Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/7/2017
05:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

WannaCry Hero Garners Security Industry Support Following Arrest

US law enforcement arrested British security researcher Marcus Hutchins for allegedly developing and selling the Kronos banking Trojan.

Many within the security community appear to be rallying behind British bug hunter and researcher Marcus Hutchins following his stunning arrest last Thursday for allegedly creating, advertising, and selling the Kronos banking Trojan.

Leading privacy and civil rights group the Electronic Frontier Foundation (EFF) Monday expressed its "deep" concern over the arrest of the man that just this May was widely hailed as a hero for shutting down the WannaCry ransomware pandemic.

"We are looking into the matter and attempting to help Mr. Hutchins obtain good legal counsel," the EFF said in a statement to Dark Reading.

New York City-based cyber law firm Tor Ekeland P.C. along with Symantec cybersecurity czar Tarah Wheeler have established a site for donating to Hutchins' legal defense citing the researcher's right to a fair trial. "We may all have opinions about what Marcus did and didn't do," Wheeler said in comments on the site.

"This is not about guilt or innocence; it is about the belief that all people deserve to be represented under American law with fervor and passion, and that includes security researchers."

The 23-year old Hutchins, who is better known as MalwareTech, has pleaded not guilty to the charges against him and was granted a $30,000 bail Friday. He is scheduled to make an appearance in federal court in Milwaukee on Tuesday. A prosecutor has claimed that Hutchins admitted to creating the banking malware and sold it. If convicted on all charges, Hutchins could spend years in prison.

But the relatively scant information in the indictment papers and the fact that Hutchins is one of two alleged conspirators in the scheme — the other has not yet been identified — have prompted questions about the strength of the government's case against him.

Some, who remember Hutchins' recent role in shutting down WannaCry, appear convinced that the arrest was unmerited and an overreach on the part of federal prosecutors. Others are reserving judgment till more information becomes available.

"As with others in the community, it was a bit of a shock, especially after a Black Hat with positive involvement from high-ranking members of DOJ, " says Jonathan Cran, vice president of research at bug bounty coordination firm BugCrowd.

"We're all trying to determine what this means for Hutchins, as well as what it means for ourselves, and for other researchers in the community. For better or worse, it is already having a chilling effect on research," he says.

Like many others, Cran says the activities that prosecutors have hit Hutchins with — at least based on what's in the indictment papers — were likely not as nefarious as the charges would lead one to believe. For instance, it is entirely possible that Hutchins' alleged act of selling a copy of Kronos and his offer of a "crypting" service to make it more invisible were simply tactics to build and maintain a reputation in underground markets.

In order for the US government to win the case, there needs to be more detail in the form of chat logs, and transactions that show Hutchins' intent when he allegedly hawked and sold the malware, Cran says.

"I think this is a wakeup call that while security research is carefully being welcomed, there are very fine lines for researchers, and it's extremely important to pay attention to the evolving case law. This is not the first case we've seen of this kind and it's not likely to be the last," he says.

Orin Kerr, a professor of law at the George Washington University Law School and a noted expert on cyber matters, is one of those who believes the government will have a hard time proving its case against Hutchins, based on what's known so far about the charges.

In an opinion piece in the Washington Post, Kerr held that based on a first look at the indictment, the government is being overly aggressive in its charges against Hutchins. For example, one of the charges against Hutchins is related to a statute that makes it illegal for anyone to intentionally send out a program or a command that damages a computer. However, in this case, the government's charge appears to be that Hutchins' sale of the software to a third-party is the same as his causing actual damage to a computer.

"For the charge to fit the statute, the government has to prove two things that it may or may not be able to prove," he said. First, prosecutors have to show that Hutchins and his unnamed conspirator had an intention to create damage. Secondly, they need to prove that the agreement between Hutchins and his conspirators was to cause damage to other computers via malware, Kerr said. He pointed to similar legal challenges with all of the other charges against Hutchins.

Ron Austin, an associate professor at Birmingham City University's School of Computing and Digital Technology in the U.K., says the case raises a number of issues between where the cybersecurity community is and where the law is in relation to researching and stopping attacks.  "There is a risk within security research where a researcher may release test code that is later used maliciously," Austin says.

"It’s a difficult balance between informing and the use of that information. The researcher needs to be able to inform the community in a responsible way," he says. "If it becomes an issue where research is stopped or delayed because the researchers are worried that they face a court case, it risks the unethical hackers gaining ground."

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4128
PUBLISHED: 2020-12-01
HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the ID Vault service.
CVE-2020-7335
PUBLISHED: 2020-12-01
Privilege Escalation vulnerability in Microsoft Windows client McAfee Total Protection (MTP) prior to 16.0.29 allows local users to gain elevated privileges via careful manipulation of a folder by creating a junction link. This exploits a lack of protection through a timing issue and is only exploit...
CVE-2020-15257
PUBLISHED: 2020-12-01
containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that...
CVE-2020-9114
PUBLISHED: 2020-12-01
FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability. Due to improper privilege management, an attacker with common privilege may access some specific files and get the administrator privilege in the affected products. Successful exploit will cause pr...
CVE-2020-9117
PUBLISHED: 2020-12-01
HUAWEI nova 4 versions earlier than 10.0.0.165(C01E34R2P4) and SydneyM-AL00 versions earlier than 10.0.0.165(C00E66R1P5) have an out-of-bounds read and write vulnerability. An attacker with specific permissions crafts malformed packet with specific parameter and sends the packet to the affected prod...