Industry News

MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability

Published

5 years ago

October 22, 2020

George Miller

Reading Time: 3 minutes

Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.

The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.

Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.

Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.

The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.

Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.

What is SQL Injection?

First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.

Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.

The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.

The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.

How we found this vulnerability

Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.

What’s the impact of the vulnerability?

The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:

By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.

The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.

Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.

What to do if you’ve been affected?

If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.

However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.

Disclosure and lack of communication from BigMage Studios

Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.

We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.

Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.

Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.

Source

American gambling industry

Gaming Americas Weekly Roundup – September 29-October 5

Published

4 days ago

October 7, 2025

Niji Narayan

gaming-americas-weekly-roundup-–-september-29-october-5

Reading Time: 2 minutes

Welcome to our weekly roundup of American gambling news again! Here, we are going through the weekly highlights of the American gambling industry which include the latest news and new partnerships. Read on and get updated.

Latest News

Jackpot Digital Inc. has announced that it has been granted a Manufacturer and Distributor License by the Mississippi Gaming Commission. This approval authorizes Jackpot Digital to supply gaming equipment to licensed casino operators throughout Mississippi. This marks the Company’s second state-level manufacturer’s license in the US. Additional licensing applications are currently pending in other jurisdictions as part of the Company’s ongoing growth strategy. Mississippi is one of the nation’s premier destination gaming markets, generating over $2.4 billion in gross gaming revenue in 2023. The state’s Gulf Coast and Biloxi regions are particularly well known for their vibrant casino tourism and established gaming brands.

iDEA (iDevelopment and Economic Association), the leading trade association representing the U.S. online gaming industry, launched the definitive online destination for all things online gambling: ideagrowth.org. The new website provides the media, and U.S. legislators and regulators, a comprehensive resource for data-driven research, policy insights, and responsible gaming resources. The new website provides the industry’s most vital statistics and research — from consumer protections to economic development — in an engaging, accessible format designed for maximum impact.

CT Interactive has further strengthened its international presence by expanding its certified game portfolio on the regulated Peruvian market with 20 new titles. This milestone underscores the company’s commitment to delivering high-quality, engaging gaming content tailored specifically to regional markets. The newly certified portfolio features titles from CT Interactive’s popular Buy Bonus product line, including fan favorites such as Duck of Luck, Fruits & Sweets, Doctor Winstein, and Nanook the White Ghost. These enhanced editions deliver dynamic gameplay with one- or three-level Buy Bonus options, giving players new tools for diverse strategies and greater control over the game’s pace and excitement. A highlight of the newly certified titles is the launch of Lucky Clover 10, the latest addition to the acclaimed Clover-themed series.

Partnerships

CT Interactive has entered a new phase of its Latin American growth by launching its complete portfolio of games on Rushbet in Mexico and Peru. This collaboration with Rush Street Interactive—one of the region’s leading online casino and sportsbook operators—marks a significant step in the company’s international expansion. Players on Rushbet now have access to proven favorites like Lucky Clover, 40 Treasures, Win Storm and Big Chilli, along with the engaging Hot Luck three-level jackpot, designed to enhance player excitement and retention. This partnership underscores CT Interactive’s commitment to long-term collaboration and delivering tailored gaming solutions across diverse Latin American markets.

Hard Rock International has announced its 26th annual PINKTOBER campaign in partnership with Sports Illustrated Swimsuit ahead of this Breast Cancer Awareness Month. As a global entertainment and hospitality brand guided by the principle “All is One,” Hard Rock is leveraging every touchpoint to support the cause throughout October, from a limited-edition retail collection to special menu items and events. A portion of proceeds from PINKTOBER sales each year are donated to the Hard Rock Heals Foundation, the charitable arm of Hard Rock, to support breast cancer awareness and research worldwide. The program has raised over $13 million for breast cancer research since its inception.

The post Gaming Americas Weekly Roundup – September 29-October 5 appeared first on European Gaming Industry News.

Amusnet

Amusnet Releases Candy Wheel

Published

1 week ago

October 2, 2025

Niji Narayan

Reading Time: 2 minutes

Amusnet’s latest Live Casino portfolio addition, Candy Wheel, invites players on an unforgettable journey where every spin bursts with excitement. Candy Wheel dazzles with its vibrant gameplay centered around a colourful wheel divided into 50 dynamic sectors, each packed with unique payout possibilities. Players can jump into the action by placing their bets on six exciting sectors — also known as tickets — and predicting where the wheel will land next.

Led by a charismatic live presenter, every moment unfolds in real time with crystal-clear video streaming and multiple camera angles that capture each thrilling spin. The host keeps the energy sky-high — announcing results, chatting with players and turning every round into a full-on celebration.

And just when you think it can’t get any sweeter, Candy Wheel introduces a couple of special features to spice things up even more:

Candy Ticket

The Candy Ticket feature appears randomly during gameplay and rewards players with a free re-bet on one of the six tickets available. If you’ve placed a bet on the chosen ticket, you’ll automatically receive a free bet for the next round – same ticket, same value. Watch as your chip transforms into a candy-themed version and slides to the side, leaving you free to place new bets and double the fun.

Dynamic Multipliers

Dynamic Multipliers is a thrilling feature that can boost players’ payout up to 25x. Similar to the Candy Ticket feature, a multiplier and а sector are randomly selected and revealed on the circular screen. If you’ve placed a bet on that sector, your winnings will be multiplied by 2x, 5x, 10x or 25x. An electrifying twist that adds a whole new layer of suspense – and serious reward potential brought to every spin.

Jackpot Cards

The Jackpot Cards Bonus game is triggered at random during the gameplay to allow players to win impressive Jackpots.

The post Amusnet Releases Candy Wheel appeared first on European Gaming Industry News.

Amusnet

Golden Goal Roulette – Where Football Meets the Thrill of the Wheel

Published

1 week ago

October 1, 2025

Niji Narayan

golden-goal-roulette-–-where-football-meets-the-thrill-of-the-wheel

Reading Time: 2 minutes

Amusnet has released Golden Goal Roulette, the latest title in its new generation of virtual roulette games. Blending the elegance of classic roulette with the electrifying energy of football, this release transforms the iconic casino experience into a matchday celebration.

Set against the backdrop of a vividly designed football stadium, Golden Goal Roulette creates an immersive environment that transports players right into the heart of the game. From the realistic ambient sounds of cheering crowds to the sleek design of the roulette wheel, every detail is crafted to heighten the atmosphere and capture the excitement of sport.

What sets Golden Goal Roulette apart is its interactive gameplay mechanics. Unlike traditional versions, this virtual roulette allows players to control the start of each spin, introducing a fresh and dynamic twist to the experience. The result is a modernised game that blends tradition with innovation while keeping the familiar structure of European-style roulette.

Golden Goal Roulette supports a wide variety of betting options to suit every preference:

Inside Bets: Straight up, Split, Street, Corner, Line bet

Outside Bets: Column, Dozen, Low/High, Even/Odd, Red/Black.

With its authentic football theme, versatility and interactive features, Golden Goal Roulette adds a new layer of energy and entertainment to Amusnet’s growing Live Casino portfolio. It’s a title designed for both roulette enthusiasts and football fans alike — an engaging blend of two worlds that never fails to capture attention.

Auto Rebet

The Auto Rebet function allows players to repeat a selected bet. When enabled, the game enters automatic mode, where bets are placed automatically for a set number of games.

Favourite Bets

This function allows players to save up to 10 personally tailored bets or bet combinations for quick access during gameplay.

Jackpot Cards

The Jackpot Cards Bonus game is triggered at random during the gameplay to allow players to win impressive Jackpots.

The post Golden Goal Roulette – Where Football Meets the Thrill of the Wheel appeared first on European Gaming Industry News.