Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arrest of WannaCry researcher sends chill through security community

thehill.com

Post reply on HN
Print view View original

221–230 of 353 posts

Re: Arrest of WannaCry researcher sends chill through security community

#221

Post by [deleted] »

DuskStar wrote: post #180
tptacek wrote: post #76

Earlier quoted context omitted.

I follow what you're saying, but look at these cases: Aurenheimer was confronted with IRC logs in which he discussed selling the information he got from the website, and Barrett Brown was accused of actively assisting the people who breached Stratfor. What ever you think of the actual prosecutions here, neither of those are cases of security research being mistaken for something else. The most you can say, for instan…

Regarding Weev, should planning on selling the data really affect the legality of his behavior? I mean, there are services that sell data they scrape from websites after all.

[deleted]

Re: Arrest of WannaCry researcher sends chill through security community

#222

Post by ddlsmurf »

natch wrote: post #84
tptacek wrote: post #47

Earlier quoted context omitted.

Hutchins is accused of creating the Kronos trojan, and of working closely with someone who sold the trojan. The lines the DOJ is saying were crossed are pretty bright.

It bears mentioning that accused does not mean convicted. The DOJ record as far as accusations turning out to be grounded in reality is not unblemished. >Hutchins is accused of creating the Kronos trojan, and of working closely with someone who sold the trojan. The lines the DOJ is saying were crossed are pretty bright. You say that as though you are contradicting NateJay. But the fear NateJay is highlighting is exac…

There is a due process to catch an ally's civilian, that's called an extradition, that process is important.

Re: Arrest of WannaCry researcher sends chill through security community

#223

Post by cargo8 »

hmahncke wrote: post #169
cargo8 wrote: post #75

Earlier quoted context omitted.

If I write open source code for research, share it with the community, and someone wants to license it for "further research" and pays me – am I responsible if their adapted software is then used / stolen / re-applied to kill people or hack a bank? In this scenario I both wrote and explicitly sold the software with no idea of what the later applied tech would do. The computer laws referenced in the article seem to re…

honest question: if your code is open source, why would someone pay you for further research? why would you charge for that?

I was being a bit of a devil's advocate, altho didn't quite get the responses I hoped for. I suppose I didn't phrase it quite right since I don't have significant knowledge about this case other than the article.

It seems like the arrest is a bit aggressive, but so is the response – clearly out of fear and uncertainty of the govt and general time we live in. Hopefully more transparency will bring light to the allegations and reassure the innocent of their safety

Re: Arrest of WannaCry researcher sends chill through security community

#224

Post by syshum »

tptacek wrote: post #201
mattnewton wrote: post #181

Earlier quoted context omitted.

There is evidence that he was a white hat hacker now, and that is enough for current white hat hackers to be worried.

I don't know what these terms even mean. "White hat hacker"? Is that what we call "everyone who does anything in infosec but doesn't sell stolen financial information obtained from botnets"? The attempt to divide the whole world into "people irrationally attacking 'hackers' and 'the good kind of hackers'" isn't doing anyone any favors. If Hutchins has nothing to do with a criminal conspiracy to profit from a truly aw…

>People love to talk about how the FBI has a history of framing people --- and in other fields they might. But there is no track record I'm aware of for the FBI to make up a story like this out of whole cloth.

No? It is fairly common in Terrorism cases. I fail to see why they could not do it for Cyber Crime as well

https://www.techdirt.com/articles/20120917/05193620404/fbi-c...

https://www.nytimes.com/2016/06/08/us/fbi-isis-terrorism-sti...

https://www.techdirt.com/articles/20150316/17433230331/fbi-p...

https://www.techdirt.com/articles/20140722/14463127971/repor...

Want more?

Re: Arrest of WannaCry researcher sends chill through security community

#225

Post by syshum »

comex wrote: post #187
eecc wrote: post #168

Earlier quoted context omitted.

So you're basically saying that if the police took him there must be a good reason for that to happen therefore guilty as charged. You have a peculiar interpretation of justice, one that makes you pretty much like those that liked to burn people on fire pyres on the basis of allegations made by socially relevant people.

Being burned at stake would count as "having one's liberty taken away", and is therefore a case where, as I said, "innocent until proven guilty" is the appropriate standard. Why is it the appropriate standard? Because as a society, we believe that taking away an innocent person's liberty is far worse than letting a guilty person go free. For the expected value (in the statistical sense) of the legal system's benefit…

I am sure people like Richard Jewell would share belief that "as a bystander believe an innocent person is guilty, it's not as big a deal."

Innocent people have their lives for ever ruined with nothing more than false accusations, and not being found not guilty at trial does not change that.

Further I would like to see where you get your belief that police are correct 75% or more of the time.

It seems to me you have a very favorable opinion of the American legal System, this tells me you have very very limited first hand experience with it and like view of from rose colored world view never having known anyone personally that has been ground down to nothing by this system that is IMO largely unethical

Re: Arrest of WannaCry researcher sends chill through security community

#226

Post by syshum »

abduhl wrote: post #123
syshum wrote: post #65

Earlier quoted context omitted.

The FBI claims he created malware, an unnamed co-conspirator is charged with selling it So you generally believe people are guilty until proven innocent, and I always believe people are innocent until they are proven guilty. I never take the government word for anything, and generally assume the government is lying at all times. History supports my position. I find it extremely alarming how quickly people just believ…

> I never take the government word for anything, and generally assume the government is lying at all times. History supports my position. Do you habitually eat food that has been left out for longer than government guidelines allow because you generally assume the government is lying at all times ? Do you increase your speed when you see a sign that says REDUCE SPEED, SHARP TURNS AHEAD because you generally assume th…

there is no federal law or guidelines, or requirement for expiration dates on anything but infant formula, and I do not consume or buy infant formula

Those are completely Voluntary and used for Stock Control not food safety

As to speed limits and sharp turns I drive for the road conditions for the most part, so no I do not always slow down around sharp turns unless there is a posted speed limit for the turn for which I would be subject to arrest or fine for violating.

Re: Arrest of WannaCry researcher sends chill through security community

#227

Post by rdtsc »

natch wrote: post #84
tptacek wrote: post #47

Earlier quoted context omitted.

Hutchins is accused of creating the Kronos trojan, and of working closely with someone who sold the trojan. The lines the DOJ is saying were crossed are pretty bright.

It bears mentioning that accused does not mean convicted. The DOJ record as far as accusations turning out to be grounded in reality is not unblemished. >Hutchins is accused of creating the Kronos trojan, and of working closely with someone who sold the trojan. The lines the DOJ is saying were crossed are pretty bright. You say that as though you are contradicting NateJay. But the fear NateJay is highlighting is exac…

You know why it's called a hat? Cause you can take it off and put another one on. Or even be extra silly and wear two or more at the same time. It's tongue in cheek but there is some truth there.

In this case he was selling malware so I think this about a time when head gear was of a darker color...

Re: Arrest of WannaCry researcher sends chill through security community

#228

Post by mirimir »

Leaving aside the particulars of this case, I must say that anyone who does anything that might plausibly be prosecuted ought to remain anonymous, and practice good OPSEC. In researching an article about such issues, just about every bust was the result of carelessness.

Re: Arrest of WannaCry researcher sends chill through security community

#229

Post by brainfire »

watty wrote: post #17

I've read a few articles but I feel like I'm missing something. What's with the sensational quotes like "I had folks afraid that their own involvement in investigating WannaCry would get them arrested."? Everything I've read points that he created banking Malware "Kronos" which was sold on various "underground forums" (whatever that means). What's with the WannaCry conspiracies? He wasn't arrested for being a securit…

People love a "lone hero" story and journalists/Twitter personalities are trying to squeeze as much milage as they can out of the genius who saved the entire world from malware.

Re: Arrest of WannaCry researcher sends chill through security community

#230

Post by pharrington »

DuskStar wrote: post #180
tptacek wrote: post #76

Earlier quoted context omitted.

I follow what you're saying, but look at these cases: Aurenheimer was confronted with IRC logs in which he discussed selling the information he got from the website, and Barrett Brown was accused of actively assisting the people who breached Stratfor. What ever you think of the actual prosecutions here, neither of those are cases of security research being mistaken for something else. The most you can say, for instan…

Regarding Weev, should planning on selling the data really affect the legality of his behavior? I mean, there are services that sell data they scrape from websites after all.

Conspiracy to commit crime is a crime in the US.
Post reply on HN