FBI solves mystery surrounding 15-year-old Fruitfly Mac malware | Hacker News Reader

FBI solves mystery surrounding 15-year-old Fruitfly Mac malware

zdnet.com

97 pointscurtis51 comments

Very detailed background on Durachinsky here: https://www.cleveland.com/court-justice/index.ssf/2018/02/th...

ZDNet has some more background on the case here: https://www.zdnet.com/article/fbi-solves-mystery-surrounding...

Wow, apparently he designed this when he was only 14 years old, and it was good enough to go undetected for another 14 years. Yet another example of why locking down open ports should be taken seriously.

I’m curious about the arrest. Was he still making use of it? Isn’t there a statute of limitations? Especially concidering he was a minor at the time?

> US authorities say he created the Fruitfly Mac malware (Quimitchin by some AV vendors) back in 2003 and used it until 2017...

What does "used it" mean?

The government typically makes grandiose statements that sound impressive and make the accused sound like the devil himself but reality is almost always an order of magnitude more mild.

Unless I hear otherwise I'm gonna assume it was just pinging back to some C&C infrastructure he owned or something like that.

> Court documents[0] reveal Durachinsky wasn't particularly interested in financial crime but was primarily focused on watching victims, having collected millions of images on his computer, including many of underage children.

[0] https://www.scribd.com/document/389668977/Durachinsky-Indict...

> including many of underage children

This makes him sound like a pedophile, but given that he created it at 14, he could watch "children" older than himself.

Except he continued using it until he was 28.

But now we're circling back to - what does "used it" mean?

Well the relevant thing here is that he still had the pictures on his computer. Maybe he was taking pictures of 15 year olds when he was 14 or whatever, but they arrested a 28 year old man whose hard drive was full of images of people that are at most 17 years old.

He could have deleted the pictures though. I find it hard to believe those pics would still be on a 14 year old drive.

This is a computer guy. Nobody would be surprised if he had spare hardware lying around from as far back as the 90s. If he just quick-formatted a bunch of spare drives and tossed them on a shelf years ago any forensics software would find what was on them before he formatted them. Considering that he's been collecting pictures since he was 14 I think it would be hard not to get him for possession if he's a hardware pack-rat.

Without details all we can do is speculate.

That's a good point. I would probably forget about old drives as well - I thought they found the pictures on an active drive but realise now that this was a baseless assumption.

Legal system doesn't particularly care about that

To be clear, I mean that the the way US laws are enforced, to the best of my knowledge, being underage yourself doesn't mean you are off the hook for having underage material.

I'd be interested to learn if this isn't the case.

What if I'm 30 and have sexual images of my own teenage self that I myself took in the mirror, say, 15 years ago? This just seems insane

Yeah, to the best of my knowledge.

> one mystery remained. How was this malware infecting victims, and how was its creator spreading it around.

> The attack vector included the scanning and identification of externally facing services, to include the Apple Filing Protocol (AFP, port 548), RDP or other VNC, SSH (port 22), and Back to My Mac (BTMM), which would be targeted with weak passwords or passwords derived from third party data breaches.

Between your two quotes you are missing this one:

> But this mystery was solved earlier today by Wardle

No, it was solved by the FBI, Wardle merely communicated that it had been solved.

It depends on what "it" refers to. If "it" refers to no one except Durachinsky knowing how it spread, then yes, "it" was solved by the FBI a long time ago. If "it" refers to no one outside the FBI and Durachinsky knowing how it spread, then "it" was solved earlier "today" by Wardle.

> The attack vector included the scanning and identification of externally facing services [..] which would be targeted with [..] passwords derived from third party data breaches.

This is an interesting notion, that people's home computers can be hacked by using their passwords from online data breaches.

It's not their password, per se, it's just using low-entropy (=common) passwords to get access where people were lazy.

And the best way to find common passwords is by using frequency analysis from prior breaches.

It's definitely clever, but it's also not super innovative - kind of a standard tool in the toolbox.

> But this mystery was solved earlier today by Wardle, who discovered an FBI flash alert sent earlier this year, on March 5. The FBI sends "flash alerts" to businesses detailing ongoing "threats" and details ways to prevent against them.

Just what did Wardle solve here? The FBI solved it.

Actually, it appears that Case Western solved it:

> The university identified more than 100 computers with active internet connections that were infected by malware. Agents learned the computers had been compromised for a few years, the affidavit says.

> The university also found an IP address, a number that identifies its location on the internet, associated with the malware was also used to access Durachinsky's alumni email account, Brian wrote.

He solved the fact that the general public didn't know how the malware spread.

So, how many more of these would there be in the wild? Given that this went undetected for as long as it did there have to be more.

Was there anything particularly special or intrusive about the virus? I'm struggling to see the significance of the news. Surely viri of this caliber are written and deployed all the time, no?

The fact that it lay undetected for 17 years, and was able to use the webcams of those infected.

Part of the reason it lay undetected was that he was using it primarily for child exploitation, and not for financial gain, which is typically how evidence of malware rapidly turns up.

Child exploitation is not true. He was spying people, not especially children.

>I'm struggling to see the significance of the news

For one, there was an arrest. It's not like the news is about the mere existence of such a virus.

I guess because nobody uses macs, despite the bubble we live in

this was just nobody looked because it wasn't that popular to look

>I guess because nobody uses macs, despite the bubble we live in

Nobody as in a solid 8-10% of the US market?

http://gs.statcounter.com/os-market-share/all/united-states-...

my point exactly.

> this was just nobody looked because it wasn't that popular to look

do you have a rebuttal to that?

>my point exactly.

Point being what? You said "nobody" (of course implying very small number) and it's 10%, which is tens of millions of people. Not only that, but it's the most lucrative 10% of the US computer-buying population. So, the "nobody" point is already taken down.

>> this was just nobody looked because it wasn't that popular to look > do you have a rebuttal to that?

That's an even worse argument. Not only the user base is large enough, but Apple news (including Mac news) receive close, or often even more publicity than Windows developments (especially any negative news). Besides there are lots of decade+ spanning cases like that on Windows side too, which, you'd have to agree, is not an unpopular platform.

The reason it went undetected all these years is already revealed in TFA: "it infected a very small number of victims".

> TFA

just breathe

Wouldn’t that mean the webcam light would be turned on, though? It’s supposed to be hardware-linked...

IIRC you can turn it on and off quick enough for the LED to be barely noticeable

No, it has been software for many years.

But I recall seeing something recent that Apple was trying to make it hardware linked now.

It is hardware linked.

Which models? And please provide a reference.

Not on iOS devices

…which don't have a light? I don't see what your point is.

I am surprised he would find any mac directly connected to the internet post 2003-2004. Unless you are connecting with 3g/4g directly, you are always behind at least a nat.

For IPv4, at least, if you connect via 3/4g you're going to be behind CGNAT. Far as I'm aware, there are no mobile operators left that don't NAT IPv4 traffic. IPv6 is different, of course, but I'm uncertain how well 14yo malware is going to deal with IPv6.

Plus good luck scanning the ipv6 address space.

Massscan upgrade needed.

IPv6 is 20 years old

But 14y ago you would be lucky to even have an ISP that would allow you to send an IPv6 packet.

My university connects everyone one the wifi directly to the internet... as an example.

Reply on news.ycombinator.com