Cloud Cybersecurity DIGITAL Uncategorized

Check Point uncovers vulnerabilities giving hackers window to hijack Fortnite gamers’ data’

check point - Science and Digital News

IF you are a gamer and playing a certain kind of game, like new entrant Fortnite, played by 80 million gamers across the world, you might as well read the following story from Check Point Software Technologies, Inc.

Check Point is a leading provider of cybersecurity solutions to governments and corporate enterprises globally.

SINGAPORE – Researchers at Check Point® Software Technologies Ltd. (NASDAQ: CHKP), a leading provider of cyber security solutions globally, on January 16 shared details of vulnerabilities that could have affected any player of the hugely popular online battle game, Fortnite.

check point logo - Science and Digital News

Fortnite has nearly 80 million players worldwide. The game is popular on all gaming platforms, including Android, iOS, PC via Microsoft Windows and consoles such as Xbox One and PlayStation 4.  In addition to casual players, Fortnite is used by professional gamers who stream their sessions online and is popular with e-sports enthusiasts.

If exploited, the vulnerability would have given an attacker full access to a user’s account and their personal information  as well as enabling them to purchase virtual in-game currency using the victim’s payment card details. The vulnerability would also have allowed for a massive invasion of privacy as an attacker could listen to in-game chatter as well as surrounding sounds and conversations within the victim’s home or other location of play.

Scams and deception

While Fortnite players had previously been targeted by scams that deceived them into logging into fake websites that promised to generate Fortnite’s “V-Buck” in-game currency, these new vulnerabilities could have been exploited without the player handing over any login details.

Researchers outlined the process in which an attacker could have potentially gained access to a user’s account through vulnerabilities discovered in Fortnite’s user login process. Due to three vulnerability flaws found in Epic Games’ web infrastructure, researchers were able to demonstrate the token-based authentication process used in conjunction with Single Sign-On (SSO) systems such as Facebook, Google and Xbox to steal the user’s access credentials and take over their account.

To fall victim to this attack, a player needs only to click on a crafted phishing link coming from an Epic Games domain, to make everything seem transparent, though sent by the attacker. Once clicked, the user’s Fortnite authentication token could be captured by the attacker without the user entering any login credentials. According to Check Point’s researchers, the potential vulnerability originated from flaws found in two of Epic Games’ sub-domains that were susceptible to a malicious redirect, allowing users’ legitimate authentication tokens to be intercepted by a hacker from the compromised sub-domain.

check point Fortnite logo - Science and Digital News
Image: courtesy of Etsy.com

“Fortnite is one of the most popular games played mainly by kids. These flaws provided the ability for a massive invasion of privacy,” said Oded Vanunu, head of products vulnerability research for Check Point.

“Together with the vulnerabilities we recently found in the platforms used by drone manufacturer DJI, show how susceptible cloud applications are to attacks and breaches. These platforms are being increasingly targeted by hackers because of the huge amounts of sensitive customer data they hold. Enforcing two-factor authentication could mitigate this account takeover vulnerability.”

Vulnerabilities fixed already

Check Point has notified Epic Games of the vulnerability which has now been fixed. Check Point and Epic Games advise all users to remain vigilant whenever exchanging information digitally, and to practice safe cyber habits when engaging with others online.  Users should also question the legitimacy of links to information seen on user forums and websites.

Organizations must perform thorough and regular hygiene checks on their IT infrastructure they have not left outdated and unused sites or access points online. In addition, it is good practice to review any outdated website or sub-domains that may still be online though not in use.

In order to minimize the threat of falling victim to an attack that exploits vulnerabilities like this, users should enable two-factor authentication, ensuring that when logging into their account from a new device, the player would need to enter a security code sent to the account holder’s email addresses. It is also important that parents make their children aware of the threat of online fraud and warn them that cyber criminals will do anything to gain access to personal and financial details which may be held as part of a gamer’s online account. (Check Point)

A full technical analysis of this vulnerability is available from the Check Point Research blog:  https://research.checkpoint.com/hacking-fortnite/

Source:

McGallen and Bolden

Image through Fortnite

Hello, Cyber World! A journalist's passion for news, which for me is every and any kind of news, but specially on Science, Technology, Innovation, Digital, and Current News, or just about anything under Heaven, birthed this news platform. Disclosure: I am not a scientist nor an expert on anything Science, and not a techie either; just some journalist who loves and care to bring the good news and share them to everyone out there. It is a big, big physical world out there, but the Industrial Revolution 4.0, the Internet in the Digital Age, has shrunk Earth into one small virtual community. Each human being a "neighbor" to everyone in the Philippines and in any point of the compass. Whatever you may see or think could be my and this site's shortcoming, my apologies. So, there, please join me in my journey in cyberspace! Be home, be safe, be mindful of your neighbors, of the Creator! Thanks so much.

0 comments on “Check Point uncovers vulnerabilities giving hackers window to hijack Fortnite gamers’ data’

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: