Slashdot Mirror
Researcher Who Stopped WannaCry Pleads Not Guilty to Creating Banking Malware (vice.com)
Lorenzo Franceschi-Bicchierai, reporting for Motherboard: Monday, the well-known security researcher who became famous after helping to stop the destructive WannaCry ransomware outbreak pleaded "not guilty" to creating software that would later become banking malware. Marcus Hutchins -- better known by his online nickname MalwareTech -- was arrested in early August in Las Vegas after the hacking conference Def Con. The US government accuses Hutchins of writing software in 2014 that would later become the banking malware Kronos. After getting out on bail and traveling to Milwaukee, he stood in front a judge on Monday for his arraignment. Prosecutors also allege he helped a still unknown co-defendant market and sell Kronos. Hutchins's lawyer Brian Klein declared in a packed courtroom in Milwaukee that Hutchins was "not guilty" of six charges related to the alleged creation and distribution of malware. Hutchins will be allowed to travel to Los Angeles, where he will live while he awaits trial. He will also be represented by Marcia Hoffman, formerly of the Electronic Frontier Foundation. Under the terms of his release, Hutchins will be tracked by GPS but will be allowed full internet access so he can continue to work as a security researcher; the only restriction is he will no longer be allowed to access the WannaCry "sinkhole" he used to stop the outbreak of ransomware.
This is very fishy.....
get arrested, well thats a way to incentivise Canadian conferences...
>> Let's incarcerate them for the rest of their lives or put a few of them to death.
Found the consultant working in Dubai.
I would have expected this plea regardless of facts. I can't wait to read more on this as it becomes available. Right now, we have speculation on one side and little except the indictment on the other.
Needs way more information to start making informed opinions.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
I'm looking forward to the sequel to "Catch Me If You Can" in 10 years after this guy helps the feds out. And why not use him in such a way? He seems to have at least some conscience that he's stopped a threat, so he can be marginally trusted.
This looks like one of those cases when someone was not fully willing to 'cooperate' with certain people and then the FBI is 'tipped off' with some very bogus evidence. I'm speculating, of course, but anyway that's how it looks to me.
Please feel free to tour our luxurious private prisons!
Stay awhile...
STAY FOREVER!
I wonder if he stopped or interfered with an NSA false-flag and is being pinned for it...
He should have taken a little drive north while he was in Milwaukee and then he could have fought extradition while living at home in the UK.
I can't believe he's being treated this way. You'd think that after what he did for THE WORLD by deactivating WCry, they'd let him go.. but nooooo they have to throw him in a courtroom and try to convict him of ... what? Writing malware that never touched an American computer and that he never executed? What is this shit?
640k ought to be enough for anyone.
Are we not all being tracked by GPS or other means?
Why is this some sort of safety measure?
Monday, the well-known security researcher
I thought he was called Marcus.
systemd is Roko's Basilisk.
"Hutchins will be tracked by GPS but will be allowed full internet access so he can continue to work as a security researcher"
Sounds like they don't have much of a case, otherwise they would be screeching about how he was a flight risk and a danger to society. I'm guessing their case is something like "he developed part of the tool that was eventually used in a bank heist". Which could be like charging the manufacturer of a large drill with conspiracy because one of their drills had been used in a physical bank robbery even if they had never interacted with the actual robbers on any level.
They are alleging that "he was the author of the code that became the Kronos malware"... even if this allegation were true, that should be entirely irrelevant if he neither authored the Kronos malware nor assisted in its distribution.... heck, by that reasoning, practically every computer programming language creator ever should be held accountable for "writing software that would eventually become malware" as well... because essentially, that's what would be amounted to by what they were saying.
You can't justly hold an inventor of a technology accountable for how nefarious people might use it unless you can reasonably demonstrate that there was some kind of cooperation between the inventor and the people that committed the wrongdoing.
Why not hold the parents responsible for breeding in the first place if their child grows up and becomes a murderer?
Gawd, there are so many things wrong with this entire thing, I can barely believe that this trial is actually happening. It is just so fucked up that I don't have the words...
File under 'M' for 'Manic ranting'
Usually it comes down to "intent" to distribute malware or cause harm. It's the magic legal word. In extreme cases "gross negligence" (bigly sloppy) comes into play, but usually carries rather short sentences.
Hillary probably avoided "gross negligence" by not being given proper training by the Department. (The "briefing" was not a full training session; otherwise it would not be called a "briefing".) The issue there seemed to be a combination of "medium" negligence by many staff members, Hillary is just one. Bunches of people should have been at least slapped with a fine in my opinion.
Table-ized A.I.
"Hutchins will be tracked by GPS but will be allowed full internet access so he can continue to work as a security researcher; the only restriction is he will no longer be allowed to access the WannaCry "sinkhole" he used to stop the outbreak of ransomware."
That tells you everything you need to know.
1. WannaCry used the code from the leaked NSA software.
2. WannaCry included code that looked to check if a specified domain had been registered. If it received a response from the domain, it shut down. If not, it continued to work.
3. The "sinkhole" domain bricked the NSA software and interfered with ongoing ops.
4. Tracking the traffic to the "sinkhole" domain might allow you to determine which traffic was from the NSA software and which one was from the WannaCry variant thus exposing ongoing NSA ops.
'It's not paranoia when they are really out to get you'
By that logic, we should all stop posting code on Stack Overflow because we would all be as guilty just for simply posting code there in the first place. :-(
It was pretty suspicious that it was mostly affecting Russian banks. Seemed like a targetted attack against the Russians and now we have confirmation that the MAN has come down hard on this guy for interfering in an existing operation
**Life is too short to be serious**
The NSA also wrote software that was later used in banking hacks.
How about we establish guilt, and then debate the penalty based on culpability?
"So long and thanks for all the fish."
Nahhh, that sounds like the right thing to do. Too much work. Hang the guilty fucker, then sue his family and ruin them for 3 generation. /s
Should sue Microsoft for enabling malware throughout the world. The lost productivity when the system go down or forced to restart for updates.
Wouldn't be the first time someone wore both black and white hats during their career (or even both hats at the same time). Max Butler was responsible for stealing massive amounts of credit card and other personal data but was also at various points doing very much white-hat things.
Why travel to the US while there are good security conferences in Europe? Take Chaos Communication Congress every December, or the Dutch and German summer camps that take place at around the same time as DEF CON. I've just been to SHA2017, it was large, lots of fun and some really interesting talks.
17779 eligible voters in a district, 17779 'vote' as one. This is Russia.
The NSA was negligent in letting its tools be stolen, and they were used against banks.
Everybody has been ignoring the real point of this arrest (for those that forgot Dmititry Skylarov's case back between Defcon VIII and XII was it?)
Defcon is not a safe venue for real hackers, whichever color hat they don. Same with Blackhat the week before.
Future hacking conventions need to be done in a country with both no laws against it, as well as strong local law enforcement to deter kidnapping of suspects from the convention.