Live data from Hacker News

Arrest of WannaCry researcher sends chill through security community

thehill.com

271–280 of 353 posts

Re: Arrest of WannaCry researcher sends chill through security community

#271
post #164

Earlier quoted context omitted.

Not a good anology. What's a legitimate use for banking malware? A more apt analogy would be selling an IED.

Hmmm. What are the legitimate uses for firearms again?

Hunting, pest control, shooting sports, self-defense, various other rural stuff.

Re: Arrest of WannaCry researcher sends chill through security community

#272

Perhaps you are being deliberately obtuse I'm not sure. The point the poster was making is that the US happily arrests foreigners who set foot in the US and regardless of your guilt or innocence you get trapped in the US justice system which is essentially a system to tie you up in court and legal processes that you cannot afford so that you accept a plea deal, possibly for something you have not done, because otherw…

> Perhaps you are being deliberately obtuse I'm not sure

We've given you countless warnings about incivility. It's time you fixed this or stopped commenting here.

We detached this subthread from https://news.ycombinator.com/item?id=14931485 and marked it off-topic.

Re: Arrest of WannaCry researcher sends chill through security community

#273

Earlier quoted context omitted.

My point isn't that I have a huge of trust and goodwill in the criminal justice system, but rather that almost nobody in the security community does the stuff that this person is accused of doing. Do you build banking trojans and then arrange for them to be sold to anonymous strangers on Darknet forums? If not: what does this case have to do with your security work?

It seems to me that this is kind of a litmus situation - this case reveals what you think of the DOJ. If you think that they somewhat routinely frame people that they are "after", then you look at the fact of the accusation and see this case as more proof that security researchers should be cautious (and maybe avoid entering the US). On the other hand, if you think that the DOJ, while subject to making mistakes, does…

It doesn't matter too much if the DOJ doesn't knowingly frame people.

They come down hard and they come down heavy on the wrong people, ruining lives. They also pile ridiculous charges even on those who are guilty of minor crimes, threatening to bury them in an avalanche of charges unless they settle. They also seem to be really ignorant of technology, and show a deep suspicion of anything that they don't understand.

Whether this bullying is because they are out of their depth, have a culture of recklessness, or some other reason doesn't matter to those who end up in their crosshairs. If you are a bank fixing Libor, or money laundering (UBS), or are involved in any number of frauds in the financial crisis, you are treated with kid gloves. But if software or encryption is involved, then the sirens wail, SWAT teams gather, and the fear campaign begins.

Re: Arrest of WannaCry researcher sends chill through security community

#274

Earlier quoted context omitted.

A white hat is being accused of black hat behaviour. There is no indication that the government is seeking to charge him with any activities related to behaviour that could be interpreted as "white hat" in any way. He's accused of creating and distributing malware. He may be found innocent of that, but the crimes he is accused of are very definitely crimes, and he shouldn't get a pass just because he's been publicly…

> There is no indication that the government is seeking to charge him with any activities related to behaviour that could be interpreted as "white hat" in any way. There is only the thinnest of lines between the two. White hats have to traffic in malware and exploits because it's necessary to understand a threat in order to defend against it, and in order to test that your defenses are effective. In may even be neces…

Wait, what?

How does a person accused of development and direct distribution of malware qualify as a white hat? Because he pulled the plug on some ransomware and put his name in global households?

There are a lot of logic jumps here that you have simply glossed over.

Re: Arrest of WannaCry researcher sends chill through security community

#275

Earlier quoted context omitted.

Link to the Orin Kerr article: https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... Orin Kerr's analysis is excellent and made me consider the accused party's intent and the difference between selling code versus using code.

He makes great points, but I intuitively feel like certain acts of creating and selling malware should be illegal, even if only by the spirit and not the letter of the law. If someone manufactures guns, doesn't register them, and knowingly sells them to street gangs, it kind of seems like they're aiding and abetting illegal activities for profit. Of course there are instances of selling malware you created to parties…

Some malware uses libcurl. Does that make its creator a criminal?

Re: Arrest of WannaCry researcher sends chill through security community

#276
post #272

Perhaps you are being deliberately obtuse I'm not sure. The point the poster was making is that the US happily arrests foreigners who set foot in the US and regardless of your guilt or innocence you get trapped in the US justice system which is essentially a system to tie you up in court and legal processes that you cannot afford so that you accept a plea deal, possibly for something you have not done, because otherw…

> Perhaps you are being deliberately obtuse I'm not sure We've given you countless warnings about incivility. It's time you fixed this or stopped commenting here. We detached this subthread from https://news.ycombinator.com/item?id=14931485 and marked it off-topic.

Incivility?

Re: Arrest of WannaCry researcher sends chill through security community

#277
post #3

Realistically, DEF CON should move to the Caribbean. Marcus Hutchins is a British citizen. Extradition before the event was feasible and would have been a far more honorable path than the snatch and grab that transpired. British security experts might insist on Grand Cayman for any further conferences in the Americas.

I'm pretty sure every year someone arrested because they attended DEF CON. Considering the US are one of the main countries seeking out and arresting cyber criminals why on earth is the main security conference in the world in what could be considered a hostile country.

A case of smart people doing stupid things.

Re: Arrest of WannaCry researcher sends chill through security community

#278

Earlier quoted context omitted.

The arrest of a mall cop who wasn't proved to be doing burglaries might send a chill, no?

Arrest is an early step in a process to prove guilt or acquit. The "burglary" did occur, and a grand jury did examine evidence and determine it was sufficient to start that process.

A couple of your friends get arrested. Do you think about it a little bit?
Post reply on HN