Fortnite teen hackers 'earning thousands of pounds a week' | Hacker News Reader

Fortnite teen hackers 'earning thousands of pounds a week'

bbc.co.uk

53 pointsyawz52 comments

I think the real issue here is not the kids doing the hacking but the parents who know what they’re doing and let them continue - even help them bank their earning in some instances. That makes the parents just as responsible in my opinion.

We’ve all taken stupid risks as kids. I’d done my fair share of hacking too when I was younger. But I tread a very fine line because I knew my parents would have gone mental if I was caught. Just as I would if I found out my kids were doing something reckless and illegal. So to endorse such behaviour in their own children really doesn’t cast them in a good light.

Sorry if this sounds high and mighty. I know comments about parenting often can sound “holier than thou”, but the parents in that article have crossed the line by in my personal opinion.

> I knew my parents would have gone mental if I was caught

You hooked it up to the phone, didn't you? You screw up again and you won't get into college!

Dade! Turn the shower off!

Good points but it seems hacking is slightly different these days with high profile hackers (i.e. jailbreak dude) being invited on tv shows and getting lucrative work. There is still a fine line between criminal behavior and just pushing the boundaries, and whole companies are build on boundary pushing. So the question is probably as relatable to morality of your kids actions as much as legality. Just thinking outloud here that the whole meaning / stigma of hackers seems to trend towards positive / resume building these days.

The parents don’t need to be technical geniuses to distinguish between hacking your own devices and mass theft.

I don't agree that much with what you are saying, mainly from personal experience.

1. Even if parents find out they probably have no idea what it means (legally or literally) 2. You can open a bank account really easily online for free. (You can find photoshop ID templates for every possible country, maybe they check them more nowadays but some years ago you didn't even need to change any of the hashed numbers and it would be accepted by most services, even PayPal) 3. I did get caught at one point by my parents, they proceeded to take away every bit of technology they could find, so I ended up doing more shady stuff (on a lended machine at mcdonalds) to make enough to buy a new computer and keep on with life as usual. Had to re-buy a new computer every year or so when they found out.

My perspective on the thing is that most parents won't even fathom the idea of what hacking is, so finding out their kid is a "hacker" won't change a thing in their day. And if it does a "hacker" will always find a way to keep on going anyway, trying to not get caught along the way, it's the job spec.

Now what I can agree on is that if the kid tells their parents they're getting money illegally and asking their parents to hold it in their bank account, and the parents agree, then that's just plain stupidity, and a lot of that goes on in the world, parent or not parent...

May I ask, as a parent, what would have been the sensible approach to what you were doing from the point of view of your parents?

> Even if parents find out they probably have no idea what it means (legally or literally)

At least one kid admitted that his parents know exactly what he's doing, in the article:

> He said he knew what he was doing was illegal, but his parents were aware of his activities and had not stopped him.

Furthermore, parents aren't idiots. I got into some shit as a kid, and while my parents weren't the tech-savviest folks around, they were usually pretty quick to catch on that something was amiss. And keep in mind, that today's parents probably grew up with computers themselves.

> Furthermore, parents aren't idiots.

Plenty of adults are idiots, and many of those are parents.

Relevant example in the news today:

https://www.nbcnews.com/news/us-news/maryland-father-accused...

Regardless of whether parents understand hacking, computers, or Fortnite, I think parents would be able to tell if something was up based on differences in what their kid is doing.

The spectrum of Fortnite "hackers" ranges from a bunch of idiots being handheld by internet users on how to use off-the-shelf scripts to those that actually have an understanding of computer science and information security to DIY their own malicious code.

I somewhat agree that if a kid is making $200-$400/mo doing some 'video game nonsense' selling "skins" or whatever, then parents could be apathetic to whatever their kid is doing in their spare time.

Now if a kid was coming to a parent with salary-level money, or buying expensive items, then that would be a more serious sign their kid is involved in something. And given they are too young to legally be employed, there would be a lot of questions where the money came from. Once this level of money is reached, it's easier to fall into a path of being a career criminal. If someone is raking in a few thousand a month as a teenager from Fortnite account theft, who's to say they wouldn't have the confidence to get involved with other crimes like identity theft, bank fraud, stealing credit cards, etc. It opens the door to a lot of bad life decisions.

Some of the parents are probably under the impression that the activity is legitimate/legal. Kids can make a lot of money in technology (apps, games, mods, etc.). Parents may not be able to easily tell the difference. They just think they have a wonder kid and are proud.

The article suggested the parents were aware that their kids activities were illegal. Which was why I took objection.

I don't know if this line from the article is what you're thinking about:

> He said he knew what he was doing was illegal, but his parents were aware of his activities and had not stopped him.

But the chances that those parents actually have a clear idea of what is going on are pretty damn slim.

While I agree with your sentiment I wouldn't describe this as hacking, it is much closer to stealing someones car key and then the car (though the value is way off). This does not require any technical knowledge whatsoever apart from using ctrl-F on a password database.

I'd still describe it as hacking. Even seasoned pen testers have a suite of automated tools. The distinction you're making is pretty arbitrary as it's based on elitist ideologies; however I do agree with you that those teenagers are essentially just "script kiddies".

I have say I think it's a pretty distracting argument to make because regardless of whether they understand the tools on a technical level, they understand what they are doing (hijacking peoples accounts and selling them on) and are aware that it is illegal. Surely that's the important takeaway here?

I receive 2-5 emails a week with 'someone has tried to log in to your account' from Epic games. After seeing this article it makes me wonder how much prevention of brute forcing passwords Epic games are providing vs Just how persistent these kids really are.

2-5 attempts per week sounds like their brute-force prevention can't really be asked to do much more.

I was getting a few a night for a couple of weeks, with no option to permanently lock my account. I had 2-factor enabled and that did nothing. There's no way to disable the emails. I was just getting endlessly spammed by someone who was never going to guess a 24+ character password via any dictionary or bruteforce. Very annoying.

I was getting these emails from having an Epic account for Unreal Engine. Since I don't use Unreal anymore, I had them 'delete' my account.

I've only gotten a couple emails since doing that, which is very strange to me. If a regular attempt still triggers that email, wouldn't I still be getting just as many emails? It makes me wonder if the people doing this are triggering the attempts in a special way, or if there is some way to view all accounts, so now my account isn't being listed and therefore isn't having access attempts anymore except by people who already built up a database of accounts.

While stealing is obviously wrong, there's no real impact from losing a video game account. For the victims hopefully this will be a cheap lesson in the importance of following good security practices: choose strong passwords, use multi-factor authentication, and keep your devices free of malware.

Do you think the same when people get their jewelery stolen? The sentimental value of in-game cosmetics might be the same to a lot of people.

I would think the same if the jewelry cost like $5. It's just a game, don't take it too seriously.

"It's just a game" works when it's about Tetris or Solitaire. If it's something like WoW or Eve Online, where you need to invest years of effort and/or thousands of dollars, it's no longer "just a game".

It's just a game. There's nothing wrong with playing games, but you're paying for entertainment. It's not an investment.

And honestly those who devote years to playing WoW or whatever are more deserving of pity than sympathy. People can spend their time however they like but it's just such a sad waste of human potential.

You could prefix any statement with "it's just a" and it wouldn't change things.

Just because you don't care it doesn't mean it's

    a/ any less of a crime
    b/ any less important to the victim

I mean where would you draw the line? It's just car (after someone steals a car) because you happen to take the train to work? Or "it's just a house" (after an arson attack) because you happen to live in a hotel? And why should anyone else care about your personal property - physical or virtual - if/when that gets stolen if you don't consider other peoples property to be important?

Thankfully the law isn't defined by your specific benchmark of personal importance.

The law is defined by the fair market value of the thing stolen or destroyed, and by the risk or damage to human life. That seems like a reasonable way to draw the line. Any sort of working car is worth a lot more than a video game account.

And there's obviously no comparison between the impact of an arson attack versus anything that could happen related to a video game. I can't fathom why you'd even bring that up. Let's have a sense of proportion.

$5 for most teenagers is what $100 is for an adult.

That's a good reason to be careful with one's money by not wasting it on video game skins and other luxury goods.

> the teenager said he had spent about £50 of his pocket money to build up a collection of skins

Isn't that the underlying problem? In-game purchases have really disrupted the economics of online gaming; £50 used to be something around the final price for the whole game.

The underlying problem here is theft.

You’re discussing an unrelated problem.

It's not unrelated if the problem exists solely because these kids can make money off of microtransactions, and would otherwise be unable to if the game was a flat price.

The game also wouldn't be anywhere near as successful with a flat price.

As a gamer, I prefer the Fornite model. F2P. Competitive. Purchases don't affect the competitive integrity of the game. Weekly, sometimes daily, updates. I love it.

Valuable property existed prior to 2016, including digital assets. There are many valid criticisms of these business models but none of them are a significant factors in explaining this behavior.

If the parents won't discipline these children, the state needs to discipline those parents.

While account hacking is wrong and should be punished, the state has limited enforcement resources. I would prefer that law enforcement focus on children who commit more serious crimes, like breaking into cars, littering, or spraying graffiti. Video games are way down the list of priorities.

True

More and more game are different now with regular updates instead of yearly releases and built around a single game being a hobby for someone. Once you spend hundreds or thousands of hours with a game that costs essentially nothing for the amount of time spent then throwing in some real money to get cool stuff is common. It used to be common for hardcore gamers to buy a new AAA game every month or two but now, at least for those I know, they keep playing the same mulyiplayer games and put in a little money occassionally.

Indeed. Long gone are the days when people made extra content for games just for fun (skins, maps, mods etc). The hobbyist modders have actually created few of the most popular games today such as Counter-Strike and Dota.

I don't see the problem. People are enjoying a free and voluntarily transactions, buying stuff that many others would find stupid, yes. Do you want to impose your notion of what's worthwhile to buy on other people?

Exactly right. People esssentially voted for this model of gaming with their wallets; it proliferated in mobile gaming where the race to the bottom for game pricing meant new revenue models had to arise

Actual casinos is something people vote for with their wallets, but are heavily regulated because it's known they are dangerous and harmful to susceptible people. I don't think the whole mobile "whales" thing is any different.

They are regulated because they make easy targets to score political points and fill in government coffers at the same time, not because there's any reasonable ethical basis for it.

This is a good learning opportunity for the kids to use better passwords. Hackers rely on large lists of leaked hashed passwords and usernames. Not sure how good Fortnite security is but it’s easy to enforce longer passwords, delays and account locks on repeated bad password entry and of course 2FA which they do support and reward players for using

What we really need is minimum authentication standards with incentives for compliance - password reuse isn’t limited to Fortnite.

You'd think the incentive to not loose your account would be enough!

I get emails from Epic to enable 2 factor often enough, I refuse because I have a strong password, I don't want to give them my phone and I have nothing to lose if I lose my account since I am not spending anything on it.

It should be much harder to change the email linked to an account, if the email password is in the data leaks then there is really nothing you can do.

I hate the tendency to demand phone number to activate two factor. I see no practice reason why not simple TOTP isn't good enough. It's probably not a practical reason though...

Probably want phone as fallback auth for the inevitable people who lose their TOTP device and didn't save any emergency codes.

That could be setup as an option. The fact that there is no option provided and a phone number is mandatory means that they want to be able to track people with a globally unique identifier.

They should use TOTP, no need for phone number. It also can protect you if your password have been leaked.

https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...

They changed it so you can now use regular TOTP through Google Authenticator or whatever. That's what I use.

Phishing not hacking is the term you look for.

Reply on news.ycombinator.com