Two men have been arrested for reportedly creating an app that steals private photos using an activity known as 'fusking
Fusking software is designed to scour photo hosting sites and effectively guess the name of files even if they haven't been publicly shared.
And Brandon Bourret, 39, from Colorado Springs and Athanasios Andrianakis, 26, from Sunnyvale, California are accused of using and selling such software to infiltrate files on Photobucket for almost two years.
According to the US Department of Justice, between 12 July 2012 and 1 July 2014, the pair 'knowingly conspired to commit acts and offenses, namely computer fraud and abuse, access device fraud, identification document fraud and wire fraud.'
As part of this alleged illegal activity, Bourret and Andrianakis developed and sold an app called 'Photof****t.'
It let viewers bypass the privacy settings of the image and video hosting website Photobucket.com and access and copy users private and password protected information, images and videos without permission.
The DoJ said the conspirators used Photof****t to obtain guest passwords to access users' password protected albums.
They also allegedly transferred guest passwords to others who paid to use the Photof****t app.
'Fusking' isn't new.
The term 'fusker' is a Danish term, taken from the German 'pfuscher' which refers to a 'bungler' who carries out a 'botch job'.
When photos are taken on a camera or phone, for example, and, unless they are given a specific name, the image titles usually follow a sequence.
For example, by the time a photo has been named DSC_010.jpg, there is the assumption that images titled DSC_001.jpg to DSC_009.jpg have also been taken and stored.
On Photobucket, albums can be shared publicly, privately or protected by a password.
However, regardless of which privacy setting has been selected, each individual image is given a unique URL that differs based on the photo's title.
And if a user shares this URL with a friend, that recipient can view the photo without entering a password or being given access to the private file.
As a result, 'fusking' software can find a photo that has been shared publicly online, and then guess the URLs of the other images in the collection - even if they're private or protected.
'It is not safe to hide behind your computer, breach corporate servers and line your own pockets by victimising those who have a right to protected privacy on the internet,' said US Attorney Walsh.
'The US Attorney's Office is keenly focused on prosecuting those people for their theft - and for the wanton harm they do to innocent internet users.'
Although photobucket isn’t as popular as it once was, there are still said to be thousands of dormant accounts.
Reports also suggest the hackers would target people with attractive profile pictures, in the hope that their accounts may contain nude photos.
Bourret and Andrianakis both face one count of conspiracy, which carries a penalty of not more than five years in federal prison and up to a $250,000 (£158,000) fine.
They each face one count of computer fraud, aid and abet, which also carries a penalty of not more than five years in federal prison and up to a $250,000 (£158,000) fine.
Finally, they each face two counts of access device fraud, which carries a penalty of not more than ten years in federal prison, and up to a $250,000 (£158,000) fine, per count.
This case is being prosecuted by Assistant US Attorney David Tonini.
The charges contained in the indictment are allegations and the defendants are presumed innocent unless and until proven guilty.
The indictment did not reveal how many Photobucket accounts were hacked or how many copies of the Photof****t app were sold
