Slashdot Mirror
Marcus Hutchins' Code Used In Malware May Have Come From GitHub (itwire.com)
troublemaker_23 quotes ITWire: A security researcher says code has been discovered that was written by British hacker Marcus Hutchins that was apparently 'borrowed' by the creator of the banking trojan Kronos. The researcher, known as Hasherezade, posted a tweet identifying the code that had been taken from Hutchins' repository on GitHub.
Hasherezade also found a 2015 tweet where a then-20-year-old Hutchins first announces he's discovered the hooking engine he wrote for his own blog -- being used in a malware sample. ("This is why we can't have nice things," Hutchins jokes.) Hasherezade analyzed Kronos's code and concluded "the author has a prior knowledge in implementing malware solutions... The level of precision lead us to the hypothesis, that Kronos is the work of a mature developer, rather than an experimenting youngster."
Monday on Twitter Hutchins posted that "I'm still on trial, still not allowed to go home, still on house arrest; but now I am allowed online. Will get my computers back soon."
Hasherezade also found a 2015 tweet where a then-20-year-old Hutchins first announces he's discovered the hooking engine he wrote for his own blog -- being used in a malware sample. ("This is why we can't have nice things," Hutchins jokes.) Hasherezade analyzed Kronos's code and concluded "the author has a prior knowledge in implementing malware solutions... The level of precision lead us to the hypothesis, that Kronos is the work of a mature developer, rather than an experimenting youngster."
Monday on Twitter Hutchins posted that "I'm still on trial, still not allowed to go home, still on house arrest; but now I am allowed online. Will get my computers back soon."
No, he's innocent until proven criminally negligent.
That makes zero sense. Criminally negligent on basis of what?
Ezekiel 23:20
and she wouldn't give it to me!
Nothing.. Nothing but innocently writing potentially malicious code can get you in trouble. Welcome to "america"! Land of the (not so) free! (We beat all the world in jail population!!)
All Heil GROUPTHINK
He left his car unattended with the engine running outside a bank where he knew a bank robbery was in progress. Then he acted shocked, shocked to find that his car was stolen and used as the getaway car.
more like he made a crowbar, which then someone else used it in a robbery... but you know your analogy is more self servant to your point.
Actually, what he did was more like planning the robbery, made that plan accessible to others, then acted surprised that someone used his plan to rob the bank.
Smith and Wesson have an awful lot to answer for then.
Not at all. There are plenty of legitimate uses for function hooking outside of malware. I know for a fact that the Windows driver for my audio card does it. And there are tons of examples of hooking code that predate his examples. Including Microsoft's own Detours: https://www.microsoft.com/en-us/research/project/detours/
Bullshit.
Let's apply this to 3D printing. If somebody makes public the designs and specifications to use some 3D printing hardware to print a functional firearm, for example, is the original publisher to be found liable for any deaths resulting from printed weapons? That's an incredibly slippery slope. We must not be so quick to suppose unlimited liability.
Actually it's more like he left his car outside a supermarket, locked and with the engine off, but in plain site so that everyone could see exactly what make it was. Then 3 years later a bank is robbed and the robbers got away in another car of the exact same make.
Bouncing through a stack buffer is not generally atomic in any way. Just pad your data to 8 to begin with.
If the code existed before on a public resource, it clearly raises a reasonable doubt.
Except that this is a criminal case, so "innocent until proven guilty" does apply, even to British citizens who have been illegally arrested by your benevolent government.
The old GTA3 era multiplayer mods, TES3: Morrowind's 3rd party graphics updates, all the work done to support windows 3.1/win9x era games on windows xp, vista, 7, and above.
All of these have required function hooking techniques and dll overrides in order to work. Many of them required because of microsoft changing the functional operation of existing functions rather than creating unique iterations of them/versioned libraries as they did with later dx9 releases (dx3-9 at least involved breakage of various core functions during directx upgrades, some of which caused whole classes of applications to break, whether due to non-standard usage of functions, improper documentation/examples on microsoft's part, or accidental breakage of functions later on which made it to release without being fixed.)
The result being that hooks and dll overrides are common for all sorts of legacy applications just to ensure they continue working.
Anyone else looking forward to the future world of chaos where anyone in malware research is by default a bad guy? It's GONNA BE GREAT.
This is the FBI, fer crissakes! The guys who were deeply, deeply penetrated by the Chinese military intelligence during the Clinton/Bush administrations (and are probably still in control). And then there is this: https://www.wired.com/2016/02/... http://www.cnn.com/2016/02/08/... http://fortune.com/2016/02/09/...
The code is code for a service intercept. Those can be tricky to get right, but are used in all manner of system enhancements, are not primarily useful for malware at all.
Intercept code I have used in the past:
* Added time, place, privilege level, and called-by-code conditions to file accesses
* Allowed file open to alter the running priority of processes
* Allowed failed access for some of the above to optionally open a different file, transparently
* Allowed files stored on backing storage (tape, network, disk, compressed files) to transparently appear local and present (or to be migrated to such storage)
* Allowed file extension or creation that would use space to trigger "get space" processes
* Allowed user mode undelete operations
* Allowed control of storage space use to minimize storage fragmentation
* Allowed controls based on access rate
These and more useful kinds of extensions are among things that can be implemented with an intercept. Not one of these has anything to do with malware.
So kindly stop and think a bit before claiming the code was done to help malware function.
Or, he just did it and is guilty.
Which is more likely, a malware analysis specialist creating software that just-so-happens to look like malware and be beneficial to the use-cases of malware being "borrowed" by someone to create malware in such a way that made it look like the analysis created the malware but actually didn't.
Or,
A malware analysis specialist created malware with his skills.
or because someone robbed a bank and was able to get away from the police even after they used spike strips, because they used run flat tires, and then they charged the inventor of run flat tires with being the robber when they couldn't find the actual robber.
or suing the inventor of the pogo stick because someone used one to beat someone to death.
"anyone in malware research is by default a bad guy" I guess it depends on why the person is researching malware. As it stands now all the "malware researches" are 6 steps behind those creating and deploying malware for criminal acts. From the guy sitting in his basement to the companies staffed with security "experts" it appears you only get post-mortems 6 months after a particularly damaging malware has been distributed far and wide. Nothing like locking the barn after the horse has already left and taken up residence in your house.
If you want to avoid being charged with a crime all you have to do is stop doing something you know is illegal. Mainly gaining access to any system that you have no business being in. Doesn't matter how easy it may be to hack someone's system that doesn't make it legal. If you want to show someone the vulnerabilities in their systems ask them before you proceed. The old "it's all for a good cause" excuse is not a legal defense. If you are a security guru but lack the intelligence needed to understand the pretty straight forward laws you should probably associate yourself with someone who does know the difference between right and wrong before you do something you will most likely regret when the FBI shows up at your house.
A malware developer not posting his malware on GitHub under his own name, I'd imagine.
Obviously you dont know what a hooking engine is. These pieces of code can be used in many things. It was not written for malware. Are we gonna say the creators of python programming language is responsible everytime someone sends malicious scripts to the interpreter?
GitHub is a million monkeys. Eventually, Marcus would write something that matches code that's already on github.
He's a proven maker of "hacking tools", so off to the slammer already.
Github is also a hoster of "hacking tools", so part of the conspiracy, and therefore needs a helping of that good old zero tolerance.
I'd love to go to America to visit yellow stone... but this kinda shit puts me off. Massive jails and anyone vaguely doing computer security is a criminal unless in top secret government 3 letter agency.
Plus the method he wrote already existed elsewhere, so although he wrote it they could still have got the function elsewhere if he hadn't.
It's about time we get some GPL'd malware! ;)
Anons need not reply. Questions end with a question mark.
Hardly, he designed a new bumper. Some one later built a car, used his design for the bumper and used the car in a robbery.
Wait, he's on house arrest in someone else's house?
Publishing hooking code (which is in no way, for or shape illegal and has perfectly legal uses). This is just the US police state thinking is does not even need to bother understanding the facts before trying to destroy somebodies life.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Not in the least. This is hooking code, not attack code.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Are we gonna say the creators of python programming language is responsible everytime someone sends malicious scripts to the interpreter?
Yes
With all of the incompetence shown in some of these comments, we should be grateful they even bothered with the court case at this point. If these idiots have their way, eventually just having possession of a compiler will be an illegal act because it could be used to make malware.
Translation: "What are you hiding!? I must assume you are guilty because authority said so and I'm a complete idiot."
There are plenty of reasons why a function hook is used. Hell the bioses of many computers used it to add support for hardware that the OS would have needed drivers written for. (Hell, on that note, Hardware Interrupts in general could be considered function hooks.) Most of the time a function hook is used because it's not the programmers code, or the source is unavailable, design limitations prohibit altering the existing code permanently, or because the original functionality is still needed in some cases.
Not all uses of function hooks are for malicious purposes. It's a normal programming technique, and labeling it as "evil" is tantamount to declaring all programming as "evil" because it could have malicious intent. Which if you are going to cast such a wide net, I would suggest reconsidering your use of computers for any purpose. That or maybe take the time to study what you are railing against so you can make a better argument.
Without the nexus of a (financial) transaction with the perpetrator it is rather difficult to prove a conspiracy to violate the computer fraud and abuse act.
For treasonous crimes like this, they lock you in Bieber's house.
Everything is meant to be modified sooner or later. Your statement falls apart if one single valid reason is shown.
Registry and file monitoring, notifications for printer status require hooking and are perfectly legal if done by the user.
More examples here.
Harmony is a function prefix, postfix, and detour library for Unity game engine: https://github.com/pardeike/Harmony/wiki
Mod Organizer uses hooks to add a virtual filesystem layer on NTFS for Bethesda and Bioware games: https://github.com/TanninOne/modorganizer
We could go on for years about legitimate uses of techniques used in muh mallwarez.
The whole thing goes waaay back.
Ezekiel 23:20