Even as a child, Phillip Durachinsky made headlines with his computer skills.
Ohio newspapers profiled the high schooler for his back-to-back programming championship wins in 2005 and 2006, but the FBI claims Durachinsky was already years into a hacking career that would lead to his indictment on hacking, child porn, wiretapping, and identity theft charges Wednesday.
From 2003 until 2017, feds say, Durachinsky led an escalating series of hacks. His alleged masterpiece was a spyware called “Fruitfly,” which could record people without their knowledge and collect personal records. The virus also allegedly collected banking records, personal communications, and pornography searches, giving Durachinsky millions of pieces of compromising material on victims. It was a culmination of hacks the Ohio man had carried out since 2003, when he was just 13, feds say.
ADVERTISEMENT
As a high school senior in 2007, Durachinsky told his local newspaper that he hoped to write a program that would make his computer play music (PDF). Durachinsky was in the spotlight as he prepared to enter a high school computer programming competition, which he and a teammate had won the previous two years. A teacher told the paper that Durachinsky had taken every computer class the school had to offer.
“It’s about teamwork, knowing your strengths and weaknesses to help the team,” Durachinsky said. “I’ve been surprised at how well we’ve done.”
A former classmate from Durachinsky’s high school programming club remembered him as “very knowledgeable and clever with computers.” “He talked about a lot of fairly advanced computer things,” the former classmate told The Daily Beast. “All stuff that I ended up learning about in my Computer Science undergrad classes later though.”
But away from the headlines, Durachinsky was working on another project, according to an federal indictment that claims he began hacking computers in 2003.
Soon, Durachinsky allegedly graduated to building spyware. Beginning August 2011, when he would have been entering his senior year at Case Western Reserve University, Durachinsky allegedly released his spyware.
Like a fly on the wall, Fruitfly could see victims inside their homes. The spyware could turn on computers and microphones in infected computers, and record without the victims’ knowledge, according to the indictment, which lists multiple instances in which Durachinsky allegedly used the microphone to snoop on private conversations.
The program also allegedly took pictures of banking information, emails, medical records, and in some cases “alerted Durachinsky if a user typed words associated with pornography,” the Department of Justice said in a press release. “According to the indictment, Durachinsky saved millions of images and often kept detailed notes of what he saw.”
Durachinsky is also accused of creating and distributing child pornography from 2011 to 2017, although the indictment does not specify whether he obtained the illegal footage from hacked computers.
But a slip-up on a school computer would be Durachinsky’s downfall.
In January 2017, security researchers found malware on computers at Case Western. An FBI investigation found more than 100 school computers infected with a mystery bug, which had been on the machines “for several years,” according to a separate criminal complaint filed last year.
But Durachinsky hadn’t covered his tracks, authorities said. The malware was associated with an IP address, which Durachinsky had also used to access his alumni email account, investigators found.
Days after researchers found the bug on Case Western’s computers, the FBI seized Durachinsky’s laptop, where they found the control system for the malware, and detailed notes including social security numbers and passwords scraped from the infected computers.
That investigation appears to have been the basis for the Wednesday indictment against Durachinsky, which alleged Fruitfly had infected thousands of computers.
“This defendant is alleged to have spent more than a decade spying on people across the country and accessing their personal information,” First Assistant U.S. Attorney David Sierleja said in a statement.
It’s unclear if Durachinsky ever built the music program he wanted to create as a teenager.
