A few serious security flaws in Electronic Arts’ Origin Games could have allowed potential attackers to hijack millions of accounts. The EA Origin vulnerabilities, as discovered by the researchers, potentially risked 300 million accounts. Upon exploit by a bad actor, these could allow mass account takeovers without the need to steal login credentials.
Multiple EA Origin Vulnerabilities Discovered
Researchers from Check Point Research, together with CyberInt, have pointed out some serious security flaws targeting the gaming giant EA Games. These EA Origin vulnerabilities risked the security of over 300 million players of this platform. They have shared the details of the bugs and the associated dangers in a blog post.
As reported, the researchers spotted a chain of vulnerabilities that could allow an attacker to hijack logged-in account sessions by exploiting authentication tokens. A potential attacker could simply trick users by sending a malicious link with an EA subdomain. Because the link would appear legit, the victim would then click on it to fall victim to the attacker’s ploy. Consequently, the attacker would gain explicit access to the victim’s account. The attacker could even make purchases through the victim’s card as well.
Explaining about this malicious link, the researchers stated,
Due to misconfigurations in the Azure cloud platform, however, EA had changed the ‘ea-invite-reg-azurewebsites.net’ CNAME record so that the subdomain, ‘eaplayinvite.com’ no longer pointed to it. This meant that ‘eaplayinvite.ea.com’ now lead to a dead link.
The researchers could easily take over this subdomain, showing how easy it would be for a bad actor as well. They have demonstrated the entire attack method in the following video. Whereas, they have also separately explained the technical aspects of the vulnerabilities in a post.
EA Games Patched The Flaw
Upon receiving reports from the researchers, EA Games swiftly patched the flaws. Hence, the accounts now remain secure from such attacks. Nonetheless, the existence of such vulnerabilities in popular platforms despite previous reports is alarming. In January, Check Point Research reported a similar problem targeting Fortnite, which could allow massive account hacks.
Commenting about such behavior by the firms, Anurag Kahol, CTO and co-founder, Bitglass, said to LHN,
When individuals create profiles on websites, they should be able to trust that their accounts won’t be hacked. While no credentials were leaked and no personal information was stolen by hackers through the EA vulnerability, 300 million consumers could have had their accounts and their data exposed if researchers hadn’t found the issue and intervened. Despite this particular scenario, companies can’t rely upon third parties to find and fix security problems in their systems. As such, organizations must take a more proactive approach to defending customers’ personal information and accounts.
Also, Jonathan Bensen, CISO, Balbix, highlighted how cybersecurity has become a problem for most firms. As he told LHN,
Digital transformation has facilitated an exponential increase in the size of the enterprise attack surface. Corporate security teams are often overloaded with the mountainous task of keeping tabs on the hundreds of thousands of digital assets connected to their organization’s network. What’s more, 51 percent of organizations report a problematic shortage of cybersecurity skills, according to ESG’s annual survey. Seeing as data theft and cyber-attacks pose significant threats to companies around the world, organizations must adopt a robust solution that can assist corporate security teams in proactively identifying vulnerabilities that could lead to data exposure. Failing to secure data could lead to lawsuits and fines under data privacy regulations. For example, under GDPR, the fines could be 4 percent of annual global turnover.
‘AI Maybe A Solution’ – Says Jonathan Bensen
Bensen recommends the use of artificial intelligence to address cybersecurity issues.
AI has rapidly gained interest as a valuable approach that can help security teams to monitor the swathes of data being generated from all devices, apps, and users present in a network for potential vulnerabilities or cyber-risks. The top AI-based security tools can automatically discover and monitor all IT assets across a broad range of attack vectors, prioritize remediations based on business risk and even implement automatic remediation workflows by integrating into enterprise ticketing and security orchestration systems.
Let us know your thoughts in the comments.