Slashdot Mirror

← Back to Stories (view on slashdot.org)

The Teen Malware Career Of Marcus Hutchins (itwire.com)

Posted by EditorDavid on from the internet-never-forgets dept.

Slashdot reader troublemaker_23 writes, "A number of security researchers have dismissed an article by reporter Brian Krebs about Marcus Hutchins, the Briton who is awaiting trial in the US on charges of writing and distributing the Kronos banking malware, by pointing out that it has nothing to do with the case." An anonymous reader writes: Krebs investigated dozens of hacker forum pseudonyms, concluding "The clues suggest that Hutchins began developing and selling malware in his mid-teens -- only to later develop a change of heart and earnestly endeavor to leave that part of his life squarely in the rearview mirror." Krebs believes 15-year-old Hutchins registered a domain he'd later advertise as "mainly for blackhats wanting to phish," and in 2010 may have filmed YouTube videos about password-stealing malware. Krebs says the early activities are "fairly small-time -- and hardly rise to the level of coding from scratch a complex banking trojan and selling it to cybercriminals," though he believes Hutchins moved on to advertising exploit kits, password-stealers, and bot rentals.

Krebs also talked to 27-year-old Brendan Johnston, a friend of Hutchins who did time in prison in 2014 for selling Trojans, who "said his old friend sincerely tried to turn things around in late 2012... 'I feel like I know Marcus better than most people do online, and when I heard about the accusations I was completely shocked,. He tried for such a long time to steer me down a straight and narrow path that seeing this tied to him didn't make sense to me at all." Krebs stresses that Hutchins didn't try to hide the fact that he'd written malware, "which in the United States at least is a form of protected speech." And his essay concludes, "Let me be clear: I have no information to support the claim that Hutchins authored or sold the Kronos banking trojan."
Symantec's former cybersecurity czar Tarah Wheeler has now set up a new legal fund after it was discovered that most of the online donations to Hutchins' previous defense fund came from stolen or fake credit card numbers. Hutchins returns to court in October, and the new fund has already received more than $16,000 in donations from more than 200 contributors.

22 of 48 comments (clear)

  1. Who gets to decide? by YuppieScum · · Score: 4, Interesting

    I'm sure the MPAA would like to categorise Kodi as malware, and the RIAA would have done the same for Napster.

    I'd like to categorise the telemetry in Windows 10 as malware...

    Where is the line drawn, and who gets to draw it?

    --
    This sig left unintentionally blank.
    1. Re: Who gets to decide? by Anonymous Coward · · Score: 1

      Somewhere between Windows 10 and stuff that steals your banking credentials.

    2. Re: Who gets to decide? by Anonymous Coward · · Score: 1

      Isn't that EA Origin?

    3. Re:Who gets to decide? by Megol · · Score: 1

      If you don't like to use Windows 10 on your own computer(s) then don't. How the hell can you think something you can control to that level can be malware?
      You can easily disable the telemetry too, can you easily disable the malware aspects of malware?

      You have a point but please make the example realistic.

    4. Re:Who gets to decide? by Megol · · Score: 1

      Overreacted - sorry. :(

  2. Re:Malware creators should be executed by julian67 · · Score: 2

    Because the people of that democratic society have rejected the death penalty for all crimes except the very most serious.

    If you'd prefer a society which enacts arbitrary death penalties and executions then you could try standing for office on that platform, or lobbying, or campaigning. Or you could go apply to live in China, N. Korea, Iran, Pakistan, Afghanistan, Syria or IS or similar. Have a nice trip.

  3. Re:Malware creators should be executed by Anonymous Coward · · Score: 1

    I have noticed this tread amongst US citizens, even left wingers and the antifa crowd, to desire execution of people they deem undesirable. I expect this among the redneck right wingers, but sadly the left is becoming more violent in speech and action.

    Anyway, we don't execute people for non violent crimes. We shouldn't execute anyone, since that empowers the state to murder, but even in the current legal climate executions are typically reserved for violent felons who committed capital crimes.

    Murdering people for small time non violent crimes would be the province of countries like North Korea who enslave and torture their people regularly.

    Oh and since you posted like a chickenshit AC, so did I.

  4. Re:Malware creators should be executed by Anonymous Coward · · Score: 1

    Because the death penalty is immoral.

    It's also no more effective as a deterrent than much less extreme punishments, which means anybody arguing for it is fucking stupid as well as a degenerate scumbag.

  5. Re:Malware creators should be executed by quonset · · Score: 2, Interesting

    have rejected the death penalty for all crimes except the very most serious.

    And yet murderers, mass murderers, rapists, child rapists, and many others are not executed but instead coddled for decades at the taxpayer expense.

    Obviously society doesn't consider any of the above as serious crimes or these criminals would be executed. And before you bring up the tired, "Capital punishment doesn't deter crime", it's not about deterring crime. It's about getting rid of people who have chosen not to live within the bounds of a civilized society and not murder or rape others.

  6. Re:Malware creators should be executed by Dorianny · · Score: 1

    If it is simply "about getting rid of people who have chosen not to live within the bounds of a civilized society" then what exactly is the difference between life without possibility of parole and execution? People in prison are by definition outside of civilized society

  7. Re:Malware creators should be executed by olsmeister · · Score: 2

    Probably several million dollars per person.

  8. the death penalty needs to remove / very cut down by Joe_Dragon · · Score: 1

    the death penalty needs to remove / very cut down.

    any ways it takes years for the courts any ways be force they charge up old sparky

  9. Re: Malware creators should be executed by Anonymous Coward · · Score: 1

    Because the death penalty is a tool of politics, not a tool of justice. The only reason why the US still does it is to give the appearance of politicians being "tough on crime" in a punitive society.

    In Saudi Arabia they behead people in the public square. There's something fundamentally honest about this compared to countries that try to pretend it's some kind of medical procedure and hide it away so nobody has to look it in the face. Kind of like drone warfare.

  10. Re:Malware creators should be executed by Anonymous Coward · · Score: 1

    Only if you kill them before the legal process has gone its whole course (all the appeals).

  11. Re:Eliminate modding down posts by Solandri · · Score: 1, Interesting

    There's actually a mathematical difference between systems which allow only up-votes, vs systems which allow both up- and down-votes. With an up-vote only system, if a sufficient number of people think a post is insightful or interesting, it ranks high.

    People mistakenly think an up/down-vote system results in fairer results. Not necessarily. It gives results which conform to the group's biases. The problem arises when the population of people likely to down-vote a post is highly disproportionate. The example I always used (to avoid political bias) is Linux vs Windows. Windows has approximately 100x more users than Linux. Imagine there's a search engine which allows users to vote search results up or down based on how useful they are.

    Say a search for "how to partition a drive" gives a bunch of results for partitioning in Windows, and one result for partition in Linux. Say 1% of all users are idiots who will unfairly down-vote something just because they don't like it. So the up/down votes work properly for the Windows results. But the Linux result? Well, the 1% of Windows users who down-vote it because it isn't relevant to them (even though it's their own fault for not specifying "Windows" in the search) will exceed the number of up-votes it gets from Linux users unless every single Linux user who finds it useful up-votes it. And as a result the Linux site will be ranked as not useful, even though it's incredibly useful for Linux users (almost all of them up-voted it).

    So an up/down-vote system ends up more representative of the population, but it also ends up reflecting the population's pre-existing biases. Basically it'll be rife with confirmation bias unless all the users are diligent about not down-voting just because they disagree.

  12. Anonymous... by thesupraman · · Score: 1, Insightful

    Posting anonymously is effectively saying your opinion doesn't matter, and you are too chickenshit to back it up. Anonymous posting should be eliminated immediately, or at least it should be impossible to mod Anonymous posts up.

    Can you see what I did there? no, didn't think so.

  13. Fake credit card? by quetzyg · · Score: 1
    The last paragraph states:

    previous defense fund came from stolen or fake credit card numbers

    How exactly can money be obtained from a phoney card number?

    1. Re:Fake credit card? by will_die · · Score: 1

      fake credit card has an industry meaning. It refers to credit card numbers with a CVV and expiration date that would validate as real but there is no actual credit card.
      Where they can be used is places that cannot do an immediate verification with the credit card company. In this case they probably collected donation information but did not process the credit cards at the time of donation. So their total showed they collected XXXX money but when they attempted to get that money from the credit card companies it was denied.

  14. Still a problem by s.petry · · Score: 1

    A big part of /. moderation is not the moderation system itself, but the abuse of the system by (let us call them) special interests. Long ago it was people with sock puppet accounts mostly using them to moderate their own posts. Those still exist today, but we also have groups punishing "wrong think" and up modding garbage. E.G. "Trump is a F*# wad!" gets modded informative, "Trump's policy on X may actually be good because.. reasoning" gets modded "Troll", and "Why is Trump's policy?" questions get modded Flamebait.

    Slashdot has never done a good job with this. I don't know if they can ban certain accounts from getting mod points, but the fact that obvious moderation problems are consistently ignored has caused many to leave the site (see Soylent News). Most of us post anonymously when we know it's a censorship issue, which will eventually cause us to leave also.

    Public drivers always need controls, because the public is not some altruistic group always doing the right thing. The lack of control mixed with the shit moderation by sock puppet and special interest accounts has driven the dialogue and discussion portion of Slashdot down to kindergarten level on most topics.

    --

    -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

  15. Wrong by s.petry · · Score: 1

    Posting anonymously is required if you have certain opinions which people see as "wrong think". Some easy examples: Arguing against UBI. Arguing against Global Warming (now called Climate Change). Arguing against pot legalization. Arguing for a creator in Philosophy (not related to theology). Arguing for most of the amendments in the US Constitution (though pro 4th is still safe). Arguing for certain political parties, platforms, and candidates, or against their opposition.

    When accounts related to special interests stop getting mod points I will agree with you. The former won't happen, so I'm not worried about the latter.

    --

    -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

  16. Brian Krebs of the Washington CIA Post .. by khz6955 · · Score: 1

    The CIA, Amazon, Bezos and the Washington Post:

  17. Re:Eliminate modding down posts by khz6955 · · Score: 1

    "Censoring posts to -1 is effectively saying you disagree with someone's post, but you are too chickenshit to explain why. Moderation should be eliminated immediately, or at least it should be impossible to mod down posts."

    And of course the down votes and the insults so patently demonstrate the mentality of the chickenshits that resort to down-voting.