Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

12:00 AM
Curtis Franklin
Curtis Franklin
Curt Franklin

WannaCry Hero in FBI Custody

Marcus Hutchins, the researcher who killed WannaCry, was arrested last week in Las Vegas. Should his arrest send a chill over the researcher community?

Can a good guy do bad things? Can a bad guy do something good that benefits millions of people? These sound like the sub-texts for the latest film in the Marvel universe, but they're actually questions that many in the cybersecurity world are asking after the arrest of Marcus Hutchins last week.

If you don't know the name, Hutchins is the malware researcher who, pretty much by accident, shut down WannaCry with a single, simple act. Known and respected in the security researcher community, Hutchins was launched into much wider view when he kept the ransomware attack from spreading beyond its two-day limits.

Hutchins returned to the headlines last week when he was arrested in Las Vegas after attending (or, according to some stories, just being in the vicinity of) DEF CON.

It took a couple of days to figure out why he had been arrested, but the FBI ultimately said that he is accused of creating, then selling, the code for Kronos malware, an unpleasant little keylogger that grabbed banking details from users' computers.

That's about all people outside the law enforcement community (and Hutchins' legal team) know for sure. We've been told, by various sources, that he admitted to creating the software, that he never had anything to do with the software, that he plans to plead "not guilty" to all six charges, and that he's guilty as sin. We should find out more tomorrow, when he has his first real court date, but until then it's all conjecture.

Not surprisingly, the security research world has erupted in panic, anger and chaos at the news, and the case does bring up some very interesting aspects of the way that security research happens. It's important to ask the question: Is the current model of security research sustainable in the changing world of today's Internet?

The current situation, in which there are white hat hackers who are presumed to work on the side of justice, legal proceedings and apple pie; black hat hackers, who should be feared and loathed by all honest and respectable people; and grey hat hackers who play both sides of the street, is an artifact of cybersecurity's relative youth as a discipline. It's entirely possible that the roles will become more codified as the field matures.

You're invited to attend Light Reading's Virtualizing the Cable Architecture event – a free breakfast panel at SCTE/ISBE's Cable-Tec Expo on October 18 featuring Comcast's Rob Howald and Charter's John Dickinson.

What's less certain is whether that will be a good thing. Most of the white hat hackers I know are fully capable (from a skills point of view) of creating horrible malware and vulnerability exploits. They must be if they're to figure out how to stop the black hat hackers. And many black hat hackers will have good causes that they can support, using their skills to support human rights or human tragedies.

It's interesting that Hutchins' arrest comes shortly after the Black Hat speech that kicked off a discussion about the possibility of expanding security's portfolio to include abusive behavior as well as acts of breaking and entering. It's looking like 2017 could well be remembered as a year in which the role of security -- and the roles of security researchers -- were examined and redefined to fit the needs of a changing world.

We'll know more soon, and Security Now will keep you posted. In the meantime, let us know what you think about the situation: Is there a reason to keep the old hat-based definition system going? Should we redefine information security entirely? Meet me in the comment section and let me know your thoughts.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-09-19
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
PUBLISHED: 2020-09-18
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.
PUBLISHED: 2020-09-18
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
PUBLISHED: 2020-09-18
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11....
PUBLISHED: 2020-09-18
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-W...