Security experts at Check Point discovered several issues in the popular online battle game Fortnite. One of the flaws is an OAuth account takeover vulnerability that could have allowed a remote attacker to takeover gamer accounts tricking players into clicking a specially crafted link.
Remaining flaws discovered by the experts include a cross-site scripting flaw, a SQL injection, and a web application firewall bypass bug.
The figures behind Fortnite are impressive, Fortnite has roughly 80 million monthly players, according to EpicFull, the game is responsible for almost half of their $5bn-$8bn estimated company value
“Due to flaws found in Epic Games’ web infrastructure, though, our researchers were able to identify vulnerabilities with the token authentication process to steal the user’s access token and perform an account takeover. ” reads the analysis published by CheckPoint.
The experts demonstrated that was possible to
“For the attack to be successful, all a victim needs to do is click on the malicious phishing link the attacker sends them. To increase the likelihood of a potential victim clicking on this link, for example, it could be sent with an enticement promising free game credits. Once clicked, with no need even for the user to enter any login credentials,
For the attack to be successful, all a victim needs to do is click on the malicious phishing link the attacker sends them. To increase the likelihood of a potential victim clicking on this link, for example, it could be sent with an enticement promising free game credits. Once clicked, with no need even for the user to enter any login credentials, their Fortnite authentication token would immediately be captured by the attacker.
Once obtained the token, an attacker could impersonate the victim and act on his behalf (access personal information,
“Users could well see huge purchases of in-game currency made on their credit cards with the attacker funneling that virtual currency to be sold for cash in the real world,” continues Check Point.
“After all, as mentioned above we have already seen similar scams operating on the back of Fortnite popularity.”
Checkpoint published a video PoC of the attack:
Check Point reported the flaws to Epic Games that fixed them in mid-December.
Full technical analysis of the flaws is available on Check Point Research.