Serious vulnerabilities discovered in the game client Origin from Electronic Arts
Check Point Research and CyberInt identified a number of defects in Electronic Arts ' Origin game customer. If exploited, the vulnerabilities might have resulted to the player's account being controlled and his identity being theft. Therefore, malicious individuals who can exploit the vulnerabilities can acquire extensive game libraries that are not otherwise accessible to legitimate owners except in internet format. Essentially, the company's scientists go to test the prospective vulnerabilities and then work with EA to discover a solution.
The EA platform faults did not involve the user to communicate any access information. Instead, they utilized deserted subdomains and using EA Games authentication tokens in conjunction with the Single Sign-On (SSO) system of OAuth and TRUST discovered within the login method of the user. EA Game. Recently, Check Point Research revealed a comparable case involving another game, Fortnite.
EA games use addresses such as ea.com and origin.com to handle player-driven services such as establishing new gaming accounts such as Apex Legends, accessing characteristics from the social networks of Origin and purchasing new games from the online store. Generally speaking, each cloud type service provided by EA is recorded with a distinctive subdomain address such as eaplayinvite.ea.com and has a DNS pointer on a cloud service provider host (ea-invite-reg.azurewebsites.net) so that the required background service operates on Azure (in this case it is a web application server). The scientists have been able to create a redirection to your Azure profileofeaplayinvite.ea.com.
"Each Azure user account may request the registration of a particular service name (Service-Name.azurewebsites.net) connected to a particular domain or subdomain," reads the technical documentation. "But while looking for CyberInt, it was found that the ea-invite-reg.azurewebsites.net service was no longer in use within Azure cloud services, but that the distinctive eaplayinvite.ea.com subdomain is still redirecting to it using a CNAME-type record."
"The CNAME redirection of amelayinvite.ea.com enables us to generate a fresh registration request in our Azure account and to register ea-invite-reg.azurewebsites.net as a fresh web application service on our proprietary Azure profile. This permitted us to hijack the eaplayinvite.ea.com subdomain and monitor applications produced by true EA customers."
"CyberInt provides a timely and automated detection system capable of predicting hacker movements and enabling businesses to proactively protect their clients and company," said Itay Yanovski, co-founderand CyberInt Technologies SVP Strategy. "Gaming goods can be discovered within the dark web in both formal and unofficial marketplaces, which makes gaming studio assaults very lucrative. We think that it is the responsibility of the IT security sector to safeguard individuals, so it is our duty to reveal studies devoted to threats identified in opposition campaigns, such as the latest TA505, with the objective of increasing awareness of more efficient identification and mitigation measures. "Check Point and CyberInt highly recommend customers to activate two-factor authentication and use only the official website to purchase and download games. Parents should then raise their children's awareness of the hazards of online fraud and the risk that cyber criminals may take any action to steal private and economic data that may be present online.