TechBizWebTechBizWeb

    Subscribe to Updates

    Get the latest news about Technology and Business from all around the web..

    What's Hot

    I’ve been getting tons of “wrong number” spam texts, and I don’t hate it?

    July 3, 2022

    DeSantis benefits from ‘Trump fatigue’ ahead of possible 2024 face-off

    July 3, 2022

    Germany and Ireland attack Boris Johnson over Northern Ireland rules

    July 3, 2022
    Facebook Twitter Instagram
    • About Us
    • Privacy Policy
    • Guest Post
    • Terms
    • Contact
    Facebook Twitter Instagram
    TechBizWebTechBizWeb
    Subscribe
    • Home
    • Technology

      I’ve been getting tons of “wrong number” spam texts, and I don’t hate it?

      July 3, 2022

      Tesla’s run of record quarterly deliveries comes to an end thanks to China’s COVID shutdowns

      July 2, 2022

      Virgin Orbit successfully launches satellites during first night mission

      July 2, 2022

      Meta’s shutting down its digital wallet, Novi

      July 2, 2022

      TCL 30 XE 5G review: not bad for $200

      July 2, 2022
    • Business
    • Cyber Security

      Tips to bolster cybersecurity, incident response this 4th of July weekend

      July 1, 2022

      Jon Raper named CISO at Costco

      July 1, 2022

      2022 RSAC takeaways: Risk management vs compliance

      July 1, 2022

      3 security lessons we haven’t learned from the Kaseya breach

      July 1, 2022

      Auston Davis named CISO at Versant Health

      June 30, 2022
    • Blockchain
    • Vulnerabilities
    • Social Engineering
    • Malware
    • Cyber Security Alerts
    TechBizWebTechBizWeb
    Home»Cyber Security»Vulnerability Allowed Fortnite Account Takeover Without Credentials
    Cyber Security

    Vulnerability Allowed Fortnite Account Takeover Without Credentials

    January 16, 2019Updated:January 16, 2019No Comments4 Mins Read
    Facebook Twitter Pinterest LinkedIn Tumblr WhatsApp
    Share
    Facebook Twitter LinkedIn Pinterest Email

    Have you been attacked? Digitpol the global investigation firm can help you, visit Digitpol’s website to learn more.


    Hacking game accounts is a popular — and enriching — pastime. The rise of in-game marketplaces that can be used for buying and selling game commodities has attracted hackers who break into gamers’ accounts, steal their game commodities (and anything else they can find from personal data to parents’ bank card details) and sell them on for cash. 

    The traditional route has always been to phish the gamers’ credentials — and obviously the bigger and more popular the game, the bigger the pool for phishing. Checkpoint recently discovered a vulnerability (now fixed) in the biggest game of all that allowed criminals to gain access to users’ accounts without requiring credentials. 

    The Target was Fortnite, an online video game developed by Epic Games and released in July 2017. It was played by nearly 80 million people in August 2018, and boasts something like 125 million accounts. It accounts for nearly half of Epic Games’ $5 to $8 billion estimated company value. Fortnite’s in-game currency is the ‘V-Buck’, which can be earned within the game, can be used to purchase game commodities from other users, and sold for fiat cash outside of the game.

    The vulnerability came to light when Check Point researchers realized the Epic Games login page, accounts.epicgames.com, had not been validated and was susceptible to a malicious redirect. The also discovered a separate unused and flawed Epic subdomain, where they identified an XSS attack to load their own JavaScript.

    The usual method for gamers to authenticate themselves for Fortnite is to employ Facebook, Google or X-Box SSO capabilities. Users would visit the Epic login page and choose ‘login with, say, Facebook’. Epic would then request and receive an access token from Facebook, and the user would gain access to his or her account.

    However, with the flaw discovered by Checkpoint, the redirect URL would send the gamer to the login page and then be redirected to the compromised sub-domain. Here, the attacker’s JavaScript would send a second request for the user credentials from Facebook, receive them, and send them to the attacker.

    “All a victim needs to do is click on the malicious phishing link the attacker sends them, either in Fortnite chat, or via social media,” writes Check Point. This link has the advantage of starting with the official EPIC login domain, and ending with another EPIC domain. “To increase the likelihood of a potential victim clicking on this link,” continues Check Point, “it could be sent with an enticement promising free game credits. Once clicked, with no need even for the user to enter any login credentials, their Fortnite authentication token would immediately be captured by the attacker.”

    With that information, the attacker can access the user’s account, steal personal information, listen in to in-game conversations, and buy and steal V-Bucks using the victim’s own bank details. The V-Bucks could then be exchanged for real money in the real world.

    In this instance the vulnerability arose because of EPIC’s failure to employ proper validation checks on the login page (allowing the redirect) exacerbated by leaving an unused, insecure sub-domain to provide the redirect destination and house the script used to steal the gamers’ credentials. This has now been fixed by EPIC.

    But users can help themselves simply by employing two-factor authentication (as EPIC recommends). Users should, writes Check Point, “enable two-factor authentication. By doing so, and when logging into their account from a new device, the user is required to enter a security code that is then sent via email to the account owner.” 2FA is not an automatic panacea for security, and can be by-passed in certain circumstances. That, however, would require considerably more effort from the attacker, where exploitation of this vulnerability requires no user hacking at all.

    Related: Epic Games Resets Passwords Following Forum Breach 

    Related: Epic Games Forums Hacked Again 

    Related: Rockstar Games Launches Public Bug Bounty Program 

    Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

    Previous Columns by Kevin Townsend:
    Tags:



    Source link

    Share. Facebook Twitter Pinterest LinkedIn Tumblr Email

    Related Posts

    Tips to bolster cybersecurity, incident response this 4th of July weekend

    July 1, 2022 Cyber Security

    Jon Raper named CISO at Costco

    July 1, 2022 Cyber Security

    2022 RSAC takeaways: Risk management vs compliance

    July 1, 2022 Cyber Security

    3 security lessons we haven’t learned from the Kaseya breach

    July 1, 2022 Cyber Security

    Auston Davis named CISO at Versant Health

    June 30, 2022 Cyber Security

    Lessons learned from slew of recent data breaches

    June 30, 2022 Cyber Security
    Editors Picks

    DeSantis benefits from ‘Trump fatigue’ ahead of possible 2024 face-off

    July 3, 2022

    Germany and Ireland attack Boris Johnson over Northern Ireland rules

    July 3, 2022

    Biden administration split on whether to remove China tariffs

    July 3, 2022

    Covid vaccines: how can immune imprinting help experts to rethink jabs?

    July 3, 2022
    Trending Now

    Special treatment for Tesla not in India’s ‘interest’, Ola says

    By techbizweb

    NFT Sales Slide to a 12-Month Low Amid Crypto Meltdown

    By techbizweb

    China’s rise pushes Asia-Pacific nations to embrace Nato

    By techbizweb

    https://www.nationalsportsacademy.com

    slot gacor hari ini

    http://www.inadesfo.org/

    http://www.eueomgbissau.org/

    http://www.congo-mai-mai.net/

    http://www.angelesdelafrontera.org/

    http://fifaworldcup2018schedule.com/

    http://tony4gtrmcr.co.uk/

    http://www.standrewsagreement.org/

    http://www.bob-russell.co.uk/

    http://davidmulholland.co.uk/

    http://railwayhotelenniskillen.com/

    http://www.fantasysportstrades.com/

    http://www.rainleaf-flooring.com

    http://mothersagainstguns.org/

    http://ma-coc.org/

    slot online

    http://www.paradoxmag.com/situs-judi-slot-online-gampang-menang-2021/

    http://www.paradoxmag.com/situs-judi-slot-online-terbaru-2021/

    http://slot-terbaru.net/

    Slot Gacor

    Slot Online

    Situs Slot Gacor

    http://www.appdexterity.com/

    https://cars4kids-deutschland.de/

    https://www.stretchingculture.com/

    https://www.b-123-hp.com/slot-gacor/

    https://denzstaffing.nl/

    https://ezbbqcooking.com/slot-gacor/

    https://www.mbahelp24.com/slot-gacor

    https://minhtanstore.com/slot-jackpot-terbesar/

    https://njbpusupplierdiversity.com/slot-gacor-gampang-menang/

    https://www.floridaspecialtycropfoundation.org/slot-gampang-menang/

    https://childrenscornerpreschool.org/slot-gacor-gampang-menang/

    https://cryptoquoter.com/slot-online-terbaik/

    https://alorkantho24.com/slot-gacor/

    https://ellas.xyz/slot-gacor/

    https://it.dougamatome.xyz/slot-online/

    https://www.daltercume.com/slot-gacor/

    https://josi-ana.dougamatome.xyz/slot88/

    https://josi-ana.dougamatome.xyz/slot-gacor/

    https://fastobserver.com/slot-jackpot-terbesar/

    https://www.planetexperts.com/slot-gacor/

    https://bfsolution.group/slot-bet-kecil/

    https://rustleva.co/slot/

    https://bfsolution.group/slot-bet-kecil/

    https://www.hotelcalimareal.com/togel-online/

    https://anime-game.dougamatome.xyz/slot-gacor-gampang-menang/

    https://anime-game.dougamatome.xyz/togel-online/

    https://bourbonbarrelfoods.com/slot/

    http://suneo39.wp.xdomain.jp/slot/

    https://techbizweb.com/slot-gacor/

    https://www.generalcatalyst.com/18-daftar-slot-gacor-terbaik-gampang-menang-jackpot-hari-ini/

    https://www.hotelcalimareal.com/slot-online/

    https://www.blockgates.io/slot-gacor/

    https://l12.com.br/slot-gacor/

    slot paling gacor

    https://www.donalds-hobby.com/slot-online/

    https://thecryptodirt.com/slot-gacor-hari-ini/

    http://iseta.edu.ar/aulavirtual/app/upload/users/1/1205/my_files/sbobet.html

    http://escuelavirtual.mincit.gov.co/app/upload/users/1/194/my_files/slot.html

    https://www.dev.medecinesfax.org/courses/JUDICASINO/document/slot.html

    http://www.e-archivos.org/cursos/courses/JUDICASINO/document/slot-gacor.html

    http://iesma.com.br/ead/main/upload/users/4/447/my_files/slot.html

    https://www.fundacoop.org/chamilo/app/upload/users/1/1185/my_files/slot.html

    https://fata-aatf.org/eskola/main/upload/users/3/31/my_files/slot.html

    https://uancv.edu.pe/ofinvestigacion/app/upload/users/3/328/my_files/slot-terlengkap.html

    https://micost.edu.my/EL/app/upload/users/2/209/my_files/slot-gacor.html

    https://www.academiacoderdojo.ro/elearningdev/app/upload/users/2/2442/my_files/slot-online.html

    http://campus-cidci.ulg.ac.be/courses/JUDICASINO/document/slot-termurah.html

    https://www.escueladerobotica.misiones.gob.ar/aula-ste/courses/LIVECASINO/document/slot-tergacor.html

    http://ccdipeepccqqfar.usac.edu.gt/chamilo/app/upload/users/3/358/my_files/slot-online.html

    https://cunori.edu.gt/campus/app/upload/users/7/7334/my_files/slot-online.html

    http://u-rus.com.ar/aula/app/upload/users/1/1322/my_files/slot.html

    http://icrodarisoveria.edu.it/chamilo/app/upload/users/1/1855/my_files/slot.html

    https://iestpliliagutierrez.edu.pe/clarolgm/courses/CASINO/document/slot.html

    http://pva.cobach.edu.mx/app/upload/users/7/7379/my_files/slot.html

    http://www.imb-pc-online.edu.gt/PL/app/upload/users/3/373/my_files/slot.html

    http://avcs.upeu.edu.pe/main/upload/users/3333/my_files/slot.html

    https://chamilo.fca.uas.edu.mx/app/upload/users/1/11186/my_files/slot-online/

    TechBizWeb
    Facebook Twitter Instagram Pinterest Vimeo YouTube
    • Home
    • Guest Post
    • About Us
    • Privacy Policy
    • Our Authors
    • Terms and Conditions
    • Contact
    © 2022 Tech Biz Web. Developed by Sawah Dev.

    Type above and press Enter to search. Press Esc to cancel.