FBI Solves Mystery Surrounding 15-Year-Old Fruitfly Mac Malware Which Was Used By a Man To Watch Victims Via their Webcams, and Listen in On Conversations (zdnet.com)

The FBI has solved the final mystery surrounding a strain of Mac malware that was used by an Ohio man to spy on people for 14 years. From a report: The man, 28-year-old Phillip Durachinsky, was arrested in January 2017, and charged a year later, in January 2018. US authorities say he created the Fruitfly Mac malware (Quimitchin by some AV vendors) back in 2003 and used it until 2017 to infect victims and take control off their Mac computers to steal files, keyboard strokes, watch victims via the webcam, and listen in on conversations via the microphone. Court documents reveal Durachinsky wasn't particularly interested in financial crime but was primarily focused on watching victims, having collected millions of images on his computer, including many of underage children. Durachinsky created the malware when he was only 14, and used it for the next 14 years without Mac antivirus programs ever detecting it on victims' computers. [...]

Describing the Fruitfly/Quimitchin malware, the FBI said the following: "The attack vector included the scanning and identification of externally facing services, to include the Apple Filing Protocol (AFP, port 548), RDP or other VNC, SSH (port 22), and Back to My Mac (BTMM), which would be targeted with weak passwords or passwords derived from third party data breaches." In other words, Durachinsky had used a technique know as port scanning to identify internet or network-connected Macs that were exposing remote access ports with weak or no passwords.

Comments

What do you charge him with?

[techno-vampire]

Judging from TFS, he was just the cyber equivalent of a peeping tom. And, if he was only 14 when he started, I don't know if you could really call him a pedofile if the pictures were of girls his own age.

Re:What do you charge him with?

[Anonymous Coward]

>Judging from TFS, he was just the cyber equivalent of a peeping tom.

Hardly.

2. During his more than thirteen years of accessing protected computers without the appropriate authorizations,
Defendant accessed protected computers owned by local, state and federal governments, a police department, schools, companies and individuals.
3. Defendant developed computer malware later named "Fruitfly" and wrote variants capable of infecting computers running macOS and Windows operating systems.
4. Defendant installed the Fruitfly malware on thousands of computers ("Fruitfly
victims").
5. The Fruitfly malware gave Defendant the ability to control a Fruitfly victim's computer by, among other things, accessing stored data, uploading files to a Fruitfly victim's computer, taking and downloading screenshots, logging a user's keystrokes and turning on the camera and microphone to surreptitiously record images and audio recordings.

Read the rest of the indictment here: https://www.justice.gov/opa/press-release/file/1024116/download

I don't know what the guy's job is now, but after he gets out of prison I'm thinking the CIA may want to hire him.

Re:What do you charge him with?

[Anonymous Coward]

Age does not matter when it comes to pornographic images of minors. There have been people under 18 who have gotten in trouble for sexting pictures of themselves, which is technically production & distribution of child pornography.

Re:What do you charge him with?

[alvinrod]

There's an assumption in there that all of the images, videos, or other material of underage individuals was something that he captured decades ago. I'm not going to pretend to have a good understanding of this person. Most people don't write malware to infect thousands of different individuals, so this guy is probably somewhere outside of our understanding in some ways. I'm also not sure what being able to spy on people all of the time from age 14 does to a person's mind and how it might affect development. Even if you somehow started out "normal", I think that might warp a person a little bit.

Also, most 14 year old boys are interested in older women, not 14 year old girls. At that age we were trying to get a Playboy to look at naked women, not naked girls. Of course when you're 14, adult women want absolutely nothing to do with you, so you have to settle for someone your own age. But if you're still interested in 14 year old girls after 18, there may be something wrong with you or you might be developmentally stunted in some way.

Re: What do you charge him with?

[drew_kime]

That is a load of pure horseshit. Just because you had a "thing" for your mother doesn't mean the rest of us did.

No, I definitely had a thing for his mother.

Re:WHY are you APOLOGIZING for a PEDO?

[Opportunist]

Do you know where the data you had 14 years ago is? Every single HD you ever owned, every single CD you ever burned? Can the hysteria, please.

Re:One wonders if others used this

[AHuxley]

Some news on the Mac functionally
OSX/FruitFly
https://objective-see.com/blog...
"New Mac backdoor using antiquated code"
https://blog.malwarebytes.com/...

So they charged a peeping tom

[140Mandak262Jamuna]

... who was looking through windows without drapes ....

Re:So they charged a peeping tom

[Sideshow Mark]

... who was looking through windows without drapes ....

Um, he was looking through Macs, not Windows.

Parent has some good points...

[bussdriver]

The FBI comes in and they image everything you've got that they find.

You might be safe now but in the future legitimate things you have might become crimes. You don't know what that might be; even if you do, like parent said, your old backups get lost or the old computer in the basement you didn't recycle or give away because you've not wiped it clean and put that off...

Think about something innocent not this guy's stuff-- and a decade from now the mere possession or mention of such things is a crime. You are not charged with a crime back in time (not allowed) but instead are charged for currently having such materials.

This could be the Anarchist's Handbook you got online in the 90s because everybody was making a fuss about the silly thing. Then after 9/11 they find that in your stuff and get you as a terrorist!

Think.

Way to focus!

[ArhcAngel]

I love how most of the comments are debates on whether the guy is a pedo or not and virtually none so far has addressed the fact that this vulnerability has been in use for fifteen years! I can't believe the Mac haters aren't piling on. Come on guys...don't let me down!

Re:Way to focus!

[angel'o'sphere]

I just looked into my task manager on my Mac.
There is is no fruitly.exe running at the moment!

Re:WHY are you APOLOGIZING for a PEDO?

[Anonymous Coward]

He was producing cp up until last year when he was arrested.

ged and incorporated by reference as if fully set forth herein.
15. From on or about October 25, 2011 through on or about January 14, 2017, in theNorthern District of Ohio, Eastern Division, and elsewhere, Defendant PHILLIP R.DURACHINSKY did use a minor and minors to engage in sexually explicit conduct, as defined in Title 18, United States Code, Section 2256(2), for the purpose of producing a visual depiction of such conduct, knowing and having reason to know that such visual depiction would be transported and transmitted, using any means and facility of interstate and foreign commerce, and in and affecting interstate and foreign commerce; such visual depiction was produced and transmitted using materials that had been mailed, shipped and transported in and affecting interstate and foreign commerce; and such visual depiction was actually transported and transmitted, using any means and facility of interstate and foreign commerce, and ...