Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/7/2018
05:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

FBI Slaps New Charges Against Researcher Who Stopped WannaCry

Federal authorities charged Marcus Hutchins with lying to the government and authoring a second piece of malware in addition to the Kronos banking Trojan.

Any hopes that Marcus Hutchins, the British security researcher credited with stopping WannaCry, might have harbored about a quick resolution of a US malware case against him were dashed this week with the FBI slapping four new charges against him.

Federal authorities arrested Hutchins, 24, in Las Vegas last August and charged him with creating and distributing, Kronos - malware for stealing online banking credentials - between July 2014 and July 2015.

In a six-count indictment, federal prosecutors accused Hutchins of, among other things, conspiring to commit computer fraud, illegally accessing computers, and distributing and advertising an illegal communication-interception device.

Hutchins shot to fame last year when he almost serendipitously found a way to stop the WannaCry ransomware outbreak. Widely hailed as a hacker hero, Hutchins was in Las Vegas to attend the 2017 DefCon hacker conference when he was arrested.

He later pleaded not guilty to the charges in a federal court in Milwaukee, where some of his criminal activity is alleged to have occurred. Hutchins is currently out on bail but has not been permitted to return to his home in England.

'Upas'

In a superseding indictment filed this week, prosecutors are now accusing Hutchins of also authoring and distributing the Upas Kit malware that uses a form grabber and Web injects for stealing credentials and other data from infected systems.

Three of the four new charges in the superseding indictment are related to Hutchins' alleged role in advertising and distributing the malware in collaboration with "Vinny," an alleged co-conspirator. Prosecutors allege that Hutchins developed Upas Kit and provided it to Vinny, who sold it for $1,500 to an individual in Milwaukee. Vinny is alleged to have helped Hutchins distribute Kronos as well.

The indictment describes the alleged criminal activity involving Upas Kit as starting sometime on or before July 2012, when Hutchins would likely still have been a minor.

The fourth new charge in the superseding indictment this week accuses Hutchins of knowingly lying to federal prosecutors about his role in developing Kronos.

Hutchins, who before the WannaCry incident referred to himself simply as "Malwaretech" and ran a blog under that name, now faces a total of ten counts related to his alleged malware activity. He could spend years in US jail if convicted on all charges.

In a tweet, Hutchins expressed his frustration at the development. "Spend months and $100k+ fighting this case, then they go and reset the clock by adding even more bullshit charges like 'lying to the FBI'," he said while making an appeal for more donations for funding his defense.

Some others, who see Hutchins as being the victim of overzealous prosecutors, too, voiced their disappointment. They maintain that Hutchins' alleged criminal activity, while not condonable, is typical of many security researchers who dabble in dubious activity when they're young, but eventually straighten out.

"A lot of security people have flecks of dirt accumulated over the years," says Nicholas Weaver, senior researcher networking and security at the University of California, Berkley's International Computer Science Institute.

But it is important to "keep open exchanges even with people whose hats aren’t as quite lily-white as we’d like," he says.

Hutchins' arrest when visiting the US for a security conference could spook other international researchers, he notes. "Yes, Mr Hutchins' hat appears a little gray, based on filings from both sides in the court case," and open source investigations, Weaver says. "But I don't think it is gray enough to justify damaging the important free-flow of people and information we get at major security conferences."

Some legal experts have also questioned the strength of the government's case against Hutchins, and of its interpretation of certain statutes in prosecuting him.

Related Content:

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Adelaida
50%
50%
Adelaida,
User Rank: Apprentice
6/13/2018 | 5:02:33 AM
wow
Let no good deed go unpunished...
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13842
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). A dangerous AT command was made available even though it is unused. The LG ID is LVE-SMP-200010 (June 2020).
CVE-2020-13843
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS software before 2020-06-01. Local users can cause a denial of service because checking of the userdata partition is mishandled. The LG ID is LVE-SMP-200014 (June 2020).
CVE-2020-13839
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via a custom AT command handler buffer overflow. The LG ID is LVE-SMP-200007 (June 2020).
CVE-2020-13840
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via an MTK AT command handler buffer overflow. The LG ID is LVE-SMP-200008 (June 2020).
CVE-2020-13841
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 9 and 10 (MTK chipsets). An AT command handler allows attackers to bypass intended access restrictions. The LG ID is LVE-SMP-200009 (June 2020).