Industry News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Industry News
CT Interactive Appoints Todor Botsev as Business Development Manager for EMEA and Asia
CT Interactive has appointed Todor Botsev as its Business Development Manager for ЕМЕА and Аsia.
With over 16 years of experience in the dynamic and rapidly evolving casino industry, Todor specialises in online and offline business operations. His career has encompassed a variety of roles and responsibilities, including managing online and offline casino operations, optimising gaming platforms and developing strategic business initiatives.
Throughout his career, Todor has gained extensive experience in the development and implementation of new gaming products for online and offline casinos, working with a diverse range of gaming platforms and systems. His expert approach to data analysis and market trends enables him to design and execute innovative strategies for customer acquisition and retention, driving sustainable growth and expanding the customer base.
Todor’s strong leadership skills allow him to effectively manage teams and projects, with a focus on operational efficiency and staff development. His leadership philosophy is built on collaboration and a commitment to delivering the highest standards of customer service.
With his deep understanding of online casino operations and strategic thinking, Todor is a valuable addition to the CT Interactive team.
The post CT Interactive Appoints Todor Botsev as Business Development Manager for EMEA and Asia appeared first on European Gaming Industry News.
The chairman of Playtech, the London-listed gambling technology group, is to step down, triggering a search for a successor with a taste for stringent corporate governance challenges.
Egon Zehnder International, the boardroom headhunter, is being appointed to handle the search for Mr Mattingley’s successor, according to a source close to the situation.
A former chairman and chief executive of 888, the London-listed gaming company now known as Evoke, Mr Mattingley was also a founding director of Gala Leisure.
At Playtech, he has overseen a frenetic period of corporate activity while also finding himself in the eye of a series of storms with shareholders over boardroom pay and wider corporate governance.
The most recent of those came in December when close to a third of investors rebelled over a €100m bonus plan for Mor Weizer, the company’s chief executive, along with other senior executives.
Shareholders give Mr Mattingley credit, however, for helping to navigate the company through a challenging period in the gambling industry, in particular his role last year in securing the sale of Snaitech, its Italian consumer gambling arm, for €2.3bn.
That represented a nearly threefold return on Playtech’s initial investment in the business, triggering total returns to shareholders of up to €1.8bn – a sum almost equivalent to all of the special dividends paid by London-listed companies in 2023.
The sale of Snaitech will transform Playtech into a pure-play business-to-business operation.
During Mr Mattingley’s three-and-a-half year tenure, shares in the company have risen by about 60%.
The post Playtech Executive Chair Brian Mattingley Set to Step Aside appeared first on European Gaming Industry News.
CT Interactive is marking a resounding success following its participation in last week’s ICE 2025 trade show. As a global iGaming provider of innovative gaming solutions, the company used the event to solidify its market presence, seal new partnerships, unveil new gaming content and engage in productive discussions about its ambitious growth plans.
CT Interactive’s showcase at ICE Gaming 2025 reaffirmed its commitment to supporting its partners by expanding its portfolio of games available for their platforms. The company’s efforts to release fresh and engaging content have already been met with enthusiasm, setting the stage for stronger collaborations and greater player satisfaction.
Another highlight of the event was the company’s announcement about its impending certification for the Brazilian market. This milestone will enable CT Interactive to officially enter one of Latin America’s most dynamic and fast-growing regions.
“We’re thrilled about the opportunities Brazil offers. We have prepared a games list designed to resonate with the preferences of Brazilian players, and we’re eager to bring our portfolio to this exciting market,” Martin Ivanov, COO of CT Interactive, said.
ICE Gaming 2025 also provided an excellent platform for CT Interactive to explore growth opportunities in Eastern Europe. With its strong regulatory framework and growing appetite for online gaming, Ukraine featured prominently in the company’s discussions. CT Interactive is about to conclude a deal with a local partner, significantly boosting its presence in this emerging market.
“The Ukrainian market holds tremendous potential, and we’re keen to expand our footprint there. We are confident that our diverse portfolio of high-quality games will meet the expectations of operators and players alike,” Martin Ivanov said.
The company’s new game releases were another highlight of its ICE Gaming presence. CT Interactive’s cutting-edge titles, designed with captivating visuals and engaging gameplay, were met with widespread acclaim. These releases are expected to captivate players and drive significant revenue growth for its operator partners.
Reflecting on the event’s success, Martin Ivanov stated that CT Interactive’s participation allowed it to strengthen its relationships with partners, explore untapped opportunities and reinforce its position in the gaming industry.
“The show was an incredible opportunity to engage with our partners, showcase our innovations, and discuss strategies for mutual growth. We leave ICE Gaming 2025 energised and excited for what’s next,” Martin Ivanov added.
The post CT Interactive Reflects on Successful Showcase at ICE 2025 appeared first on European Gaming Industry News.
UKGC Launches Latest Consultation on Gaming Machine Technical Standards
Permanent Secretary for the Economy Visits MGA Offices
TENTENSEVEN MARKETING AGENCY LAUNCHES WITH €500K INVESTMENT FROM THE UNIT
Celebrate the Season of Love with Amusnet’s Diamond Plus – Valentine’s Edition
Cherry Play adds BetCity to growing roster of partners in the Netherlands
Saracen Casino Resort Chooses QCI Chatalytics to Enhance Casino Operations with Integrated AI Solutions
WA.Technology makes its debut in Brazil’s regulated market
EGT Digital’s top-performing titles are live on the leading Colombian betting site Betplay
BETBY TO INTRODUCE INDUSTRY-FIRST AI-BASED FEED AT ICE BARCELONA
Esports Highlights: Trends to Watch in 2025
-
gaming2 years agoODIN by 4Players: Immersive, state-of-the-art in-game audio launches into the next generation of gaming
-
EEG iGaming Directory8 years ago
iSoftBet continues to grow with new release Forest Mania
-
News7 years ago
Softbroke collaborates with Asia Live Tech for the expansion of the service line in the igaming market
-
News6 years ago
Super Bowl LIII: NFL Fans Can Bet on the #1 Sportsbook Review Site Betting-Super-Bowl.com, Providing Free Unbiased and Trusted News, Picks and Predictions
-
iGaming Industry7 years ago
Rick Meitzler appointed to the Indian Gaming Magazine Advisory Board for 2018
-
News6 years ago
REVEALED: Top eSports players set to earn $3.2 million in 2019
-
iGaming Industry7 years ago
French Senator raises Loot Boxes to France’s Gambling Regulator
-
News7 years ago
Exclusive Interview with Miklos Handa (Founder of the email marketing solutions, “MailMike.net”), speaker at Vienna International Gaming Expo 2018
