WannaCry Hero in FBI Custody

Marcus Hutchins, the researcher who killed WannaCry, was arrested last week in Las Vegas. Should his arrest send a chill over the researcher community?

Can a good guy do bad things? Can a bad guy do something good that benefits millions of people? These sound like the sub-texts for the latest film in the Marvel universe, but they're actually questions that many in the cybersecurity world are asking after the arrest of Marcus Hutchins last week.

If you don't know the name, Hutchins is the malware researcher who, pretty much by accident, shut down WannaCry with a single, simple act. Known and respected in the security researcher community, Hutchins was launched into much wider view when he kept the ransomware attack from spreading beyond its two-day limits.

Hutchins returned to the headlines last week when he was arrested in Las Vegas after attending (or, according to some stories, just being in the vicinity of) DEF CON.

It took a couple of days to figure out why he had been arrested, but the FBI ultimately said that he is accused of creating, then selling, the code for Kronos malware, an unpleasant little keylogger that grabbed banking details from users' computers.

That's about all people outside the law enforcement community (and Hutchins' legal team) know for sure. We've been told, by various sources, that he admitted to creating the software, that he never had anything to do with the software, that he plans to plead "not guilty" to all six charges, and that he's guilty as sin. We should find out more tomorrow, when he has his first real court date, but until then it's all conjecture.

Not surprisingly, the security research world has erupted in panic, anger and chaos at the news, and the case does bring up some very interesting aspects of the way that security research happens. It's important to ask the question: Is the current model of security research sustainable in the changing world of today's Internet?

The current situation, in which there are white hat hackers who are presumed to work on the side of justice, legal proceedings and apple pie; black hat hackers, who should be feared and loathed by all honest and respectable people; and grey hat hackers who play both sides of the street, is an artifact of cybersecurity's relative youth as a discipline. It's entirely possible that the roles will become more codified as the field matures.

You're invited to attend Light Reading's Virtualizing the Cable Architecture event – a free breakfast panel at SCTE/ISBE's Cable-Tec Expo on October 18 featuring Comcast's Rob Howald and Charter's John Dickinson.

What's less certain is whether that will be a good thing. Most of the white hat hackers I know are fully capable (from a skills point of view) of creating horrible malware and vulnerability exploits. They must be if they're to figure out how to stop the black hat hackers. And many black hat hackers will have good causes that they can support, using their skills to support human rights or human tragedies.

It's interesting that Hutchins' arrest comes shortly after the Black Hat speech that kicked off a discussion about the possibility of expanding security's portfolio to include abusive behavior as well as acts of breaking and entering. It's looking like 2017 could well be remembered as a year in which the role of security -- and the roles of security researchers -- were examined and redefined to fit the needs of a changing world.

We'll know more soon, and Security Now will keep you posted. In the meantime, let us know what you think about the situation: Is there a reason to keep the old hat-based definition system going? Should we redefine information security entirely? Meet me in the comment section and let me know your thoughts.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Read more about:

Security Now

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights