Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

12:00 AM
Curtis Franklin
Curtis Franklin
Curt Franklin

WannaCry Hero in FBI Custody

Marcus Hutchins, the researcher who killed WannaCry, was arrested last week in Las Vegas. Should his arrest send a chill over the researcher community?

Can a good guy do bad things? Can a bad guy do something good that benefits millions of people? These sound like the sub-texts for the latest film in the Marvel universe, but they're actually questions that many in the cybersecurity world are asking after the arrest of Marcus Hutchins last week.

If you don't know the name, Hutchins is the malware researcher who, pretty much by accident, shut down WannaCry with a single, simple act. Known and respected in the security researcher community, Hutchins was launched into much wider view when he kept the ransomware attack from spreading beyond its two-day limits.

Hutchins returned to the headlines last week when he was arrested in Las Vegas after attending (or, according to some stories, just being in the vicinity of) DEF CON.

It took a couple of days to figure out why he had been arrested, but the FBI ultimately said that he is accused of creating, then selling, the code for Kronos malware, an unpleasant little keylogger that grabbed banking details from users' computers.

That's about all people outside the law enforcement community (and Hutchins' legal team) know for sure. We've been told, by various sources, that he admitted to creating the software, that he never had anything to do with the software, that he plans to plead "not guilty" to all six charges, and that he's guilty as sin. We should find out more tomorrow, when he has his first real court date, but until then it's all conjecture.

Not surprisingly, the security research world has erupted in panic, anger and chaos at the news, and the case does bring up some very interesting aspects of the way that security research happens. It's important to ask the question: Is the current model of security research sustainable in the changing world of today's Internet?

The current situation, in which there are white hat hackers who are presumed to work on the side of justice, legal proceedings and apple pie; black hat hackers, who should be feared and loathed by all honest and respectable people; and grey hat hackers who play both sides of the street, is an artifact of cybersecurity's relative youth as a discipline. It's entirely possible that the roles will become more codified as the field matures.

You're invited to attend Light Reading's Virtualizing the Cable Architecture event – a free breakfast panel at SCTE/ISBE's Cable-Tec Expo on October 18 featuring Comcast's Rob Howald and Charter's John Dickinson.

What's less certain is whether that will be a good thing. Most of the white hat hackers I know are fully capable (from a skills point of view) of creating horrible malware and vulnerability exploits. They must be if they're to figure out how to stop the black hat hackers. And many black hat hackers will have good causes that they can support, using their skills to support human rights or human tragedies.

It's interesting that Hutchins' arrest comes shortly after the Black Hat speech that kicked off a discussion about the possibility of expanding security's portfolio to include abusive behavior as well as acts of breaking and entering. It's looking like 2017 could well be remembered as a year in which the role of security -- and the roles of security researchers -- were examined and redefined to fit the needs of a changing world.

We'll know more soon, and Security Now will keep you posted. In the meantime, let us know what you think about the situation: Is there a reason to keep the old hat-based definition system going? Should we redefine information security entirely? Meet me in the comment section and let me know your thoughts.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-11-28
An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c.
PUBLISHED: 2020-11-28
An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.
PUBLISHED: 2020-11-28
An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.
PUBLISHED: 2020-11-28
An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71.
PUBLISHED: 2020-11-28
An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.