{"id":332,"date":"2017-12-27T15:20:39","date_gmt":"2017-12-27T15:20:39","guid":{"rendered":"http:\/\/ielrblog.com\/?p=332"},"modified":"2017-12-27T15:20:39","modified_gmt":"2017-12-27T15:20:39","slug":"the-latest-on-wannacry-north-korea-decries-accusations-u-s-comments-on-marcus-hutchins-arrest","status":"publish","type":"post","link":"https:\/\/ielrblog.com\/index.php\/2017\/12\/27\/the-latest-on-wannacry-north-korea-decries-accusations-u-s-comments-on-marcus-hutchins-arrest\/","title":{"rendered":"The Latest on WannaCry: North Korea Decries Accusations; U.S. Comments on Marcus Hutchins\u2019 Arrest"},"content":{"rendered":"

At a White House press briefing<\/a> on December 19, 2017, President Donald Trump\u2019s Homeland Security Advisor Tom Bossert publicly attributed the destructive WannaCry cyberattack to North Korea.<\/p>\n

Over a period of several days in May 2017, the WannaCry ransomware crippled hundreds of thousands of personal and corporate computer networks in over 150 countries, until a UK computer security researcher, Marcus Hutchins, inadvertently discovered a \u201ckill-switch\u201d in the malware\u2019s code that disabled the attack. Until Tuesday, the attack had not been publicly attributed to any particular state or non-state actor.<\/p>\n

\u201cAfter careful investigation, the United States is publicly attributing the massive WannaCry cyberattack to North Korea,\u201d Bossert said during the briefing.\u00a0 \u201cWe do not make this allegation lightly.\u00a0 We do so with evidence, and we do so with partners.\u201d<\/p>\n

Bossert went on to praise corporate partners, in particular Microsoft and Facebook, for their role in disabling North Korean hacking and cyber operations directed towards the U.S. \u201cLast week, Microsoft and Facebook and other major tech companies acted to disable a number of North Korean cyber exploits and disrupt their operations as the North Koreans were still infecting computers across the globe.\u00a0 They shut down accounts the North Korean regime hackers used to launch attacks and patched systems.\u201d<\/p>\n

Bossert then introduced Jeanette Manfra, Assistant Secretary for the Office of Cybersecurity for DHS. Bossert and Manfra went on to repeatedly stress the importance of public-private sector cooperation in cybersecurity matters. \u201cIn many ways, WannaCry was a defining moment and an inspiring one,\u201d Manfra said. \u201cIt demonstrated the tireless commitment of our industry partners, a moment that showed how the government and private sector got it right; that our preparation, our investments in cybersecurity, keeping our systems up to date, and sharing information paid off.\u201d<\/p>\n

The Assistant Secretary also called for strengthening international cooperation with regards to cyber: \u201cTo prevent another attack like WannaCry, we are calling on all companies to commit to the collective defense of our nation.\u00a0 And this commitment does not end on our borders\u2026 it is only through international partnerships that the United States had time to prepare.\u201d<\/p>\n

On December 26, 2017, North Korea\u2019s envoy in charge of U.S. affairs at the UN, Pak Song Il, demanded<\/a> that the U.S. prove that the North Koreans were behind WannaCry. North Korea\u2019s state-controlled media denounced the U.S.\u2019s allegations as \u201creckless.\u201d<\/p>\n

 <\/p>\n

Comments on the Recent Indictment of Marcus Hutchins <\/em><\/p>\n

During the briefing, a reporter asked Bossert for comments on the recent DOJ indictment<\/a> of Marcus Hutchins on unrelated computer fraud charges in early August. The DOJ has charged Hutchins for his alleged involvement of the Kronos banking Trojan, which experts believe was created in 2014 and distributed via the now-defunct cryptocurrency exchange AlphaBay. Hutchins is currently awaiting a court date, and has pleaded not guilty<\/a> to the charges.<\/p>\n

Bossert declined to comment on the ongoing criminal prosecution. He did acknowledge Hutchins\u2019 role in disabling WannaCry, saying that \u201cwe\u2026 had a programmer that was sophisticated, that noticed a glitch in the malware, a kill-switch, and then acted to kill it.\u00a0 He took a risk, it worked, and it caused a lot of benefit.\u00a0 So we\u2019ll give him that.\u201d<\/p>\n

Bossert did not give Hutchins all, or even most, of the credit, however. \u201c[I]t wasn\u2019t luck \u2014 it was preparation,\u201d he clarified. [I]t was partnership with private companies, and so forth.\u201d<\/p>\n

Hutchins\u2019 indictment had come as a shock to the cybersecurity community, which considered him somewhat of a hero for his role in disabling WannaCry. Immediately following his arrest, many of his colleagues took to Twitter to voice their skepticism of the charges. In September, however, Brian Krebs, an American investigative reporter and cybersecurity blogger, published an in-depth investigative piece<\/a> titled, \u201cWho is Marcus Hutchins\u201d on his popular cybersecurity blog, KrebsonSecurity. In intricate detail, complete with screenshots of his process as well as a mindmap of his data points, Krebs excavates the dozens of online pseudonyms, email addresses, and posts in hacker forums linked to Hutchins\u2019 early online accounts. He manages to link Hutchins to several online personas involved in selling malicious software on hacker forums.<\/p>\n