Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

// // //

WannaCry Hero in FBI Custody

Marcus Hutchins, the researcher who killed WannaCry, was arrested last week in Las Vegas. Should his arrest send a chill over the researcher community?

Can a good guy do bad things? Can a bad guy do something good that benefits millions of people? These sound like the sub-texts for the latest film in the Marvel universe, but they're actually questions that many in the cybersecurity world are asking after the arrest of Marcus Hutchins last week.

If you don't know the name, Hutchins is the malware researcher who, pretty much by accident, shut down WannaCry with a single, simple act. Known and respected in the security researcher community, Hutchins was launched into much wider view when he kept the ransomware attack from spreading beyond its two-day limits.

Hutchins returned to the headlines last week when he was arrested in Las Vegas after attending (or, according to some stories, just being in the vicinity of) DEF CON.

It took a couple of days to figure out why he had been arrested, but the FBI ultimately said that he is accused of creating, then selling, the code for Kronos malware, an unpleasant little keylogger that grabbed banking details from users' computers.

That's about all people outside the law enforcement community (and Hutchins' legal team) know for sure. We've been told, by various sources, that he admitted to creating the software, that he never had anything to do with the software, that he plans to plead "not guilty" to all six charges, and that he's guilty as sin. We should find out more tomorrow, when he has his first real court date, but until then it's all conjecture.

Not surprisingly, the security research world has erupted in panic, anger and chaos at the news, and the case does bring up some very interesting aspects of the way that security research happens. It's important to ask the question: Is the current model of security research sustainable in the changing world of today's Internet?

The current situation, in which there are white hat hackers who are presumed to work on the side of justice, legal proceedings and apple pie; black hat hackers, who should be feared and loathed by all honest and respectable people; and grey hat hackers who play both sides of the street, is an artifact of cybersecurity's relative youth as a discipline. It's entirely possible that the roles will become more codified as the field matures.


You're invited to attend Light Reading's Virtualizing the Cable Architecture event – a free breakfast panel at SCTE/ISBE's Cable-Tec Expo on October 18 featuring Comcast's Rob Howald and Charter's John Dickinson.

What's less certain is whether that will be a good thing. Most of the white hat hackers I know are fully capable (from a skills point of view) of creating horrible malware and vulnerability exploits. They must be if they're to figure out how to stop the black hat hackers. And many black hat hackers will have good causes that they can support, using their skills to support human rights or human tragedies.

It's interesting that Hutchins' arrest comes shortly after the Black Hat speech that kicked off a discussion about the possibility of expanding security's portfolio to include abusive behavior as well as acts of breaking and entering. It's looking like 2017 could well be remembered as a year in which the role of security -- and the roles of security researchers -- were examined and redefined to fit the needs of a changing world.

We'll know more soon, and Security Now will keep you posted. In the meantime, let us know what you think about the situation: Is there a reason to keep the old hat-based definition system going? Should we redefine information security entirely? Meet me in the comment section and let me know your thoughts.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-25135
PUBLISHED: 2023-02-03
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are...
CVE-2022-4634
PUBLISHED: 2023-02-03
All versions prior to Delta Electronic’s CNCSoft version 1.01.34 (running ScreenEditor versions 1.01.5 and prior) are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code.
CVE-2023-0123
PUBLISHED: 2023-02-03
Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.
CVE-2023-0124
PUBLISHED: 2023-02-03
Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to an out-of-bounds write, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.
CVE-2023-24613
PUBLISHED: 2023-02-03
The user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb tool to overwrite the backend function call stack after accessing the system with administrator privileges. A successful exploit could leverage this vulnerability in the backend bin...