#Fortnite hacks caught full

вЂњTogether with the vulnerabilities we recently found in the platforms used by drone manufacturer DJI, show how susceptible cloud applications are to attacks and breaches. These flaws provided the ability for a massive invasion of privacy,вЂќВ said Oded Vanunu, head of products vulnerability research for Check Point. вЂњFortniteВ is one of the most popular games played mainly by kids. The vulnerability would also allow an attacker to listen to in-game chatter if they joined a match with the hacked account.

#Fortnite hacks caught full

If exploited, the vulnerability would have given an attacker full access to a userвЂ™s account and their personal information as well as enabling them to purchase virtual in-game currency using the victimвЂ™s payment card details, according to Check Point. Once clicked, the userвЂ™sВ FortniteВ authentication token could be captured by the attacker without the user entering any login credentials. ToВ fall victim toВ this attack, a player needed only to click on a crafted phishing link - one typically designed to look like it was coming from an Epic Games domain. Researchers outlined the process in which an attacker could have potentially gained access to a userвЂ™s account through vulnerabilities discovered in вЂFortniteвЂ™sвЂ™ user login process.В Due to three vulnerability flaws found in Epic GamesвЂ™ web infrastructure, researchers were able to demonstrate the token-based authentication process used in conjunctionВ with Single Sign-On (SSO) systems such as Facebook, Google, and Xbox toВ steal the userвЂ™s access credentials and take over their account. Instead, the security hole was tied to flaws found in two of Epic GamesвЂ™ sub-domains that were susceptible to a malicious redirect, allowing usersвЂ™ legitimate authentication tokens to be intercepted by a hacker from the compromised sub-domain. In this particular case, the issue wasnвЂ™t related to passwords though, hackers could gain access to an account without the need for any login information.