I exploited existing YouTube videos with a fake Patreon profile

https://www.lucas03.com/how-i-exploited-existing-youtube-videos-with-a-fake-patreon-profile/

by lucas03 • 5 years ago

184 64 5 years ago

keyle• 5 years ago

I find this partially interesting but mostly lucky.

I don't see this hack raking a lot of dollaroos. "stealing" someone's account would be far more dangerous. That said I'm surprised that Patreon will just let people recycle accounts like this without even a second step.

This is no different than DNS parking after a domain fell off the wagon, only with direct revenues.

qwantim1• 5 years ago

Not lucky- just deceptive. Deception is what scammers do, and they do it because it’s guaranteed to make money, not because they hope to get lucky.

I’m not advocating this. Doing this was wrong, and it’s not some black hat exploit. It was a scam; pretending to be someone to make money off of an unwitting victim.

rriepe• 5 years ago

I'm not a lawyer but I got lawyer-nervous reading this post.

ObsoleteNerd• 5 years ago

That’s because it’s fraud.

pmiller2• 5 years ago

Nah. It's not fraud if they don't get any benefit from it. Since they refunded the single, solitary person who pledged $3/month, then shut it all down, it's all good from the fraud angle.

braddx3• 5 years ago

it's called "responsible disclosure" though this is not 100% responsible. lol

cecja• 5 years ago

This is just fraud nothing more or less. It's not even that interesting of an exploit and especially not worthy 689 words.

braddx3• 5 years ago

please submit this to HITB white papers - https://twitter.com/HITBMedia/status/1359324451976843267

braddx3• 5 years ago

ps: you should consider automating the process.

a bot that: 1. scraps all pateron links 2. check if they are dead to claim them 3. of a famous channel 4. profit $$$

paulie_a• 5 years ago

Can he automate his prison time too?

rhizome• 5 years ago

You'd think somewhere they'd expand what "HITB" means.

acheron• 5 years ago

As far as I know it means “half in the bag”.

hi5eyes• 5 years ago

is this an exploit I remember there was an "exploit" that reregistered the urls from old tweets of celebs or verified users that had used now expired link shorteners

tehwebguy• 5 years ago

Interesting! Lot’s of more active scams like this happening in merchandising. I started doing merch for YouTubers back in maybe 2007 and in the last 3-4 years the scams have really picked up.

For some time the most well known youtubers would receive spam replies on all of their tweets with links to counterfeit merch sites.

If you search for the the top handful of YT creator names on Amazon or eBay you’ll find loads of bootleg merch (sometimes with hundreds of reviews!)

nexthash• 5 years ago

Not related to the subject of the post, but for anyone interested OP seems to run a stock portfolio tracker for dividend investors, which he mentioned briefly (his blog mostly concerns his investing endeavors). It seemed pretty cool to me and is in need of support, so I'll leave the link here:

https://www.digrin.com/

tekromancr2• 5 years ago

"I discovered this neat new hack called 'fraud'"

cmeacham983• 5 years ago

This post is wild. The author does not seem to realize they are confessing to a relatively serious crime, and even calls it a "profitable business"!

CyanDeparture• 5 years ago

The writer at the end refunds the money and messages Patreon to fix the issue, I think that would go massively in his favour in the rare change it ended up in front of a judge.

nerdponx• 5 years ago

They "made" €3, which they refunded.

mountainb• 5 years ago

Not as uncommon as you think. Many people realize without knowing much about the law that breaking the law can be a great business plan. They just converge upon ideas that are illegal naturally and unperturbed by the potential problems.

Ironically this is also a bit of an entrepreneurial advantage. A trained corporate management drone will be aware of all the bad things that can happen and has been paper trained by lawyers to be frightened of doing anything illegal. The sweet spot is when it's something that's just slightly illegal or just a matter of civil law, but the danger zone is in something like this which is just fraud.

ghego1• 5 years ago

Not legal advice.

Why fraud? If we are talking about criminal law, the requirements to convict a person are strict. In this case the author has not claimed neither on Patreon or YouTube to be someone he is not. He has not falsified any data/documents and has not stolen any account, since the one he claimed was available.

Sketchy? No doubts. Fraud? Doesn't seem like it at all.

kuu• 5 years ago

In this case the author has not claimed neither on Patreon or YouTube to be someone he is not

I am not a lawyer, but using someone else picture and name sounds a bit of "claiming someone you're not" to me :)

londons_explore• 5 years ago

Simply putting your name on patreon to be someone else's youtube username, and doing so deliberately for financial gain, could be considered fraud...

Closi• 5 years ago

In the UK it could be technically counted as fraud by false representation. The legal hurdles for this are:

* The patreon page was misleading (this post shows it was, including the use of old links and imagery to show association to a YouTube channel which was false)

* The person making it knows it might be misleading (they did - they said so in this post)

* The intention was to make a gain in money for themselves, others or to cause a loss to someone else. This includes situations where the gain in money is only temporary (again, technically yes.)

https://www.legislation.gov.uk/ukpga/2006/35/pdfs/ukpga_2006...

I'm not saying they should be charged with it as clearly they didn't mean to cause harm and were doing it to raise awareness, but it does seem to fit the definition.

Cthulhu_• 5 years ago

He confesses that it was a black hat "proof of concept", but he's refunded the money and reported things to Patreon.

Patreon, and ANY website that has user's profiles as permalinks, should reserve ANY account name that has been deleted to prevent squatting.

I'm not sure how this works with the right to be forgotten laws though; I have a gut feeling that you can have your profile deleted and the leftover URLs and permalinks just go to 404 or other kinds of placeholders.

julianwachholz• 5 years ago

Wouldn't the proper status code be "410 Gone" in that case?

alisonkisk2• 5 years ago

Social engineering is a hack.

tekromancr2• 5 years ago

I never said it wasn't.

I am just saying that in security, while it can be very difficult to always find where the line between ethical and unethical conduct is; and what will get a company to pay attention to an issue without getting yourself arrested;

What I AM saying is that this person blew so far past that line that I wonder if they are even aware that one exists. All without even considering that, maybe, "that time last week when I committed wire fraud" probably isn't the best topic for a blog post.

Do I think that the author was acting maliciously or in bad faith? No. But the US justice system has a really nasty habit of not taking facts like these into account; as Aaron Swartz tragically learned.

Tl;dr "it's just a prank, bro" is not an effective legal defense, and prosecutors fucking LOVE convicting hackers.

EE84M3i• 5 years ago

The technical summary here seems to be: patreon shouldn't allow usernames/url slugs to be reused.

IndySun• 5 years ago

Digital locksmiths here are generally applauded as ingenious. This tale is not at all surprising except that the OP fessed up in the end. The morality aspect is moribund, in an ocean of tracking, data mining, fake accounts, yes fraud, and the general disregard for other peoples hard work (those you don't see, you don't feel for).

Ice_cream_suit• 5 years ago

Wire fraud attracts fairly stiff penalties....

the0k0• 5 years ago

best marketing strategy ever

however, what you are doing is illegal...

I exploited existing YouTube videos with a fake Patreon profile

Related Stories