's public now, I'd say "not guilty". What do you want from me? Cases like this unfold over time. We don't get to know everything we want to know the moment we want to know it.

The parent post thread is about why researchers were afraid as a result of the arrest. While it might unfold and get a not guilty, in the mean time he's in jail. If you were a malware researcher with good intentions, you might rightly think it's a mistake and one that could get you in the same kind of trouble.

Re: Arrest of WannaCry researcher sends chill through security community

#112

Post by sqeaky »

tptacek wrote: post #93
zippy wrote: post #83

Earlier quoted context omitted.

"can we name anyone who has been prosecuted for what turned out to clearly be benevolent research work?" Randal Schwartz https://en.wikipedia.org/wiki/Randal_L._Schwartz

Yeah, I think you'll find when you dig into the details that that case is not a great example for you.

Instead of doubt, can you give us concrete reasons?

Re: Arrest of WannaCry researcher sends chill through security community

#113

Post by us0r »

chasil wrote: post #3

Realistically, DEF CON should move to the Caribbean. Marcus Hutchins is a British citizen. Extradition before the event was feasible and would have been a far more honorable path than the snatch and grab that transpired. British security experts might insist on Grand Cayman for any further conferences in the Americas.

[0] is an interesting article about this. It doesn't matter where it is, if they want you they will get you. They have done this private plane on the runway thing a few times now.

> Seleznev, the identity thief who is the son of the Duma deputy, chose to vacation at a five-star resort in the Indian Ocean archipelago nation of the Maldives in 2014 precisely because it has no extradition treaty with the United States. U.S. officials got word and persuaded Maldives authorities to intercept Seleznev at the airport, where in a fast-paced operation he was bundled on a private plane to Guam

Personally - I think in this Hutchins case they just wanted a new hire.

http://hamodia.com/2017/04/02/u-s-sweeping-russian-hackers-b...

Re: Arrest of WannaCry researcher sends chill through security community

#114

Post by tptacek »

sqeaky wrote: post #112
tptacek wrote: post #93

Earlier quoted context omitted.

Yeah, I think you'll find when you dig into the details that that case is not a great example for you.

Instead of doubt, can you give us concrete reasons?

This is from memory, but it's been discussed on HN before, so you can also consult the search bar. Schwartz had a contract to do sysadmin work for Intel. In the course of doing that work, he backdoored some of the systems he worked on. After his employment with the firm that had staffed him at Intel concluded, he continued to use those backdoors to access Intel's systems. His claim is that it was necessary to do so, in order to complete work Intel had asked him to do. But from what I recall, he was caught using those backdoors after any relationship he'd had with Intel had been severed.

It's not the crime of the century, but it's not a case of someone doing benevolent security research getting caught. Nobody practicing today would backdoor a client computer, use the backdoor after their engagement had ended, and expect anyone to find that action defensible.

Re: Arrest of WannaCry researcher sends chill through security community

#115

Post by tptacek »

ggggtez wrote: post #111
tptacek wrote: post #96

Earlier quoted context omitted.

I'm not convicting him, and if you put a gun to my head and forced me to render a verdict based on what's public now, I'd say "not guilty". What do you want from me? Cases like this unfold over time. We don't get to know everything we want to know the moment we want to know it.

The parent post thread is about why researchers were afraid as a result of the arrest. While it might unfold and get a not guilty, in the mean time he's in jail. If you were a malware researcher with good intentions, you might rightly think it's a mistake and one that could get you in the same kind of trouble.

My point isn't that I have a huge of trust and goodwill in the criminal justice system, but rather that almost nobody in the security community does the stuff that this person is accused of doing. Do you build banking trojans and then arrange for them to be sold to anonymous strangers on Darknet forums? If not: what does this case have to do with your security work?

Re: Arrest of WannaCry researcher sends chill through security community

#116

Post by mnarayan01 »

jxcole wrote: post #71
mnarayan01 wrote: post #51

As someone who's not sure where I stand on this, I feel like Hutchins supporters are doing themselves a disservice by overly-conflating this with WannaCry. I think there's potentially a good argument to be made along the lines of "Hutchins good work w.r.t. WannaCry is the only reason that anyone (including law enforcement) is aware of semi-historical Kronos, so going after him for Kronos is equivalent to going after…

I don't think that's what these researchers are saying. I think they are saying more along the lines of: "Hutchins has shown that he is a security researcher through his work on wannacry. As a security researcher, he probably has researched other problems as well, possibly including Kronos. The fact that he was arrested with little to no evidence could be showing that the DOJ is willing to arrest people who have copi…

I think this is also an argument with potential (at least when presented as here, i.e. without excessive reference to WannaCry), but I think you need to either have a decent amount of affirmative evidence against him having sold Kronos or to wait at least several days before using the DOJ's absence of presented evidence as evidence of absence.

W.r.t. the latter, I'm not saying that the DOJ should have had him arrested if it lacks serious evidence of his guilt. I'm saying that his arrest has happened; it's too late to stop it. The question is whether it should have happened, and, since we're highly unlikely to be able to change anything within a few days, it seems like it makes sense to wait a few days before asserting that the DOJ lacked evidence to support the arrest if only to avoid poising the well. If it turns out that they didn't have any evidence, then the arrest was a problem which needs to have consequences. But I think being over-eager at this point greatly lowers the probability of there being any such consequences.

Re: Arrest of WannaCry researcher sends chill through security community

#117

Post by [deleted] »

aphextron wrote: post #80
tetrep wrote: post #37

Earlier quoted context omitted.

> He's not a "hacker" who is doing security research, he's a malware creator selling malware. There's no reason he can't be both. We can both like him for stopping WannaCry, and dislike him for (if true) marketing/distributing malware based on Kronos. Although I agree with your general sentiment, I'm confused as to why the security community is chilled by this. The court case should be public, so we'll be able to jud…

>The court case should be public, so we'll be able to judge the evidence ourselves. Well this is still the United States, so by law it will be. People are blowing this way out of proportion as if he were disappeared by the secret police or something.

[deleted]

Re: Arrest of WannaCry researcher sends chill through security community

#118

Post by tptacek »

pw wrote: post #106
tptacek wrote: post #62

Earlier quoted context omitted.

You think the FBI is going to interdict a computer criminal before they spend a week in Las Vegas associating with computer security professionals, any of whom could be criminal co-conspirators?† That would be exceptionally nice of them, but also extremely poor investigative practice. I will say, though, as one of the many people in my field that is bone-tired of schlepping out to the worst place in the United States…

So I take it you're not a fan of Vegas?

I have friends who live there and don't want to talk shit about the real city of Las Vegas where people actually live, but the part of Las Vegas that Black Hat and Defcon drag us to every year is probably the worst place in the country.

Re: Arrest of WannaCry researcher sends chill through security community

#119

Post by [deleted] »

cargo8 wrote: post #75
tptacek wrote: post #47

Earlier quoted context omitted.

Hutchins is accused of creating the Kronos trojan, and of working closely with someone who sold the trojan. The lines the DOJ is saying were crossed are pretty bright.

If I write open source code for research, share it with the community, and someone wants to license it for "further research" and pays me – am I responsible if their adapted software is then used / stolen / re-applied to kill people or hack a bank? In this scenario I both wrote and explicitly sold the software with no idea of what the later applied tech would do. The computer laws referenced in the article seem to re…

[deleted]

Re: Arrest of WannaCry researcher sends chill through security community

#120

Post by notatoad »

natch wrote: post #84
tptacek wrote: post #47

Earlier quoted context omitted.

Hutchins is accused of creating the Kronos trojan, and of working closely with someone who sold the trojan. The lines the DOJ is saying were crossed are pretty bright.

It bears mentioning that accused does not mean convicted. The DOJ record as far as accusations turning out to be grounded in reality is not unblemished. >Hutchins is accused of creating the Kronos trojan, and of working closely with someone who sold the trojan. The lines the DOJ is saying were crossed are pretty bright. You say that as though you are contradicting NateJay. But the fear NateJay is highlighting is exac…

A white hat is being accused of black hat behaviour. There is no indication that the government is seeking to charge him with any activities related to behaviour that could be interpreted as "white hat" in any way. He's accused of creating and distributing malware. He may be found innocent of that, but the crimes he is accused of are very definitely crimes, and he shouldn't get a pass just because he's been publicly acting as a white hat.

If the government has evidence, he should be charged and tried. And that appears to be what's happening here.

Post reply on HN