Security researcher tends to be harmful to malicious software
Security researcher Marcus Hutchins was guilty on Wednesday of writing malware and helping with the distribution with the help of a partner.
Hutchins is better known for his central role in breaking WannaCry's spread throughout the world and his online persona MalwareTech where he interacts with the information security community by helping those entering the field convey information on new threats and release guidance on how to analyze malicious software.
Hutchins was arrested at Las Vegas Airport on August 2, 201[ads1]7, on his way home to the UK, after attending Black Hat and DEF CON security conferences as a security researcher.
Possible prison term and significant fines
Filed on Friday is the culprit of the case for Count One and counts two out of a total of ten accusations given in compensation from US prosecutors.
These refer to the development of malware (UPAS Kit and Kronos banking trojans) and help with the distribution in collaboration with a co-conspirator known "Vinny", "VinnyK", "Aurora 123" Gone with the Wind, "" Cocaine "and" Jack of All Trades. "These activities took place between July 2012 and September 2015, according to court documents.
Each of the two charges has a maximum of five years in prison, up to $ 250,000 in fines, one year of supervisory release and a $ 100 special evaluation In all, Hutchin's 10-year imprisonment and $ 500,000 are in danger, and according to this agreement, the remainder of the count will be rejected in court for criminal conviction.
It should be noted that regardless of the outcome of this agreement, Hutchins is not exempt from further civil or administrative acts, from the US or local government.
In a public statement on the blog, the researcher says he regrets his actions before he goes into cyber security and takes full responsibility for his mistakes.
"After growing up, I have The page has been using the same skills that I abused several years ago for constructive purposes. I will continue to spend my time keeping people safe from malicious attacks. "
The support is still strong
Although not always openly and for good reasons, many security researchers dallied with cybercriminal activity, often a drop of blackhat in each professional donating a white hat, especially with older generations. of security experts, who did not have the current information resources; Also they did it at a time when the laws of chat were too vague or non-existent.
Today's internet offers, however, sufficient learning opportunities to reach expert levels without breaking the law and even Hutchins agrees:
There is a misunderstanding that you must be a security expert on the dark side. It is not true. You can learn everything you need to know legally. Stick to the good side.
– MalwareTech (@MalwareTechBlog) April 20, 2019
After his arrest, many scientists ransacked him to help him out. Even his local Conservative MP, Peter Heaton-Jones, and a dozen more sent letters on his behalf. Hutchins has been dependent on crowdfunding to cover his legal fees.
Even now, Hutchins has a large audience in his corner. A clear look at the answers he received after tweeting his statement on the latest developments of the case shows mostly positive comments; You have to look harder to find a negative answer.
Stay strong, you come back from this
– x0rz (@ x0rz) April 19, 2019
Hope for the best.
– Moose (@LitMoose) April 19, 2019
Sucks honestly, you deserve to be home.
– DEY! (@ronindey) April 19, 2019
I think many of us recognize this case was always a bad use of judicial judgment. Right and wrong has always been a completely different standard for legal and illegal. Hope to see you back in the good fight soon.
– Jacob Riggs (@Riggsbit) April 19, 2019
Still in your corner, kiddo. And I do not mean lovingly in a declining way. Just come home. That's what I want for you. And for your family to be able to squeeze and see you. All my love and support. I always believe in you.
– BlackRoomSec (@blackroomsec) April 19, 2019
Clearly, most are within the data security field: coaches, malware researchers, penetration testers, reverse engineering, security consultants, nerds
Redeeming himself
Having given up criminal life, Hutchins dedicated his skills to combat malware threats and searched for a position with the UK intelligence agency, General Communications Headquarters (GCHQ), but went for a better deal from US-based Cybersecurity Company Kryptos Logic, who recruited him after seen his analysis of Kelihos botnet).
Even before the application, Hutchin published technical articles that showed their reverse technical skills, and often revealed the tricks used in various malware strains and their components; and give details on how to fight them.
In a post in 2013 about the imminent leakage of the source code for malware from Carberp, Hutchins wrote this:
"Nothing good comes from leaks like this. The AV companies get a massive wave of infected users and spin-off bots is usually created. […] I guess we can only hope that major antivirus vendors can upgrade their software to handle this threat before more damage is done First five people asking me where to get the source will get a virtual flap on their face (all disbursed costs) and my eternal disapproval. "
Even after he was arrested, he continued to add input to combat cybercrime: identify and understand the topology of command and control servers (Emoted), tracking botnets (Hide and Seek), review of a reverse tool (NSAs GHIDRA) and analysis of security issues.
All this effort has been translated into a community of followers who are not only demanded words of comfort but also drawn together to pay for his lawyer's fees (after the arrest he was refused to work for his employer).
This, along with the time already served, can also count when the court gives the sentence, for which there is no date at the moment.
