Russian Cyber Criminal Unmasked As Creator of "Most Successful" Apple Malware

DavidGilbert99 writes "It was the malware which affected as many Apple computers as the Conficker worm affected Windows PCs and earned its creator up to $10,000 per day. Until now, no one know who was behind the Flashback Trojan which hit 650,000 computers last year, but security researcher Brian Krebs has managed to uncover the creator as a 30-year-old Russian cyber criminal."

Comments

apples response?

[Nyder]

based on how they go after prototypes that get lost, you'd think they got an iDrone heading his way....

Cyber criminal

[fustakrakich]

Does this mean we won't hear the word 'hacker' anymore?

Russian spam

[slackware 3.6]

I had this nice Russian fellow spoofing my email to spam others when I discovered this (thanks to an email from an ISP admin in Denmark) I figured out who he was through his ISP in the Ukraine. I then proceded to phone him at 3am his time every day for weeks. It was awesome. Then after his wife stopped answering the phone and some complaints to his Ukraine ISP his internet service was canceled.

Bad summary

[Macman408]

The summary says: "It was the malware which affected as many Apple computers as the Conficker worm affected Windows PCs..."
This is obviously inaccurately rewritten from what Krebs said, which is "...Flashback [was] roughly as common for Macs as the Conficker Worm was for Windows PCs."

Those are not equivalent statements. The summary is equating raw numbers, while TFA is equating percentages.

Sorry, I just read that sentence and thought "no way in hell is that true." As confirmation, Wikipedia says Flashback hit 600,000 Macs, while Conficker infected between 9 and 15 million PCs.

Re:Bad summary

[Plumpaquatsch]

The summary says: "It was the malware which affected as many Apple computers as the Conficker worm affected Windows PCs..."
This is obviously inaccurately rewritten from what Krebs said, which is "...Flashback [was] roughly as common for Macs as the Conficker Worm was for Windows PCs."

Those are not equivalent statements. The summary is equating raw numbers, while TFA is equating percentages.

Sorry, I just read that sentence and thought "no way in hell is that true." As confirmation, Wikipedia says Flashback hit 600,000 Macs, while Conficker infected between 9 and 15 million PCs.

It should also be noted that Conficker wasn't the malware with the largest number of infections (which has often been claimed when that comparison was first made a year ago), let alone percentage of infected computers. That honor belongs to the ILOVEYOU virus from 2000.

  " Within ten days, over fifty million infections had been reported,[6] and it is estimated that 10% of internet-connected computers in the world had been affected."

Re:Bad summary

[oldlurker]

The summary says: "It was the malware which affected as many Apple computers as the Conficker worm affected Windows PCs..." This is obviously inaccurately rewritten from what Krebs said, which is "...Flashback [was] roughly as common for Macs as the Conficker Worm was for Windows PCs."

Those are not equivalent statements. The summary is equating raw numbers, while TFA is equating percentages.

Sorry, I just read that sentence and thought "no way in hell is that true." As confirmation, Wikipedia says Flashback hit 600,000 Macs, while Conficker infected between 9 and 15 million PCs.

You are right the summary can be interpreted as meaning actual numbers and not percentages. I didn't read it that way but maybe because I knew from before that Mac Flashback is the biggest malware epidemic in modern times in terms of percentage of user base affected (most accounts actually have it "beating" Conficker on Windows).

Of course the Windows user base is much bigger. But percentage of user base affected is the right metric to use if you want to look at risk of infection and infectability on a platform. This is still not a comparison Windows vs Mac in general, just the worst case from each platform. Windows currently has a longer tail of other cases of course. But it should be a much bigger wake-up call to the "Mac can't be infected" people than it was. Later versions of Mac Flashback did completely silent drive-by infection just by visiting a web page, not needing user interaction or admin password, something many Mac people still today seem to think only happens on Windows.

I wouldn't shed a tear

[PapayaSF]

I wouldn't shed a tear if malware authors and spammers started having fatal accidents. In fact, I'd love it if some tech billionaire had a private hit squad for just that purpose.

Re:I wouldn't shed a tear

[Anonymous Coward]

Well, if you ever have jury duty, I really hope you do try to get out of it. If all else fails, show them this comment and how you believe thats correct action.

Re:I wouldn't shed a tear

[srussia]

In fact, I'd love it if some tech billionaire had a private hit squad for just that purpose.

"I don't need no stinkin' hit squad! -- John McAfee

Re:I wouldn't shed a tear

[tehcyder]

I wouldn't shed a tear if malware authors and spammers started having fatal accidents. In fact, I'd love it if some tech billionaire had a private hit squad for just that purpose.

Indeed, I think they should being back public hanging (and disembowelling) for anyone caught stealing anything worth more than a loaf of bread. Those were the days! A nice family day out at Tyburn Tree, and if you were lucky they got the rope length wrong and someone's head was ripped clean off.

Proportionality is everything.

Re:I wouldn't shed a tear

[benjfowler]

The Chinese, the thugs that they are, are onto something.

Kill the chicken to warn the monkeys.

Re:I wouldn't shed a tear

[monzie]

Surely you don't want human beings DYING for spamming. I hate spam and spammers but that does sound a bit over the top.

Re:I wouldn't shed a tear

[tqk]

The guilty should live if for no other reason than to suffer the ridicule ...

Ridicule? $10,000/day and more than half a million computers pwned, he succeeded way beyond his wildest dreams! We can only dream about making a mark that big. No, I don't like malware and spam, but I do appreciate he did what he set out to do, spectacularly. Had I chosen that as a goal, I'd be beaming with pride right now.

Re:I wouldn't shed a tear

[PapayaSF]

If it's one stolen loaf of bread or one burglarized home, I agree. But when the victims number in the millions, that changes the proportionality.

Evidence?

[Alex Belits]

1. All that was mentioned is, that the person claimed to be an author of Flashback in a private message on a board for malware authors.

2. Translation is the image wrong. It says "I specialize in finding exploits and creating bots". Original Russian text is "[my] specialty is creating exploits and bots". The whole exchange is about the person communicating with mavook mentioning something that may be "stilll relevant" asking mavook how he would want to be introduced:

Hi!
Is it still relevant?
If so, respond with something like, nick, area of activity (how to introduce you).
We will solve the problem in 2-3 days.

mavook responds:

any random nick macbook for example
creator of flashback botnet for macs
specialty is creating exploits and bots

(Capitalization and punctuation, or lack of one, is preserved wherever possible.)

Hardly an evidence.

Re:Useless Russian police?

[some old guy]

Not useless, complicit.

Regarding the FSB, "There is no such thing as a former Chekist."- Vladimir Putin