7 ms·
FBI solves mystery surrounding 15-year-old Fruitfly Mac malware
- sverige 8y agoWow, apparently he designed this when he was only 14 years old, and it was good enough to go undetected for another 14 years. Yet another example of why locking down open ports should be taken seriously.
- donatj 8y agoI’m curious about the arrest. Was he still making use of it? Isn’t there a statute of limitations? Especially concidering he was a minor at the time?
- molecule 8y ago> US authorities say he created the Fruitfly Mac malware (Quimitchin by some AV vendors) back in 2003 and used it until 2017...
- dsfyu404ed 8y agoWhat does "used it" mean? The government typically makes grandiose statements that sound impressive and make the accused sound like the devil himself but reality is almost always an order of magnitude more mild. Unless I hear otherwise I'm gonna assume it was just pinging back to some C&C infrastructure he owned or something like that.
- jjjjjjjjjjjjjjj 8y ago> Court documents[0] reveal Durachinsky wasn't particularly interested in financial crime but was primarily focused on watching victims, having collected millions of images on his computer, including many of underage children. [0] https://www.scribd.com/document/389668977/Durachinsky-Indictment https://www.scribd.com/document/389668977/Durachinsky-Indict...
- golergka 8y ago> including many of underage children This makes him sound like a pedophile, but given that he created it at 14, he could watch "children" older than himself.
- Bjartr 8y agoLegal system doesn't particularly care about that
- Bjartr 8y agoTo be clear, I mean that the the way US laws are enforced, to the best of my knowledge, being underage yourself doesn't mean you are off the hook for having underage material. I'd be interested to learn if this isn't the case.
- opencl 8y agoExcept he continued using it until he was 28.
- GranPC 8y agoBut now we're circling back to - what does "used it" mean?
- 8y ago
- simula67 8y ago> one mystery remained. How was this malware infecting victims, and how was its creator spreading it around. > The attack vector included the scanning and identification of externally facing services, to include the Apple Filing Protocol (AFP, port 548), RDP or other VNC, SSH (port 22), and Back to My Mac (BTMM), which would be targeted with weak passwords or passwords derived from third party data breaches.
- askmike 8y agoBetween your two quotes you are missing this one: > But this mystery was solved earlier today by Wardle
- jacquesm 8y agoNo, it was solved by the FBI, Wardle merely communicated that it had been solved.
- Buge 8y agoIt depends on what "it" refers to. If "it" refers to no one except Durachinsky knowing how it spread, then yes, "it" was solved by the FBI a long time ago. If "it" refers to no one outside the FBI and Durachinsky knowing how it spread, then "it" was solved earlier "today" by Wardle.
- iopuy 8y agoWas there anything particularly special or intrusive about the virus? I'm struggling to see the significance of the news. Surely viri of this caliber are written and deployed all the time, no?
- newnewpdro 8y ago> But this mystery was solved earlier today by Wardle, who discovered an FBI flash alert sent earlier this year, on March 5. The FBI sends "flash alerts" to businesses detailing ongoing "threats" and details ways to prevent against them. Just what did Wardle solve here? The FBI solved it.
- ianhawes 8y agoActually, it appears that Case Western solved it: > The university identified more than 100 computers with active internet connections that were infected by malware. Agents learned the computers had been compromised for a few years, the affidavit says. > The university also found an IP address, a number that identifies its location on the internet, associated with the malware was also used to access Durachinsky's alumni email account, Brian wrote.
- Buge 8y agoHe solved the fact that the general public didn't know how the malware spread.
- jacquesm 8y agoSo, how many more of these would there be in the wild? Given that this went undetected for as long as it did there have to be more.
- cm2187 8y agoI am surprised he would find any mac directly connected to the internet post 2003-2004. Unless you are connecting with 3g/4g directly, you are always behind at least a nat.
- jfindley 8y agoFor IPv4, at least, if you connect via 3/4g you're going to be behind CGNAT. Far as I'm aware, there are no mobile operators left that don't NAT IPv4 traffic. IPv6 is different, of course, but I'm uncertain how well 14yo malware is going to deal with IPv6.
- cm2187 8y agoPlus good luck scanning the ipv6 address space.
- stephengillie 8y agoMassscan upgrade needed.
- zeckalpha 8y agoIPv6 is 20 years old
- cm2187 8y agoBut 14y ago you would be lucky to even have an ISP that would allow you to send an IPv6 packet.
- gpm 8y agoMy university connects everyone one the wifi directly to the internet... as an example.
- fouc 8y ago> The attack vector included the scanning and identification of externally facing services [..] which would be targeted with [..] passwords derived from third party data breaches. This is an interesting notion, that people's home computers can be hacked by using their passwords from online data breaches.
- appleflaxen 8y agoIt's not their password, per se, it's just using low-entropy (=common) passwords to get access where people were lazy. And the best way to find common passwords is by using frequency analysis from prior breaches. It's definitely clever, but it's also not super innovative - kind of a standard tool in the toolbox.
- ilamont 8y agoVery detailed background on Durachinsky here: https://www.cleveland.com/court-justice/index.ssf/2018/02/the_road_from_computer_whiz_to.html https://www.cleveland.com/court-justice/index.ssf/2018/02/th... ZDNet has some more background on the case here: https://www.zdnet.com/article/fbi-solves-mystery-surrounding-15-year-old-fruitfly-mac-malware/ https://www.zdnet.com/article/fbi-solves-mystery-surrounding...