Researcher Who Stopped WannaCry Pleads Not Guilty to Creating Banking Malware (vice.com) 71
Lorenzo Franceschi-Bicchierai, reporting for Motherboard: Monday, the well-known security researcher who became famous after helping to stop the destructive WannaCry ransomware outbreak pleaded "not guilty" to creating software that would later become banking malware. Marcus Hutchins -- better known by his online nickname MalwareTech -- was arrested in early August in Las Vegas after the hacking conference Def Con. The US government accuses Hutchins of writing software in 2014 that would later become the banking malware Kronos. After getting out on bail and traveling to Milwaukee, he stood in front a judge on Monday for his arraignment. Prosecutors also allege he helped a still unknown co-defendant market and sell Kronos. Hutchins's lawyer Brian Klein declared in a packed courtroom in Milwaukee that Hutchins was "not guilty" of six charges related to the alleged creation and distribution of malware. Hutchins will be allowed to travel to Los Angeles, where he will live while he awaits trial. He will also be represented by Marcia Hoffman, formerly of the Electronic Frontier Foundation. Under the terms of his release, Hutchins will be tracked by GPS but will be allowed full internet access so he can continue to work as a security researcher; the only restriction is he will no longer be allowed to access the WannaCry "sinkhole" he used to stop the outbreak of ransomware.
Fishy (Score:3, Interesting)
This is very fishy.....
Re: (Score:2)
Is WannaCry an inside job?
Seems Wannacry was NSA afterall (Score:2)
It was pretty suspicious that it was mostly affecting Russian banks. Seemed like a targetted attack against the Russians and now we have confirmation that the MAN has come down hard on this guy for interfering in an existing operation
Re: (Score:2)
Found the consultant working in Dubai.
Re: Now throw the book at him (Score:3)
How about we establish guilt, and then debate the penalty based on culpability?
travel to the USA... (Score:2, Insightful)
get arrested, well thats a way to incentivise Canadian conferences...
Re: (Score:1)
Sadly Canada takes a less the friendly view to American visitors. Something like 17-20% of Americana has been convicted of driving under the influence making them ineligible for entry into Canada. The overwhelming majority of these cases are misdemeanor offenses. Felony DUI is a fairly rare and serious crime, but Canada treats misdemeanor offenders of this type as ineligible felons. That is of course unless you pay a fine to Canada to demonstrate you have been rehabilitated. What amounts to international do
Re: (Score:2)
You mock our insane criminal justice system but then go on to mock its victims
Re: travel to the USA... (Score:2)
You can 'bribe' your way into any country, even with criminal convictions. You apply for a visa, ahead of time, and pay the applicable fees. Even murderers travel internationally, if they have the money. Depending on your past, they will just ask for more money.
Re: (Score:2)
Felony DUI is a fairly rare and serious crime, but Canada treats misdemeanor offenders of this type as ineligible felons
That's because in Canada it's considered an I/O or indictable offence, or felony for you americans. In canada only the feds can have felony law, and it's universally applied across the country. It's not double jepordy though, you were never tried under Canuck law.
Re: (Score:2)
Sadly Canada takes a less the friendly view to American visitors. Something like 17-20% of Americana has been convicted of driving under the influence making them ineligible for entry into Canada. The overwhelming majority of these cases are misdemeanor offenses. Felony DUI is a fairly rare and serious crime, but Canada treats misdemeanor offenders of this type as ineligible felons.
The US is only marginally better. Official US government policy is that one DUI isn't a problem for visitors, but 2 or more can get your entry denied. Conviction on any drug offense is grounds for denying admission, although potential visitors do have the ability to ask for a waiver in advance. As always, there are no guarantees that a waiver will be given if applied for.
Expected regardless (Score:5, Interesting)
I would have expected this plea regardless of facts. I can't wait to read more on this as it becomes available. Right now, we have speculation on one side and little except the indictment on the other.
Needs way more information to start making informed opinions.
Re: Expected regardless (Score:2, Interesting)
More information is needed for an informed opinion but I'll still make a guess that the NSA is pissed that he stopped their malware from working.
Re: (Score:3)
Who says they'd put up a way for the victims to unlock their machines?
It becomes ransomware when the distributor wants to make money. It becomes a cyberweapon when the distributor wants to take someone down hard.
Re: (Score:2)
It becomes ransomware when the distributor wants to make money. It becomes a cyberweapon when the distributor wants to take someone down hard.
How is ransomware not a cyberweapon?
Re: (Score:2)
Re: Expected regardless (Score:1)
I like your generic statement. You can pretty much post this anywhere involving a court case.
Maybe he says the truth (Score:4, Insightful)
Re: (Score:2)
Things that make you go hmmm (Score:2)
I wonder if he stopped or interfered with an NSA false-flag and is being pinned for it...
Should have driven to Canada... (Score:2)
He should have taken a little drive north while he was in Milwaukee and then he could have fought extradition while living at home in the UK.
Re: (Score:2)
I doubt that would have worked out. That "little drive north" would be into Canada, which is most definitely not the UK. (Canada is an independent nation with its own laws and policies, believe it or not.) There's no guarantee he would be allowed in to Canada. (UK citizens are refused entry all the time.) If the CBSA folks are aware of the bail conditions, there's a good chance that would be reason to turn him back. Of course, he could try walking across the border and avoiding the border stations, but that
Poor Marcus (Score:1)
Re: (Score:3, Interesting)
> What is this shit?
You wrote it yourself just prior:
> what he did for THE WORLD by deactivating WCry
He messed with some probably very active NSA malware.
Re: (Score:3)
Yep, I hope everyone's learned an important lesson here about doing the "right thing".
Remember, no good deed ever goes unpunished.
The next time you see malware about to destroy all of civilization, and you could deactivate it, don't. It's not worth it. You won't be helping yourself, and you'll end up being severely punished for your trouble.
His name's Monday? (Score:5, Funny)
Monday, the well-known security researcher
I thought he was called Marcus.
You can tell a lot from pretrial stuff (Score:2, Insightful)
"Hutchins will be tracked by GPS but will be allowed full internet access so he can continue to work as a security researcher"
Sounds like they don't have much of a case, otherwise they would be screeching about how he was a flight risk and a danger to society. I'm guessing their case is something like "he developed part of the tool that was eventually used in a bank heist". Which could be like charging the manufacturer of a large drill with conspiracy because one of their drills had been used in a physica
Re: (Score:2)
I'm guessing their case is something like "he developed part of the tool that was eventually used in a bank heist". Which could be like charging the manufacturer of a large drill with conspiracy because one of their drills had been used in a physical bank robbery even if they had never interacted with the actual robbers on any level.
Very close. I think it's more like a guy buying a heavy-duty drill and hardened drill bits, and receiving generic advice about the best ways to drill through hardened steel from the owner of a hardware store, and then said guy breaks into a bank safe and robs it, and the government going after the hardware store owner as an accessory to the crime.
And yes, I also believe Hutchins is being punished for interfering in a US TLA operation in which WCry was a part. Need to start doxing the top brass of US TLAs
Re: (Score:2)
Either/or. It's a distinction without much difference.
Strat
Wait... what? (Score:4, Insightful)
They are alleging that "he was the author of the code that became the Kronos malware"... even if this allegation were true, that should be entirely irrelevant if he neither authored the Kronos malware nor assisted in its distribution.... heck, by that reasoning, practically every computer programming language creator ever should be held accountable for "writing software that would eventually become malware" as well... because essentially, that's what would be amounted to by what they were saying.
You can't justly hold an inventor of a technology accountable for how nefarious people might use it unless you can reasonably demonstrate that there was some kind of cooperation between the inventor and the people that committed the wrongdoing.
Why not hold the parents responsible for breeding in the first place if their child grows up and becomes a murderer?
Gawd, there are so many things wrong with this entire thing, I can barely believe that this trial is actually happening. It is just so fucked up that I don't have the words...
"Intent" [Re:Wait... what?] (Score:1)
Usually it comes down to "intent" to distribute malware or cause harm. It's the magic legal word. In extreme cases "gross negligence" (bigly sloppy) comes into play, but usually carries rather short sentences.
Hillary probably avoided "gross negligence" by not being given proper training by the Department. (The "briefing" was not a full training session; otherwise it would not be called a "briefing".) The issue there seemed to be a combination of "medium" negligence by many staff members, Hillary is just one
Re: (Score:2)
There was never an intent requirement in the classified information law. That was just special Clinton 'justice' applied by the Obama administration. Nobody else gets that.
Re: (Score:1)
You are making that up. And, it was singular. State Dept. confirmed there was no record she attended the FORMAL class.
Re: (Score:1)
Here's a link. [mediaite.com]
It doesn't explain why she missed the training course(s). Normally a CEO has assistants to make sure such appointments are scheduled and kept. I wouldn't expect a CEO or equivalent to micromanage such scheduling all themselves. Therefore, the failure was a team effort. Yes, she "should have" found a way, but "should have" is not the same as "gross negligence".
Re: (Score:2)
Just because you sold software on "criminal" forums does not mean you knew the person(s) were criminals.
The legal phrase is "knew or should have known". It's not necessary that you have actual knowledge of their criminal history or plans, only that a reasonable person in your place should have known. This isn't true for all criminal statutes that involve knowledge or intent, but it is true of most.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
IANAL, but there is a legal thing called negligent culpability. If I sell you 2 tons of TNT, under dont-ask-dont-tell terms, and you blow up a school with it, I could be held to be negligent in my duty to attempt to determine that the customer had a legitimate use for it (even if they did end up using it to blow up a school).
If, however, you gave me some evidence that you had a legitimate use (e.g., you wanted to ship it to a construction company that does demolition work and that company has a Dun/Bradstr
Conspiracy Theory (Score:5, Insightful)
"Hutchins will be tracked by GPS but will be allowed full internet access so he can continue to work as a security researcher; the only restriction is he will no longer be allowed to access the WannaCry "sinkhole" he used to stop the outbreak of ransomware."
That tells you everything you need to know.
1. WannaCry used the code from the leaked NSA software.
2. WannaCry included code that looked to check if a specified domain had been registered. If it received a response from the domain, it shut down. If not, it continued to work.
3. The "sinkhole" domain bricked the NSA software and interfered with ongoing ops.
4. Tracking the traffic to the "sinkhole" domain might allow you to determine which traffic was from the NSA software and which one was from the WannaCry variant thus exposing ongoing NSA ops.
'It's not paranoia when they are really out to get you'
Re: (Score:1)
Just because you're paranoid, doesn't mean they're not out to get you.
Basically I think that this is the most likely explanation.
NSA is pissed that he fucked with their little exploit, and this is their way of taking revenge.
The nice thing is that his government doesn't even step in to put an end to this madness.
Really puts things in perspective.
Researchers should never travel to the US.
Maybe he is guilty of the banking thing... (Score:2)
Wouldn't be the first time someone wore both black and white hats during their career (or even both hats at the same time). Max Butler was responsible for stealing massive amounts of credit card and other personal data but was also at various points doing very much white-hat things.
Alternative conferences in Europe (Score:3)
Why travel to the US while there are good security conferences in Europe? Take Chaos Communication Congress [wikipedia.org] every December, or the Dutch and German summer camps that take place at around the same time as DEF CON. I've just been to SHA2017 [sha2017.org], it was large, lots of fun and some really interesting talks.
Why doesn't the FBI arrest the NSA? (Score:1)
The NSA was negligent in letting its tools be stolen, and they were used against banks.