A week in security (February 17 – 23)

Last week on Malwarebytes Labs, we highlighted the benefits and concerns of identity-as-a-service IDaaS, an identity management scheme deployed from the cloud; reported on scammers and squatters taking advantage of Rudy Giuliani’s Twitter typos; and gave a high-level overview of RobbinHood, the...

Rockstar Games: Dom based XSS on www.rockstargames.com/GTAOnline/features/freemode

In this report, the researcher identified a DOM-Based XSS vulnerability on www.rockstargames.com/GTAOnline/features/freemode. This type of attack can result in cookie theft, or enable CSRF and phishing attacks. With the researcher's help we were able to identify the cause of the vulnerability and...

Latest LokiBot malware variant distributed as Epic Games installer

By Deeba Ahmed The new variant of the notorious LokiBot malware is more sophisticated and effective than its previous versions. This is a post from HackRead.com Read the original post: Latest LokiBot malware variant distributed as Epic Games installer...

Rockstar Games: Open redirect in https://www.rockstargames.com/GTAOnline/restricted-content/agegate/form may lead to Facebook OAuth token theft

In this report, the researcher identified an Open Redirect vulnerability in the age-gate code on the GTA Online sub-site. This vulnerability could also potentially have caused sensitive tokens to leak via the Referer header if it were exploited under specific circumstances. The Open Redirect was...

Rockstar Games: csrf in https://www.rockstargames.com/reddeadonline/feedback/submit.json

In this report, the researcher discovered an endpoint that lacked CSRF protection and demonstrated a way to exploit it via a remote webserver. Typically CSRF-related reports are not eligible for bounty, but the impact of this exploit was high enough to warrant a reward. This was only exploitable ...

Rockstar Games: Image Injection/XSS vulnerability affecting https://www.rockstargames.com/newswire/article

In this report, the researcher demonstrated a method to chain together separate vulnerabilities that, under certain conditions, could cause a user's Facebook Oauth tokens to leak via the Referer header. The specific vulnerability that was addressed in this report was the image injection/XSS...

Rockstar Games: Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft.

In this report, the researcher demonstrated a method to chain together separate vulnerabilities that, under certain conditions, could cause a user's Facebook Oauth tokens to leak via the Referer header. In this instance, an Open Redirect vulnerability was utilized to exploit the fact that the ful...

mail.compulsiongames.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1081212 Security Researcher geeknik Helped patch 8908 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting mail.compulsiongames.com...

Rockstar Games: Image Injection vulnerability in www.rockstargames.com/IV/screens/1280x720Image.html

In this report, the researcher demonstrated a method to chain together separate vulnerabilities that, under certain conditions, could cause a user's Facebook Oauth tokens to leak via the Referer header. The specific vulnerability that was addressed in this report was the image injection component...

Rockstar Games: Open redirect affecting m.rockstargames.com/

In this report, the researcher identified an open redirect vulnerability on our Support site that impacted m.rockstargames.com, among other subdomains that were no longer actively being maintained. By addressing the problem on the Support site, we were able to prevent it from being further...

The vulnerability of the NVIDIA Games App software component of the NVIDIA Shield TV Experience device allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the NVIDIA Games App software on the NVIDIA Shield TV Experience device is related to lack of access control. Exploiting this vulnerability could allow a hacker to cause service failures or execute arbitrary codes...

games-dendy.ru Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8574 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting games-dendy.ru website and its users. Following coordinate...

Details of the Olympic Destroyer APT

Interesting details on Olympic Destroyer, the nation-state cyberattack against the 2018 Winter Olympic Games in South Korea. Wired's Andy Greenberg presents evidence that the perpetrator was Russia, and not North Korea or China...

Rockstar Games: Unquoted Service Path in "Rockstar Game Library Service"

In this report, the researcher discovered a flaw in a Registry entry created by the Rockstar Service, which is used to install, update, and uninstall Rockstar Games titles on Windows PCs. Specifically, the ImagePath setting used by the entry was not enclosed in quotation marks. Using quotation...

Cheating at Professional Poker

Interesting story about someone who is almost certainly cheating at professional poker. But then I start to see things that seem so obvious, but I wonder whether they aren't just paranoia after hours and hours of digging into the mystery. Like the fact that he starts wearing a hat that has a...

virtualrealitygamesfree.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-970203 Security Researcher Hchabik Helped patch 2469 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting virtualrealitygamesfree.com...

CB TAU Threat Intelligence Notification: State-Sponsored Espionage Group Targeting Multiple Verticals with ‘Crosswalk’

FireEye recently reported on APT41, a Chinese state-sponsored espionage group. The group has been documented as targeting healthcare, high-tech, and telecommunications companies for traditional corporate espionage purposes. Additionally this group has also targeted companies in the video game...

Epic Games slapped with lawsuit over hacked Fortnite accounts

By Waqas Epic Games who developed Fortnite has been sued for not protecting Fortnite accounts from hackers. This is a post from HackRead.com Read the original post: Epic Games slapped with lawsuit over hacked Fortnite accounts...

Epic Games Hit With Class Action Lawsuit Over Hacked 'Fortnite' Accounts

Epic Games, the creator of the popular 'Fortnite' video game, is facing a class-action lawsuit from gamers over hacked Fortnite accounts, accusing the company of failing to maintain adequate security measures and notify users of the security breach in a timely manner. The lawsuit, filed by...

Epic Games Hit With Class Action Lawsuit Over Hacked 'Fortnite' Accounts

Epic Games, the creator of the popular 'Fortnite' video game, is facing a class-action lawsuit from gamers over hacked Fortnite accounts, accusing the company of failing to maintain adequate security measures and notify users of the security breach in a timely manner. The lawsuit, filed by...