Industry News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Powered by WPeMatico
RubyPlay has launched Firerose, a new studio aimed at building operator-specific casino game experiences, as suppliers and operators push for more branded content to stand out in crowded markets.
The company said Firerose is designed to let operators combine RubyPlay’s existing game catalogue with the studio’s technology and creative resources, using operator-led insight to shape games around an operator’s brand identity rather than standardised supplier content.
RubyPlay said Superbet is among the first operators to launch Firerose-powered titles. The supplier did not disclose game names or specific performance figures, but said early results showed “strong engagement metrics”.
Firerose becomes part of RubyPlay’s multi-studio structure alongside Koala Games, Mad Hat Games, Ruby Studio, and Xslots, which the company said share technology, infrastructure and distribution.
Dima Reiderman , Chief Commercial Officer at RubyPlay, said: ”Firerose represents a deliberate shift in how we think about content creation and partnership. The market is no longer driven solely by volume, but by identity. Operators want experiences that feel native to their brand and help them clearly differentiate in increasingly competitive casino environments.”
Dr. Eyal Loz, CPO at RubyPlay, added: “Firerose was created to put the operator’s voice at the centre of the creative process. Every game starts with their brand, their audience and their story, and our role is to bring that to life through the full weight of RubyPlay’s creative capabilities.
“We’re shaping experiences that players immediately associate with the operator itself. That level of ownership is what allows operators to stand out in increasingly crowded casino environments.”
The post RubyPlay launches Firerose studio for operator-specific casino games appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.
Expanse Studios, a subsidiary of Meridian Holdings Inc., announced the deployment of proprietary jackpot and tournament mechanics across its portfolio, providing B2B operator partners with engagement tools designed to enhance player entertainment value.
The system introduces two jackpot formats—Happy Hour Jackpot and Mystery Jackpot—alongside four tournament competition variants. Operators can control prize structures, scheduling parameters and promotional configurations through platform interfaces.
Happy Hour Jackpot provides scheduled jackpot events aligned with operator promotional strategies, enabling coordinated marketing campaigns and player communication around jackpot opportunities.
Mystery Jackpot delivers multi-tier progressive prize mechanics integrated into gameplay, with operator-configurable prize values and event parameters that support diverse promotional objectives.
Tournament mechanics include four competition formats:
• Bonus Buy tournaments create competitive environments for players who choose to engage with bonus purchase features, with scoring designed to reward strategic gameplay decisions.
• Spin Count tournaments track player activity across gameplay sessions, offering multiple entry opportunities and achievement-based progression that accommodates different play styles.
• Combo tournaments combine multiple competition elements, enabling operators to design promotional events that appeal to diverse player preferences and gaming behaviours.
• Time-based tournaments operate within defined promotional windows, allowing players to participate according to their own schedules while competing for tournament prizes.
“Content providers increasingly compete on operational capabilities, not just game quality. This positions our portfolio as solutions-oriented infrastructure that helps operators execute diverse promotional strategies while maintaining control over player engagement parameters,” said Damjan Stamenkovic, CEO of Expanse Studios.
Tournament formats integrate with game interfaces through standardised promotional systems designed to enhance entertainment value while providing operators with promotional flexibility.
For Expanse Studios, the deployment strengthens competitive positioning in B2B partnerships where operators increasingly evaluate content providers based on promotional feature capabilities in addition to game performance metrics.
The post Expanse Studios Launches Proprietary Jackpot and Tournament System appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.
Nils Ristau and Daniel Schmitz debut a work enablement platform aimed at day-to-day execution across product, retention and AI adoption.
Sparky Space, a new AI-powered work enablement platform founded by former German Air Force officer Nils Ristau and tech leader Daniel Schmitz, has launched and is now available globally for iGaming operators and suppliers.
The founders are positioning the product around execution support inside daily workflows as teams face tighter regulatory demands, faster product cycles and higher player expectations. The company cited industry research suggesting only 10-20% of learning is consistently applied in day-to-day work, creating a gap between training and on-the-job outcomes.
“In military operations, performance depends on clarity, structure, and disciplined execution in changing environments,” said Ristau. “The iGaming industry operates under similar pressure.
“Competitive advantage does not come from knowledge alone – it comes from how effectively teams apply it every day.”
Sparky Space said its platform supports areas including product development, player retention and AI adoption, with use cases spanning customer-centric experimentation, agile product and game development, decision-making and prioritisation, practical generative AI prompting, and cross-functional collaboration. The company said the tools are intended to help teams launch features, respond to regulatory change, and optimise marketing and support processes.
While initially focused on iGaming, Sparky Space said it has been built for broader use in other fast-moving, technology-driven industries.
Relevant data as follows:
- Sparky Space: https://www.sparkyspace.com Official company site for product and launch details.
- UK Gambling Commission: https://www.gamblingcommission.gov.uk Regulatory context referenced in the article’s discussion of increasing compliance pressure.
- Malta Gaming Authority: https://www.mga.org.mt Key European regulator relevant to operators and suppliers navigating shifting regulation.
The post Former German Air Force officer launches Sparky Space AI platform for iGaming teams appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.
-
Affiliate Industry7 days agoAlberta’s Next Step into a Regulated Commercial Gambling Market: What it Means for Operators and Affiliates
-
Africa7 days ago
Playson goes live with Betika in Kenya and Uganda
-
Central Europe7 days ago
ZEAL launches Dream Car Raffle charity lottery in Germany
-
Akshat Rathee6 days ago
Manish Agarwal Joins NODWIN Gaming Board as Non-Executive Director
-
AGCO6 days ago
Platipus Gaming secures Ontario supplier licence
-
Bally’s Intralot6 days ago
Bally’s Intralot Signs New Contract with British Columbia Lottery Corporation
-
Caesars Digital5 days ago
RubyPlay partners with Caesars Entertainment in Ontario to advance North American expansion
-
Latest News7 days ago
The AI fraud wars: Slotegrator shows operators how to fight back in new report
