MalwareTech - The guy who helped to stop WannaCry - has been Detained in the US (UPDATED: arrested for the advertisement and sale of illegal hacking )

[WelshDdraig]

Source: https://motherboard.vice.com/en_us/article/ywp8k5/researcher-who-stopped-wannacry-ransomware-detained-in-us-after-def-con

Source 2: http://www.bbc.co.uk/news/uk-england-40820837

 

 

Title pretty much says it all.

The person who was responsible for helping stop - or at least Delay the huge attack on systems around the World by the WannaCry Ransomware

has been detained in US Custody shortly after attending "DefCon" and "Black Hat" conferences in Las Vegas.

 

This is not a US Marshals arrest, but an FBI Arrest of Mr Hutchins.

This is known as a "US Marshal" gave this comment:

Quote

A US Marshals spokesperson told Motherboard in an email, "my colleague in Las Vegas says this was an FBI arrest. Mr. Hutchins is not in U.S. Marshals custody."

There is no known reason as of yet for the arrest, but the FBI has acknowledged a request for comment but decided not release a statement.

 

 

 

Since this is a legal investigation, not much more information has been made available.

Quote

"We are aware a UK national has been arrested but it's a matter for the authorities in the US," a spokesperson for the UK's National Crime Agency told Motherboard in an email.

 

A spokesperson from the UK's National Cyber Security Centre told Motherboard in an email, "We are aware of the situation. This is a law enforcement matter and it would be inappropriate to comment further."

 

 

My Opinion:

 

Shortly after delaying WannaCry - MalwareTech, now know to be "Marcus Hutchins" was practically Doxxed by journalists, so now there is information about the user available on line and in the tabloids.

Naturally, after such a feet of delaying WannaCry, I can only assume that some governments have been keeping an eye on him or checking is background/History.

After attending such conferences that could be questionable, such as Black Hat (Black Hat Hacking is pretty illegal) - I can only assume that made him a prime target.

Either way, this sucks for the guy and I hope he gets released soon.

 

Yeah - My opinion has changed and is not worth me typing until more confirmations have arrived.

 

Your thoughts, please leave them down below

 

 

 

 

UPDATE TIME:

So - an update has come out from a different source

(https://www.theguardian.com/technology/2017/aug/03/researcher-who-stopped-wannacry-ransomware-detained-in-us)

In which it claims that Marcus Hutchins is alleged to have helped

Quote

"create, spread and maintain the banking trojan Kronos between 2014 and 2015."

 

The Kronos malware was spread through emails with malicious attachments such as compromised Microsoft word documents and hijacks credentials like internet banking passwords to let its user steal money with ease.

 

Although on another note - possibly a coincidence:

Quote

Hours after Hutchins was arrested by the FBI, more than £100,000 ($130,000) of the bitcoin ransom taken by the creators of WannaCry was moved within the bitcoin network for the first time since the outbreak. There is nothing to suggest the withdrawal, which appears to have moved the coins into a “mixer”, a digital money-laundering system, is connected to the arrest of Hutchins.

2

The perpetrators are probably doing this as a precaution, but you don't know, perhaps the 2 are linked.

 

UPDATE TIME #2:

Just released via SkyNews Twitter:

Turns out he was arrested for the advertisement and sale of illegal hacking tools.

[Billy_Mays]

Fucking idiots the world could've been a different place right now if it wasn't for him

[kelvinhall05]

Stupid. The people who started WannaCry should have this done to them, not the guy who saved thousands (I think) of computer's lives.

[Oshino Shinobu]

This where it comes to light that it was actually the US that released WannaCry, conveniently using the Windows exploit that the CIA (or was it NSA's, I can't remember) "lost", so they're just annoyed that he stopped it. 

[SatanExe]

I don't understand how raised suspicions is justification for an arrest warrant?
I'm from the UK, where you need a reason to arrest, even if it's just evidence for something planned. I assume US Laws (whether they be state or national) say otherwise.

[BuckGup]

They probably think if he had the knowledge to stop it he had the knowledge to make it. Idiots. Or they are offering him a job

[JakeNTech]

3 minutes ago, BuckGup said:

They probably think if he had the knowledge to stop it he had the knowledge to make it. Idiots. Or they are offering him a job

Thats a different job interview then.....

[themctipers]

the world is a fucked up place. 

[JakeNTech]

https://www.theguardian.com/technology/2017/aug/03/researcher-who-stopped-wannacry-ransomware-detained-in-us?utm_term=Autofeed&CMP=fb_a-technology_b-gdntech#link_time=1501783492

Quote

According to an indictment released by the US Department of Justice, Hutchins is accused of having helped to spread and maintain the banking trojan Kronos between 2014 and 2015.

 

[Ryujin2003]

Everyone immediately had some knee jerk reaction about US Gestapo... Watch it be something like him downloading illegal porn in his hotel room, or meeting and purchasing narcotics in a back alley.

 

Edit: Wasn't correct as @fixitnow stated. Still, I stand by not instantly judging a situation...

[Ryujin2003]

1 minute ago, fixitnow said:

https://www.theguardian.com/technology/2017/aug/03/researcher-who-stopped-wannacry-ransomware-detained-in-us?utm_term=Autofeed&CMP=fb_a-technology_b-gdntech#link_time=1501783492

 

Cannot be!! He's the savior of the world!!!!! No way in hell, wrong person. US is over extending it's authority../s

[Linus_torvalds]

Now this is why i agree with any black hat hacker! They must destroy anything they can. Destroy US computers i do not mind, destroy CIA, NSA and things like that. If anyone gets harmed in this process, well this is like a war and there are always victims in a war.

 

I remember there was a post about a guy who helped university and got caught by police. Literally for kindness.

[ivan134]

Lots of edgelords in here

[Jinchu]

Wow. I wonder what comes out of this cooking. Seems like there are a ton of speculation and little knowledge.. 

[Misanthrope]

Who the fuck organizes a black hat convention the epicenter of Orwellian institutions, the US?

 

Might as well organize a hobbit birthday party in the middle of fucking Mordor.

[Zando_]

1 hour ago, mate_mate91 said:

Now this is why i agree with any black hat hacker! They must destroy anything they can. Destroy US computers i do not mind, destroy CIA, NSA and things like that. If anyone gets harmed in this process, well this is like a war and there are always victims in a war.

Uuuuum. What? If they destroy the CIA and NSA, we're all dead (or gonna be captured). Cyberwarfare is massive, and going on all the time, and is critical to national security. Saying to destroy the CIA is like saying we should destroy the military. It won't work out well. 

[Zando_]

1 minute ago, Misanthrope said:

Who the fuck organizes a black hat convention the epicenter of Orwellian institutions, the US?

 

Might as well organize a hobbit birthday party in the middle of fucking Mordor.

'Tis strange. But then people burn the flag and all kinds of stuff in public. It's the land of the "free". As in, free to hate the government and cops and stuff, but then demand freebies from the same government you profess to dislike. Doesn't make sense. 

[Misanthrope]

12 minutes ago, Zando Bob said:

'Tis strange. But then people burn the flag and all kinds of stuff in public. It's the land of the "free". As in, free to hate the government and cops and stuff, but then demand freebies from the same government you profess to dislike. Doesn't make sense. 

Unfortunately the flag makers lobbying think tanks are not as influential as the ones who are routinely affected by rogue cyber security experts and such. 

[mrchow19910319]

He was in las vegas for a long time, (vacation?) and he keep posting on twitter all the super car they rent from day to day. Dude was having a blast. (@MalwareTechBlog) what an turn of event...

[LAwLz]

Currently reading through my Twitter feed but from what I can tell it seems like MalwareTech directly or indirectly wrote code that was used in a Trojan.

 

Here is the serious part from the indictment.

Spoiler

According to this document (link to the full document here), MalwareTech wrote some code and some unnamed person sold it, spread it and so on.

 

His GitHub page contains quite a lot of code which could be used to create malware. Such as this code which will inject code into regular processes, or this which does a privilege escalation.

These programs are proof-of-concepts and used for educational purposes. Hence why I phrased the previous paragraph so precisely with "intent of profit or causing damage".

I think that there is a chance that MalwareTech wrote that Trojan without the intention of profit or damage. He might just have written it for the same purpose as a lot of his other programs, proof of concept, education and experimentation.

After all, the document I posted essentially says that MalwareTech just wrote the code, but all of the other activities such as selling it and such were done by some yet-to-be-named person.

 

 

This could set a very bad precedent where security researches become afraid of actually developing tools to test and educate about security issues.

 

 

On a side note, the EFF is trying to contact MalwareTech but so far, no success.

Being detained in another country without a lawyer sounds like my worst nightmare. I feel really bad for him even if it turns out that he is guilty of deliberately creating malware with the intent of profit or causing damage.

 

 

Anyhow, I think it is too soon to draw any conclusions. It will be interesting to see how things plays out.

Orin Kerr, a law professor, will be writing a post

[Deletist_Jerk]

"Detained" in other words, pre-selected to work for the U.S. government with the highest security clearance after serving some time. 

 

[Cool Guy]

More often than not the best security experts have done something pretty naughty, most times it's just not documented.  This accusation could just be an excuse to detain him, I'm sure he's now wishing he never found the killswitch.  If it was me and I found the killswitch I would tell someone else about it but I wouldn't necessarily consider it my responsibility to activate it, even if the NHS was hijacked.  I'm just someone who prefers to work behind the scenes.

 

Although I guess him going to black hat could've raised suspicions, it's pretty common for good security workers to attend these conferences. I think the FBI hates anyone with knowledge who isn't on their side, because it's a risk to them.  If he did actually spread the malware though, then he got what was coming.  This is why I didn't apply to the security job I was offered to apply for because not only is there huge screening process but you are seen as a risk by your own government.  especially if you work at a private firm like was the case.  

 

I genuinely hope the best for the guy, because despite all odds he did a good thing and definitely saved a lot of networks from the dreaded ransomware that could've been stopped had they patched their systems.

[Grinners]

Advertising and selling hacks. Involved in banking trojans... i hope he spends a good period of time in jail. 

[Billy_Mays]

Is it just one source that says it was  for black hack tools?

[LAwLz]

6 hours ago, Grinners said:

Advertising and selling hacks. Involved in banking trojans... i hope he spends a good period of time in jail. 

Where did you get that info from? Not even the Indictment says he advertised and sold hacks. It says MalwareTech made a Trojan which some yet-to-be-named person advertised and sold.