> A number of people have pointed out that would be taking the extremely ridiculously long game for an alibi - why would the author ask for a copy of his own code?

If I was greedy and in the security field, with identities (or middlemen) on both sides of the game, I would be terribly tempted to play those identities to support each other. For example when blackhat-me would be selling an exploit, whitehat-me could create buzz by talking about it. Later, when the exploit's market value drops towards zero (ip enforcement is weak on the darknet), whitehat-me could reap the glory of discovering all the details about the exploit, maybe even using some "mistakes" blackhat-me left in the code to facilitate plausible parallel construction.

What are all those ifs having to do with the WannaCry situation? Probably nothing, hopefully nothing. Or maybe hopefully a lot, because it would mean that the FBI did not lock up the wrong guy?

I feel like you just described the business model of every anti-virus company ever.

Are they petty enough to sell exploits? Kaspersky, for example, is so deep in bed with FSB that it's hard to tell exactly where one ends and the other starts; I really doubt FSB would bother selling exploits to anyone.

He's not personally accused of selling Kronos in the indictment; his unnamed co-conspirator is.

(That co-conspirator is unnamed to us, but most probably is someone clearly known to the DOJ).

The indictment itself is pretty bare. But an indictment isn't a trial; the DOJ will need to prove its charges to a jury with a considerable amount of evidence, and, as Orin Kerr pointed out last night, they have an uphill climb ahead of themselves, because the letter of the law is favorable to people who create and sell banking trojans.

> most probably is someone clearly known to the DOJ

not probably. the first line of the indictment is "Defendant [redacted] used the online aliases [redacted].

https://www.documentcloud.org/documents/3912549-MalwareTechB...

I would imagine when he allegedly sold the malware it wasn't named "Kronos". He could have had no idea at the time that the specific campaign was his code, or perhaps had a suspicion and wanted to confirm it.

There's a video demonstration of the tool we're talking about. Nobody who has watched it is going to for a moment entertain the idea that the author of this tool didn't understand its intention. Its purpose is extracting financial information from botnets.

That doesn't seem to be a reply to GP's post.

If you wrote some malware and people were passing around copies of it, wouldn't you want to see the source of what they were passing around?

My personal opinion, until shown evidence otherwise, is this is the real author/seller being turned into an informant, and part of that process, the first step, is to protect the informant and smear another. MTB's high profile on the issue may mean he was a target of opportunity.

Of course I could be wrong, so time will tell. A good future indicator of this will be if the case is dropped as quietly as possible.

Anecdotal, but I did things that were a lot more paranoid than "tweeting myself" when I was doing questionably legal things on the internet as a 13 year old.

So to me, tweeting "I want a sample of Kronos" is indicative of nothing.