Epic Games has repaired a vulnerability that exposed Fortnite, the world’s most popular game of the moment, to hackers. The hole, which was left in Epic’s web infrastructure, allowed hackers to target players with email that appeared to come from Epic Games, but would have led them to a phishing site, where their log-in details would have been stolen.
Researchers at cyber security solutions provider Check Point Software alerted Epic to vulnerabilities that could have affected any player of the hugely popular online battle game.
Fortnite has nearly 80 million players worldwide. The game is popular on all gaming platforms, including Android, iOS, PC via Microsoft Windows and consoles such as Xbox One and PlayStation 4. In addition to casual players, Fortnite is used by professional gamers who stream their sessions online, and is popular with e-sports enthusiasts.
If exploited, the vulnerability would have given an attacker full access to a user’s account and their personal information as well as enabling them to purchase virtual in-game currency using the victim’s payment card details. The vulnerability would also have allowed for a massive invasion of privacy, as an attacker could listen to in-game chatter as well as surrounding sounds and conversations within the victim’s home or other location of play.
While Fortnite players had previously been targeted by scams that deceived them into logging into fake websites that promised to generate Fortnite’s ‘V-Buck’ in-game currency, these new vulnerabilities could have been exploited without the player handing over any login details
Click here to read how the Fortnite hack worked
To win a set of three Fortnite Funko Pop Figurines, click here.
How the Fortnite hack would have worked
Researchers outlined the process in which an attacker could have potentially gained access to a user’s account through vulnerabilities discovered in Fortnite’s user login process. Due to three vulnerability flaws found in Epic Games’ web infrastructure, researchers were able to demonstrate the token-based authentication process used in conjunction with Single Sign-On (SSO) systems such as Facebook, Google and Xbox to steal the user’s access credentials and take over their account.
To fall victim to this attack, a player needed to click on a crafted phishing link coming from an Epic Games domain, to make everything seem transparent, though sent by the attacker. Once clicked, the user’s Fortnite authentication token would have been captured by the attacker without the user entering any login credentials. According to Check Point’s researchers, the potential vulnerability originated from flaws found in two of Epic Games’ sub-domains that were susceptible to a malicious redirect, allowing users’ legitimate authentication tokens to be intercepted by a hacker from the compromised sub-domain.
“These flaws provided the ability for a massive invasion of privacy,” said Oded Vanunu, head of products vulnerability research for Check Point. “Together with the vulnerabilities we recently found in the platforms used by drone manufacturer DJI, they show how susceptible cloud applications are to attacks and breaches. These platforms are being increasingly targeted by hackers because of the huge amounts of sensitive customer data they hold. Enforcing two-factor authentication could mitigate this account takeover vulnerability.”
Check Point notified Epic Games of the vulnerability, which was then fixed.
Click here to read how consumers and companies can protect themselves from such vulnerabilities.
To win a set of three Fortnite Funko Pop Figurines, click here.
Check Point and Epic Games have advised all users
- emain vigilant whenever exchanging information digitally;
- practice safe cyber habits when engaging with others online;
- question the legitimacy of links to information seen on user forums and websites;
- enable two-factor authentication, ensuring that when logging into their account from a new device, the player would need to enter a security code sent to the account holder’s email addresses
Organisations must:
- perform thorough and regular hygiene checks on their IT infrastructure
- ensure they have not left outdated and unused sites or access points online
- review any outdated website or sub-domains that may still be online though not in use.
Parents must also make their children aware of the threat of online fraud and warn them that cyber criminals will do anything to gain access to personal and financial details which may be held as part of a gamer’s online account.