7 ms·

Fortnite teen hackers 'earning thousands of pounds a week'

53 points by yawz 8y ago

deleted 8y ago
[deleted]
kjullien 8y ago
SWIM did something similar at a similar age on the game League of Legends. What is interesting was that at the time, most script kiddy programs to do the "cracking" would in fact work, but as soon as you found (bruteforced) a valid account it would be sent by the program in question to a main server, by the time somebody tried to do anything with the account, the credentials were long gone (stolen by the dev of the app). Essentially, they used the script kiddies as a server farm and free human labour, and from what I understood they made copious amounts of money, much more than the thousands they talk about in this article.
laumars 8y ago
I think the real issue here is not the kids doing the hacking but the parents who know what they’re doing and let them continue - even help them bank their earning in some instances. That makes the parents just as responsible in my opinion. We’ve all taken stupid risks as kids. I’d done my fair share of hacking too when I was younger. But I tread a very fine line because I knew my parents would have gone mental if I was caught. Just as I would if I found out my kids were doing something reckless and illegal. So to endorse such behaviour in their own children really doesn’t cast them in a good light. Sorry if this sounds high and mighty. I know comments about parenting often can sound “holier than thou”, but the parents in that article have crossed the line by in my personal opinion.
- sebcat 8y ago
  > I knew my parents would have gone mental if I was caught You hooked it up to the phone, didn't you? You screw up again and you won't get into college!
  - efdee 8y ago
    Dade! Turn the shower off!
- SonicSoul 8y ago
  Good points but it seems hacking is slightly different these days with high profile hackers (i.e. jailbreak dude) being invited on tv shows and getting lucrative work. There is still a fine line between criminal behavior and just pushing the boundaries, and whole companies are build on boundary pushing. So the question is probably as relatable to morality of your kids actions as much as legality. Just thinking outloud here that the whole meaning / stigma of hackers seems to trend towards positive / resume building these days.
  - JeremyBanks 8y ago
    The parents don’t need to be technical geniuses to distinguish between hacking your own devices and mass theft.
- kjullien 8y ago
  I don't agree that much with what you are saying, mainly from personal experience. 1. Even if parents find out they probably have no idea what it means (legally or literally) 2. You can open a bank account really easily online for free. (You can find photoshop ID templates for every possible country, maybe they check them more nowadays but some years ago you didn't even need to change any of the hashed numbers and it would be accepted by most services, even PayPal) 3. I did get caught at one point by my parents, they proceeded to take away every bit of technology they could find, so I ended up doing more shady stuff (on a lended machine at mcdonalds) to make enough to buy a new computer and keep on with life as usual. Had to re-buy a new computer every year or so when they found out. My perspective on the thing is that most parents won't even fathom the idea of what hacking is, so finding out their kid is a "hacker" won't change a thing in their day. And if it does a "hacker" will always find a way to keep on going anyway, trying to not get caught along the way, it's the job spec. Now what I can agree on is that if the kid tells their parents they're getting money illegally and asking their parents to hold it in their bank account, and the parents agree, then that's just plain stupidity, and a lot of that goes on in the world, parent or not parent...
  - yawz 8y ago
    May I ask, as a parent, what would have been the sensible approach to what you were doing from the point of view of your parents?
    - kjullien 8y ago
      I don't think I am able to answer this. If you took a bank robber instead of hacker you could ask the same question and if anybody had an answer to this I don't think there would be bank robbers in the world. edit: This actually feels like more of a personal philosophy type of thing. Say maybe I consider "borrowing" money from a big corp. that screws over the average working person at every chance it gets a good thing. They probably don't. You surely have your own opinion. Hope you see what I mean. edit2: actually now that I think about it, if you (as a parent) have prior knowledge of the field then you surely could spend quality family time orienting the kid in the right direction, while still keeping him happy doing the stuff he wants to do, namely "hacking". This way if he ever ventures too close to the thin line of legality you can be there to have a say in it and make him realize there is suc a thing. (Because to be honest at that time, I did have the notion that what I was doing was illegal, but no idea of what how consequences would affect me, I was a kid. It's the same as kids and the concept of death. Only now do I actually REALIZE that most of the stuff I did could have landed me years of prison time, even if you told me at the time I would not have cared, because being a kid and thinking you are hot shit all the time makes you try crazy stuff just to see how far you can take it)
- w8rbt 8y ago
  Some of the parents are probably under the impression that the activity is legitimate/legal. Kids can make a lot of money in technology (apps, games, mods, etc.). Parents may not be able to easily tell the difference. They just think they have a wonder kid and are proud.
  - laumars 8y ago
    The article suggested the parents were aware that their kids activities were illegal. Which was why I took objection.
- jmull 8y ago
  I don't know if this line from the article is what you're thinking about: > He said he knew what he was doing was illegal, but his parents were aware of his activities and had not stopped him. But the chances that those parents actually have a clear idea of what is going on are pretty damn slim.
- borkt 8y ago
  While I agree with your sentiment I wouldn't describe this as hacking, it is much closer to stealing someones car key and then the car (though the value is way off). This does not require any technical knowledge whatsoever apart from using ctrl-F on a password database.
  - laumars 8y ago
    I'd still describe it as hacking. Even seasoned pen testers have a suite of automated tools. The distinction you're making is pretty arbitrary as it's based on elitist ideologies; however I do agree with you that those teenagers are essentially just "script kiddies". I have say I think it's a pretty distracting argument to make because regardless of whether they understand the tools on a technical level, they understand what they are doing (hijacking peoples accounts and selling them on) and are aware that it is illegal. Surely that's the important takeaway here?
xfitm3 8y ago
What we really need is minimum authentication standards with incentives for compliance - password reuse isn’t limited to Fortnite.
- simeonOli 8y ago
  You'd think the incentive to not loose your account would be enough!
- simion314 8y ago
  I get emails from Epic to enable 2 factor often enough, I refuse because I have a strong password, I don't want to give them my phone and I have nothing to lose if I lose my account since I am not spending anything on it. It should be much harder to change the email linked to an account, if the email password is in the data leaks then there is really nothing you can do.
  - markild 8y ago
    I hate the tendency to demand phone number to activate two factor. I see no practice reason why not simple TOTP isn't good enough. It's probably not a practical reason though...
    - ams6110 8y ago
      Probably want phone as fallback auth for the inevitable people who lose their TOTP device and didn't save any emergency codes.
      - lotsofpulp 8y ago
        That could be setup as an option. The fact that there is no option provided and a phone number is mandatory means that they want to be able to track people with a globally unique identifier.
  - slezyr 8y ago
    They should use TOTP, no need for phone number. It also can protect you if your password have been leaked. https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...
circular_logic 8y ago
I receive 2-5 emails a week with 'someone has tried to log in to your account' from Epic games. After seeing this article it makes me wonder how much prevention of brute forcing passwords Epic games are providing vs Just how persistent these kids really are.
- jstanley 8y ago
  2-5 attempts per week sounds like their brute-force prevention can't really be asked to do much more.
  - vorpalhex 8y ago
    I was getting a few a night for a couple of weeks, with no option to permanently lock my account. I had 2-factor enabled and that did nothing. There's no way to disable the emails. I was just getting endlessly spammed by someone who was never going to guess a 24+ character password via any dictionary or bruteforce. Very annoying.
- mattbreeden 8y ago
  I was getting these emails from having an Epic account for Unreal Engine. Since I don't use Unreal anymore, I had them 'delete' my account. I've only gotten a couple emails since doing that, which is very strange to me. If a regular attempt still triggers that email, wouldn't I still be getting just as many emails? It makes me wonder if the people doing this are triggering the attempts in a special way, or if there is some way to view all accounts, so now my account isn't being listed and therefore isn't having access attempts anymore except by people who already built up a database of accounts.
Symbiote 8y ago
> the teenager said he had spent about £50 of his pocket money to build up a collection of skins Isn't that the underlying problem? In-game purchases have really disrupted the economics of online gaming; £50 used to be something around the final price for the whole game.
- JeremyBanks 8y ago
  The underlying problem here is theft. You’re discussing an unrelated problem.
  - WilliamEdward 8y ago
    It's not unrelated if the problem exists solely because these kids can make money off of microtransactions, and would otherwise be unable to if the game was a flat price.
    - atom-morgan 8y ago
      The game also wouldn't be anywhere near as successful with a flat price. As a gamer, I prefer the Fornite model. F2P. Competitive. Purchases don't affect the competitive integrity of the game. Weekly, sometimes daily, updates. I love it.
    - JeremyBanks 8y ago
      Valuable property existed prior to 2016, including digital assets. There are many valid criticisms of these business models but none of them are a significant factors in explaining this behavior. If the parents won't discipline these children, the state needs to discipline those parents.
      - nradov 8y ago
        While account hacking is wrong and should be punished, the state has limited enforcement resources. I would prefer that law enforcement focus on children who commit more serious crimes, like breaking into cars, littering, or spraying graffiti. Video games are way down the list of priorities.
saipardhu 8y ago
"The items are collected as in-game purchases but are purely cosmetic and do not give gamers any extra abilities." It's sad how much emphasis on looks do the teenagers have these days.
nradov 8y ago
While stealing is obviously wrong, there's no real impact from losing a video game account. For the victims hopefully this will be a cheap lesson in the importance of following good security practices: choose strong passwords, use multi-factor authentication, and keep your devices free of malware.
- foepys 8y ago
  Do you think the same when people get their jewelery stolen? The sentimental value of in-game cosmetics might be the same to a lot of people.
  - nradov 8y ago
    I would think the same if the jewelry cost like $5. It's just a game, don't take it too seriously.
    - mdpopescu 8y ago
      "It's just a game" works when it's about Tetris or Solitaire. If it's something like WoW or Eve Online, where you need to invest years of effort and/or thousands of dollars, it's no longer "just a game".
      - nradov 8y ago
        It's just a game. There's nothing wrong with playing games, but you're paying for entertainment. It's not an investment. And honestly those who devote years to playing WoW or whatever are more deserving of pity than sympathy. People can spend their time however they like but it's just such a sad waste of human potential.
        laumars 8y ago
        You could prefix any statement with "it's just a" and it wouldn't change things. Just because you don't care it doesn't mean it's a/ any less of a crime b/ any less important to the victim I mean where would you draw the line? It's just car (after someone steals a car) because you happen to take the train to work? Or "it's just a house" (after an arson attack) because you happen to live in a hotel? And why should anyone else care about your personal property - physical or virtual - if/when that gets stolen if you don't consider other peoples property to be important? Thankfully the law isn't defined by your specific benchmark of personal importance.
justinhj 8y ago
This is a good learning opportunity for the kids to use better passwords. Hackers rely on large lists of leaked hashed passwords and usernames. Not sure how good Fortnite security is but it’s easy to enforce longer passwords, delays and account locks on repeated bad password entry and of course 2FA which they do support and reward players for using
lihaciudaniel 8y ago
Phishing not hacking is the term you look for.

53 points by yawz 8y ago

deleted 8y ago

[deleted]

SWIM did something similar at a similar age on the game League of Legends. What is interesting was that at the time, most script kiddy programs to do the "cracking" would in fact work, but as soon as you found (bruteforced) a valid account it would be sent by the program in question to a main server, by the time somebody tried to do anything with the account, the credentials were long gone (stolen by the dev of the app). Essentially, they used the script kiddies as a server farm and free human labour, and from what I understood they made copious amounts of money, much more than the thousands they talk about in this article.

laumars 8y ago

I think the real issue here is not the kids doing the hacking but the parents who know what they’re doing and let them continue - even help them bank their earning in some instances. That makes the parents just as responsible in my opinion. We’ve all taken stupid risks as kids. I’d done my fair share of hacking too when I was younger. But I tread a very fine line because I knew my parents would have gone mental if I was caught. Just as I would if I found out my kids were doing something reckless and illegal. So to endorse such behaviour in their own children really doesn’t cast them in a good light. Sorry if this sounds high and mighty. I know comments about parenting often can sound “holier than thou”, but the parents in that article have crossed the line by in my personal opinion.

sebcat 8y ago
> I knew my parents would have gone mental if I was caught You hooked it up to the phone, didn't you? You screw up again and you won't get into college!
- efdee 8y ago
  Dade! Turn the shower off!
SonicSoul 8y ago
Good points but it seems hacking is slightly different these days with high profile hackers (i.e. jailbreak dude) being invited on tv shows and getting lucrative work. There is still a fine line between criminal behavior and just pushing the boundaries, and whole companies are build on boundary pushing. So the question is probably as relatable to morality of your kids actions as much as legality. Just thinking outloud here that the whole meaning / stigma of hackers seems to trend towards positive / resume building these days.
- JeremyBanks 8y ago
  The parents don’t need to be technical geniuses to distinguish between hacking your own devices and mass theft.
kjullien 8y ago
I don't agree that much with what you are saying, mainly from personal experience. 1. Even if parents find out they probably have no idea what it means (legally or literally) 2. You can open a bank account really easily online for free. (You can find photoshop ID templates for every possible country, maybe they check them more nowadays but some years ago you didn't even need to change any of the hashed numbers and it would be accepted by most services, even PayPal) 3. I did get caught at one point by my parents, they proceeded to take away every bit of technology they could find, so I ended up doing more shady stuff (on a lended machine at mcdonalds) to make enough to buy a new computer and keep on with life as usual. Had to re-buy a new computer every year or so when they found out. My perspective on the thing is that most parents won't even fathom the idea of what hacking is, so finding out their kid is a "hacker" won't change a thing in their day. And if it does a "hacker" will always find a way to keep on going anyway, trying to not get caught along the way, it's the job spec. Now what I can agree on is that if the kid tells their parents they're getting money illegally and asking their parents to hold it in their bank account, and the parents agree, then that's just plain stupidity, and a lot of that goes on in the world, parent or not parent...
- yawz 8y ago
  May I ask, as a parent, what would have been the sensible approach to what you were doing from the point of view of your parents?
  - kjullien 8y ago
    I don't think I am able to answer this. If you took a bank robber instead of hacker you could ask the same question and if anybody had an answer to this I don't think there would be bank robbers in the world. edit: This actually feels like more of a personal philosophy type of thing. Say maybe I consider "borrowing" money from a big corp. that screws over the average working person at every chance it gets a good thing. They probably don't. You surely have your own opinion. Hope you see what I mean. edit2: actually now that I think about it, if you (as a parent) have prior knowledge of the field then you surely could spend quality family time orienting the kid in the right direction, while still keeping him happy doing the stuff he wants to do, namely "hacking". This way if he ever ventures too close to the thin line of legality you can be there to have a say in it and make him realize there is suc a thing. (Because to be honest at that time, I did have the notion that what I was doing was illegal, but no idea of what how consequences would affect me, I was a kid. It's the same as kids and the concept of death. Only now do I actually REALIZE that most of the stuff I did could have landed me years of prison time, even if you told me at the time I would not have cared, because being a kid and thinking you are hot shit all the time makes you try crazy stuff just to see how far you can take it)
w8rbt 8y ago
Some of the parents are probably under the impression that the activity is legitimate/legal. Kids can make a lot of money in technology (apps, games, mods, etc.). Parents may not be able to easily tell the difference. They just think they have a wonder kid and are proud.
- laumars 8y ago
  The article suggested the parents were aware that their kids activities were illegal. Which was why I took objection.
jmull 8y ago
I don't know if this line from the article is what you're thinking about: > He said he knew what he was doing was illegal, but his parents were aware of his activities and had not stopped him. But the chances that those parents actually have a clear idea of what is going on are pretty damn slim.
borkt 8y ago
While I agree with your sentiment I wouldn't describe this as hacking, it is much closer to stealing someones car key and then the car (though the value is way off). This does not require any technical knowledge whatsoever apart from using ctrl-F on a password database.
- laumars 8y ago
  I'd still describe it as hacking. Even seasoned pen testers have a suite of automated tools. The distinction you're making is pretty arbitrary as it's based on elitist ideologies; however I do agree with you that those teenagers are essentially just "script kiddies". I have say I think it's a pretty distracting argument to make because regardless of whether they understand the tools on a technical level, they understand what they are doing (hijacking peoples accounts and selling them on) and are aware that it is illegal. Surely that's the important takeaway here?

xfitm3 8y ago

What we really need is minimum authentication standards with incentives for compliance - password reuse isn’t limited to Fortnite.

simeonOli 8y ago
You'd think the incentive to not loose your account would be enough!
simion314 8y ago
I get emails from Epic to enable 2 factor often enough, I refuse because I have a strong password, I don't want to give them my phone and I have nothing to lose if I lose my account since I am not spending anything on it. It should be much harder to change the email linked to an account, if the email password is in the data leaks then there is really nothing you can do.
- markild 8y ago
  I hate the tendency to demand phone number to activate two factor. I see no practice reason why not simple TOTP isn't good enough. It's probably not a practical reason though...
  - ams6110 8y ago
    Probably want phone as fallback auth for the inevitable people who lose their TOTP device and didn't save any emergency codes.
    - lotsofpulp 8y ago
      That could be setup as an option. The fact that there is no option provided and a phone number is mandatory means that they want to be able to track people with a globally unique identifier.
- slezyr 8y ago
  They should use TOTP, no need for phone number. It also can protect you if your password have been leaked. https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...

circular_logic 8y ago

I receive 2-5 emails a week with 'someone has tried to log in to your account' from Epic games. After seeing this article it makes me wonder how much prevention of brute forcing passwords Epic games are providing vs Just how persistent these kids really are.

jstanley 8y ago
2-5 attempts per week sounds like their brute-force prevention can't really be asked to do much more.
- vorpalhex 8y ago
  I was getting a few a night for a couple of weeks, with no option to permanently lock my account. I had 2-factor enabled and that did nothing. There's no way to disable the emails. I was just getting endlessly spammed by someone who was never going to guess a 24+ character password via any dictionary or bruteforce. Very annoying.
mattbreeden 8y ago
I was getting these emails from having an Epic account for Unreal Engine. Since I don't use Unreal anymore, I had them 'delete' my account. I've only gotten a couple emails since doing that, which is very strange to me. If a regular attempt still triggers that email, wouldn't I still be getting just as many emails? It makes me wonder if the people doing this are triggering the attempts in a special way, or if there is some way to view all accounts, so now my account isn't being listed and therefore isn't having access attempts anymore except by people who already built up a database of accounts.

Symbiote 8y ago

> the teenager said he had spent about £50 of his pocket money to build up a collection of skins Isn't that the underlying problem? In-game purchases have really disrupted the economics of online gaming; £50 used to be something around the final price for the whole game.

JeremyBanks 8y ago
The underlying problem here is theft. You’re discussing an unrelated problem.
- WilliamEdward 8y ago
  It's not unrelated if the problem exists solely because these kids can make money off of microtransactions, and would otherwise be unable to if the game was a flat price.
  - atom-morgan 8y ago
    The game also wouldn't be anywhere near as successful with a flat price. As a gamer, I prefer the Fornite model. F2P. Competitive. Purchases don't affect the competitive integrity of the game. Weekly, sometimes daily, updates. I love it.
  - JeremyBanks 8y ago
    Valuable property existed prior to 2016, including digital assets. There are many valid criticisms of these business models but none of them are a significant factors in explaining this behavior. If the parents won't discipline these children, the state needs to discipline those parents.
    - nradov 8y ago
      While account hacking is wrong and should be punished, the state has limited enforcement resources. I would prefer that law enforcement focus on children who commit more serious crimes, like breaking into cars, littering, or spraying graffiti. Video games are way down the list of priorities.

saipardhu 8y ago

"The items are collected as in-game purchases but are purely cosmetic and do not give gamers any extra abilities." It's sad how much emphasis on looks do the teenagers have these days.

nradov 8y ago

While stealing is obviously wrong, there's no real impact from losing a video game account. For the victims hopefully this will be a cheap lesson in the importance of following good security practices: choose strong passwords, use multi-factor authentication, and keep your devices free of malware.

foepys 8y ago
Do you think the same when people get their jewelery stolen? The sentimental value of in-game cosmetics might be the same to a lot of people.
- nradov 8y ago
  I would think the same if the jewelry cost like $5. It's just a game, don't take it too seriously.
  - mdpopescu 8y ago
    "It's just a game" works when it's about Tetris or Solitaire. If it's something like WoW or Eve Online, where you need to invest years of effort and/or thousands of dollars, it's no longer "just a game".
    - nradov 8y ago
      It's just a game. There's nothing wrong with playing games, but you're paying for entertainment. It's not an investment. And honestly those who devote years to playing WoW or whatever are more deserving of pity than sympathy. People can spend their time however they like but it's just such a sad waste of human potential.
      - laumars 8y ago
        You could prefix any statement with "it's just a" and it wouldn't change things. Just because you don't care it doesn't mean it's a/ any less of a crime b/ any less important to the victim I mean where would you draw the line? It's just car (after someone steals a car) because you happen to take the train to work? Or "it's just a house" (after an arson attack) because you happen to live in a hotel? And why should anyone else care about your personal property - physical or virtual - if/when that gets stolen if you don't consider other peoples property to be important? Thankfully the law isn't defined by your specific benchmark of personal importance.

justinhj 8y ago

This is a good learning opportunity for the kids to use better passwords. Hackers rely on large lists of leaked hashed passwords and usernames. Not sure how good Fortnite security is but it’s easy to enforce longer passwords, delays and account locks on repeated bad password entry and of course 2FA which they do support and reward players for using

lihaciudaniel 8y ago

Phishing not hacking is the term you look for.