Self-taught computer-security researcher credited with stopping a
devastating cyberattack that crippled British hospitals in May was arrested on
charges that he created malware used to hack banking systems in Canada and
Europe, the U.S. said.
Marcus Hutchins, who started blogging under the pseudonym MalwareTech when
he was a teenager, was arrested Wednesday in Las Vegas, the Justice Department
said in a statement. Court documents unsealed Thursday show he was indicted in
July on several charges of computer misconduct relating to the creation and
distribution of the Kronos banking Trojan, a type of malicious program that
steals usernames and passwords for banking websites from infected machines.
“We are aware of the situation. This is a law enforcement matter and it
would be inappropriate to comment further,” the U.K. National Cyber Security
Centre said in a statement.
Hutchins’ arrest came as a shock to the cybersecurity industry, which was
coming off its biggest week of the year at the Black Hat and Def Con
conferences in Las Vegas, which Hutchins had attended. Among white-hat security
researchers, who hack technologies to find ways to fix them, Hutchins was a
hero. They hailed his quick thinking in neutralizing the WannaCry ransomware
just hours into a fast-spreading attack in May that threatened not just
computer systems but also potentially lives.
WannaCry infected about 300,000 computers in 150 countries, locking users
out unless they paid a ransom in bitcoin. Victims included the U.K.’s National
Health Service, whose hospitals were disrupted, as well as FedEx Corp., Nissan
Motor Co. and Renault. Hutchins found a clever way to stop the attack by
registering an Internet domain that served as a ‘kill switch’ for the malware,
a secret that was hidden in its code.
Eva Galperin, director of cybersecurity for the Electronic Frontier
Foundation, said the San Francisco-based legal advocacy group is trying to
reach out to Hutchins.
‘Deeply Concerned’
“The EFF is deeply concerned about the arrest of Marcus Hutchins” said
Jeanne Carstensen, a spokeswoman for the group. “We are looking into the
matter, and are reaching out to Hutchins.”
According to federal investigators, in 2014 and 2015, more than a year
before the WannaCry outbreak, Hutchins wrote the Kronos malware, advertised it
for sale in online hacker forums and split thousands of dollars in profits with
at least one other defendant, whose name was redacted in the indictment. While
Kronos is one of many widely used forms of banking Trojans, Hutchins is accused
of being a supplier, and not actually hacking people’s computers to install the
malware.
Profile: Surfer Who Saved the World from WannaCry
Tor Ekeland, a U.S. attorney who specializes in cyber crime, told the BBC
Friday that Hutchins faces six felony charges, with up to 40 years in jail.
“It seems to be suggesting that writing software of this
type is a felony which is highly problematic for the information software
industry as a whole,” he said.
The arrest appears linked to the FBI’s shutdown of a notorious online
criminal marketplace called AlphaBay, where Hutchins is accused of selling the
Kronos malware. The Justice Department announced late last month that it had
dismantled the site, which it said had 200,000 users and 40,000 sellers. The
site had hundreds of thousands of listings for drugs, guns, fake IDs and hacker
tools. The alleged founder, a 26-year-old Canadian living in Thailand named
Alexandre Cazes, was found dead in his jail cell shortly after his arrest, in
an apparent suicide.
The language in the indictment and timing of the allegations suggest that
federal investigators used information they learned in the probe of AlphaBay to
build the case against Hutchins, who became a reluctant celebrity after news
outlets published his real name — ‘doxing,’ in hacker parlance — following his
WannaCry intervention.
His arrest coincides with a conclusion of sorts for the WannaCry attacks. On
Thursday, three bitcoin wallets linked to the malware were emptied out, with
the tokens divided into smaller amounts and sent to other bitcoin addresses.
The wallets held a combined 52 BTC, or about $140,000.
Comments
Post a Comment