Hacker News Reader

Comment by holtalanm | Hacker News Reader

I'm curious what charges are being brought against him. For all we know, this detention is completely unrelated to WannaCry. We shall see.

View on HN

I may be totally off base here but IIRC, before he ran MalwareTech and was a whitehat, he participated (and was an op) in fairly "shady" IRC channels, with his oldest nick I can recall being `Ntoskrnl`, dedicated to malware and malware development which even had a person (Edit3: As pointed out in this thread, that person was `BetaMonkey/TouchMe`) who was selling a variant of a botnet drone client builder. Edit2: From one of the comments below in this thread, the network on which he was present (and was an IRC operator of) was `irc.voidptr.cz` or a variation of that, I could not recall the name of the network at first but when someone mentioned it, I instantly recognized it.

If he's who I think he is, I doubt his early background is that clean, despite him being a whitehat now. It is very much possible he is being held because of something related to that and not because of anything related to WannaCry. This was all before he even started running the MalwareTech blog, it's very much possible the FBI decided to look into his background or were already familiar with it prior to him arriving in or leaving the US.

That being said, it's possible that I'm mistaking him for someone else in which case I do apologize. I edited the post a bit, to clarify, the first paragraph to the best of my knowledge is certainly true, second one is based on my own speculation so take it with a grain of salt.

Instead of apologizing for potentially spreading FUD and falsehoods, maybe you should refrain from posting until you have actual facts in hand?

Like the article itself?

> maybe you should refrain from posting until you have actual facts in hand?

Yeah, like the rest of the people commenting here, right? They have all the facts.

The grandparent is making a good point. It is entirely possible that the researcher is being prosecuted for something related to his past. It's not likely that he's being prosecuted for smuggling a small amount of drugs (for example), the FBI wouldn't be the one making the arrest. Even if all the activities he has done in the past are completely legal the FBI could still try to wring him for them.

There's an equal number of FUD and speculation going the other way, e.g. that he was arrested for no reason or that he was "disappeared".

Kind of like the assumptions as to why he was arrested?

I can confirm that christina_b is correct and sbarre can rest easy knowing that nobody is being defamed.

He ran a carding forum in the past, malkit.ws and then malkit.su.

Virustotal passive DNS shows that it was hosted for a time on the same server as his old irc, irc.voidptr.cz

https://www.virustotal.com/en/ip-address/188.190.99.148/info...

Was it him or BetaMonkey running this? If I recall correctly BM owned voidptr but both had admin access there?

EDIT: Ah, found some old logs on google: http://www.exposedbotnets.com/2013/05/hf-elite-coding-team.h...

  [08:08] <TouchMe> if i still owned this irc
  [08:09] <TouchMe> i would shut it down and start over

BetaMonkey/TouchMe was in fact the person I was referring to who was providing support for his botnet drone builder until he dissapeared with no trace at a later date. Just could not recall the nick at the time of making my original post.

I always assumed the two to be different people. The log shows the two of them talking at the same time, and I remember the two of them having very different attitudes in general.

I know TouchMe is malwaretech but would be inclined to assume that BetaMonkey isn't.

TouchMe was still a malware developer though, and apparently used to run voidptr before handing it over to BetaMonkey.

I was pretty sure TouchMe was BetaMonkey's new nick, I don't think it was Ntoskrnl (MalwareTech). From what I've heard TouchMe continued support of his drone's users until he dissapeared without a trace. This was so long ago and my memory isn't amazing.

TouchMe is MalwareTech, 0 doubt https://twitter.com/touchmymalware

If BetaMonkey==TouchMe then they were trying really hard to conceal that.

Here's a hackforums thread mentioning some other malware TouchMe was distributing though https://hackforums.net/showthread.php?tid=3786935

> TouchMe is MalwareTech, 0 doubt https://twitter.com/touchmymalware

If I was a bad man in the security profession who was certain he was anonymous, I'd point to someone else who was a security professional on twitter when I vanished too.

It just y'know, wouldn't have been me.

That tweet was in 2013 however.

If you tweet and stop using an account that is what happens and that was a shady group of people in 2013.

pfft.

I used to talk to this guy on a malware dev IRC on a daily basis, he started a blog "TouchMyMalware" which eventually evolved into Malwaretech.

This is all easily verifiable with google and archive.org.

And lol, apparently some twitter user dug up logs of him offering to sell me a rootkit for $20k https://twitter.com/jeremiahg/status/893207272154734592

That just looks like standard IRC bantz though. Do you know if he was actually trying to sell/weaponize the malware he was developing? (I assume he was, given the indictment, but can't hurt to ask.)

I'd go with "no doubt" for both. Although I'd assume he'd have loved the $20k if it was actually on the table.

Sup ryan, remember me? i used to chill on voidptr sometimes too. I don't know why everyone is so surprised by this

"he's a fucking genius because he got us all" https://twitter.com/x0rz/status/893203106338680832

> This is all easily verifiable with google and archive.org.

Yes. And I've had a hostile fellow once upon a time put my RL info in the whois and post a bunch of shit on it. I generally give people the benefit of the doubt when its random online public stuff until they are convicted.

The internet "evidence" is way too flimsy to be considered reasonable standards of proof imho.

Okay, never fear! In that case I will provide you with irrefutable proof.

Navigate to: https://web.archive.org/web/20131031200609/https://twitter.c...

Pick any of the tweets, copy the direct link to that tweet.

You'll end up with something like this: https://web.archive.org/web/20131031200609/https://twitter.c...

Now remove the archive.org part from the beginning: https://twitter.com/TouchMyMalware/status/395862786602827776

Click on the link and boom you're suddenly redirected to https://twitter.com/MalwareTechBlog/status/39586278660282777...

Here's also an archive.org link showing the account with the "TouchMe" name on it: https://web.archive.org/web/20130710045915/https://twitter.c...

Happy?

> Now remove the archive.org part from the beginning: https://twitter.com/TouchMyMalware/status/395862786602827776

> Click on the link and boom you're suddenly redirected to https://twitter.com/MalwareTechBlog/status/39586278660282777....

> Okay, never fear! In that case I will provide you with irrefutable proof.

> Happy?

https://twitter.com/TouchMyMalware/status/893243147580473344

You proved he is Donald Trump?

I'm not trying to pick a fight here so just chill and move on. We aren't going to agree.

>I'm not trying to pick a fight here so just chill and move on. We aren't going to agree.

Yes, I'm sorry I didn't immediately realize that you were just trolling. If not, you might want to look at the parts of my post you decided not to quote.

Even better -- Here's someone @'ing TouchMyMalware and then MalwareTechBlog replying "Thanks for the tweet, also my new twitter handle is @MalwareTechBlog"

https://twitter.com/MalwareTechBlog/status/40533646447018393...

Betamonkey was someone different. The reason he disappeared without a trace was that he was so bad at PHP that people got sent to prison (his support site was owned by a whitehat and all the customer information was harvested and distributed to law enforcement)[0].

Touchme/Marcus was a close friend of his though, one of his first articles on the site that eventually became malwaretech.com was an attempt to disprove the claim that betamonkey's malware was banking malware. This had gotten him banned from selling on hackforums, his main source of customers at the time. You have to read the article on the way back machine, for some reason he deleted it from his site later on [1].

If I were betamonkey I would be sweating pretty hard right now, his malware is also still being used and Marcus will be looking hard for someone else to drag under the bus.

[0] http://www.xylibox.com/2015/04/betabot-retrospective.html [1] https://web-beta.archive.org/web/20130625172146/http://touch... (halfway down the page)

I don't think he directly ran his own IRC, it was a "in partnership with another organization" sort of thing.

Here it is

> For anyone still into IRC, MalwareTech has partnered with sigterm.no to launch a new IRC network. It’s still fairly new so don’t expect an instant response, but everyone is welcome (socializing or just asking for help).

https://www.malwaretech.com/2014/10/new-irc-launc.html

Different irc, different time. Look at the timestamps on VT, we're talking about 2013 stuff :)

> For all we know, this detention is completely unrelated to WannaCry.

No everyone has already determined 'wow he did a good deed' and 'us law enforcement bad'.

The fact is he is linked to this event and a person of interest who they want to get more info from. As such it makes total sense they would detain him for some questioning searches and so on.

If you are someone who stops a crime you will also get questioned by the police. For all they know you are covering your own tracks and had a role in the crime. This is almost a cliche in movies and tv.

Everyone's determined 'us law enforcement bad' because it doesn't matter what crime he may or may not have committed. He was arrested in the US, which means he may be tortured or murdered, and if he's sentenced he almost certainly will be tortured through means such as prisoner assaults, permanent solitary confinement or abuse, or god knows what else. And heaven forbid he's sent to a military prison. He will never come out again.

If you believe the USA is so terrible then push for sanctions against them. Its better than wringing your hands anytime one of our longtime allies decides to arrest a alleged criminal.

> If you are someone who stops a crime you will also get questioned by the police. For all they know you are covering your own tracks and had a role in the crime. This is almost a cliche in movies and tv.

Yup. Law enforcement is not obliged to assume his innocence.

I understand your point of view, but I don't share it. First, asking questions doesn't require to detain people. Second, that person is not an American citizen. Unless he committed crimes on the American soil, which might be the case, handling foreign visitors like that is puzzling to say the least.

Reply on news.ycombinator.com