Prolific Hacker Made Millions Selling Network Access
A hacker group going by the name of ShinyHunters claims to have breached ten companies and is currently selling their respective user databases on a dark web marketplace for illegal products. The hackers are the same group who breached last week Tokopedia, Indonesia’s largest online store. Hackers initially leaked 15 million user records online, for free, but later put the company’s entire database of 91 million user records on sale for $5,000. Encouraged and emboldened by the profits from the Tokopedia sale, the same group has, over the course of the current week, listed the databases of 10 more companies.
This includes user databases allegedly stolen from organizations such as:
• Online dating app Zoosk (30 million user records)
• Printing service Chatbooks (15 million user records)
• South Korean fashion platform SocialShare (6 million user records)
• Food delivery service Home Chef (8 million user records)
• Online marketplace Minted (5 million user records)
• Online newspaper Chronicle of Higher Education (3 million user records)
• South Korean furniture magazine GGuMim (2 million user records)
• Health magazine Mindful (2 million user records)
• Indonesia online store Bhinneka (1.2 million user records)
• US newspaper StarTribune (1 million user records)
The listed databases total for 73.2 million user records, which the hacker is selling for around $18,000, with each database sold separately.
The hacker group has shared samples from some of the stolen databases, which ZDNet has verified to include legitimate user records — for the samples where user details were provided. Children as young as 14 are making thousands of pounds a week as part of a global hacking network built around the popular video game Fortnite. About 20 hackers told the BBC they were stealing the private gaming accounts of players and reselling them online. Fortnite is free to play but is estimated to have made more than £1bn through the sale of “skins”, which change the look of a character, and other add-ons. This fuels a growing black market.
Hackers can sell player accounts for as little as 25p or hundreds of pounds, depending on what they contain. The items are collected as in-game purchases but are purely cosmetic and do not give gamers any extra abilities. Fortnite-maker Epic declined to comment on the investigation but said it was working to improve account security. The game has more than 200 million players.
One British hacker said he got involved at the age of 14 earlier this summer, when he himself became the victim of a hack. Speaking from his bedroom via a video chat, wearing a baseball cap and bandana to hide his identity, the teenager said he had spent about £50 of his pocket money to build up a collection of skins, when he had woken up to a message that changed everything. “The email said that my password had been changed and two-factor authentication had been added by someone else. It felt horrible,” he recalled.
Two-factor authentication meant his account could only be accessed by entering a code sent to an email address or app registered by the perpetrator. Like many victims, he turned to Twitter to vent his frustration. That was where he saw new accounts containing even better items on sale. “I was approached by someone who said I could buy an account for 25p and I could clearly see the account was worth a lot more,” he recalled. “I bought it.” He knew he was playing on a stolen account but with so many others doing it online and making lots of money, he was soon drawn into the world of “Fortnite cracking”. “I was approached by a cracking team and they told me what it was and all about ‘combos’, ‘proxies’ and I guess they showed me how to crack,” he said.
He said they showed him where to find the vast lists of usernames and passwords published online from other data breaches over the years. They showed him where to buy “off-the-shelf” hacker tools needed to input those credentials into the login page of Fortnite. Once inside an account, they showed him how to take it over and then sell it to the hungry online community. He insisted that he only carried out one cracking session. But in that single day he managed to access more than 1,000 Fortnite accounts. “It’s lucky dip basically, you either get a good account or you don’t. People like the rarity of the ‘skins’ and it’s about the look of them and showing off to friends.” The hacker said he was now a middleman for other crackers, selling on accounts he knew to be stolen. In his first few weeks, he made around £1,500 and bought himself some games and a new bicycle. He said he knew what he was doing was illegal, but his parents were aware of his activities and had not stopped him Offences like this fall under the Computer Misuse Act and carry a possible prison sentence of two years. Some hackers show no signs of remorse or concern. One of the most prolific is a 17-year-old from Slovenia, who sells through his own website. “You can’t get caught, nobody checks it,” he told the BBC from within the game. Amidst the gunfire and wall-building, he said he had made £16,000 in the seven months that he had been cracking. He said his mother was an accountant who was helping him save for a first car. He sent screenshots of his Paypal accounts and Bitcoin wallets to confirm his business was real. Another hacker showed proof of earnings ranging from £50 a day to almost £300. The 15-year-old from France said his best week netted him £2,300. “Yes I have done other stuff but nothing too big,” he added, referring to identity fraud among other cyber-crimes.
Fortnite players warned over hack attacks
Rehab camp aims to put young cyber-crooks on right track
The hidden history of cyber-crime forums
The National Crime Agency says there is a long-standing link between video games and hacking, and that publishers need to do more to prevent players being tempted into crime.”What we want to see these companies do is not look at this from a purely technical standpoint,” said the agency’s lead on gaming, Ethan Thomas. “What we’d like… is the gaming industry engaging more with law enforcement and looking at early intervention messaging on their platforms to divert [youngsters] on to a more ethical and legal path.”