Industry News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Powered by WPeMatico
AI-Driven Optimisation
HilltopAds Introduces Dedicated iGaming Feature Suite and Managed Performance Service
Reading Time: < 1 minute
HilltopAds announced the rollout of a specialised feature set built exclusively for iGaming advertisers, reinforcing the company’s focus on performance-driven media buying across global markets.
At the center of the release are newly launched, ready-to-use white- and blacklists, curated from premium traffic sources that have consistently shown strong results for iGaming campaigns. These lists are derived from performance data across thousands of active advertisers and are designed to reduce testing time while increasing the predictability of campaign outcomes.
HilltopAds is also introducing a full-managed service, giving advertisers access to dedicated iGaming specialists who will set up, launch and continuously optimise campaigns based on individual KPI requirements. This service aims to support teams looking for deeper expertise, streamlined workflows or hands-off performance management.
To mark the launch, HilltopAds is providing a $2000 bonus for all direct iGaming advertisers making their first deposit of $5000 or more using the promo code IGAVCIP.
These updates complement HilltopAds’ existing capabilities for the iGaming sector, including:
• Massive Global Reach: Over 273B monthly impressions available across 250+ countries.
• Premium Direct Traffic: Access to 39,000+ vetted websites suitable for iGaming user acquisition.
• AI-Driven Optimisation: Automated tools focused on maximising bets, deposits and high-value player actions.
• Flexible Bidding Models: CPM, CPC and CPA Goal options tailored for scale and performance control.
• Specialised Network Infrastructure: Built to support consistent delivery, stable volumes and transparent reporting for regulated verticals.
With these additions, HilltopAds aims to provide iGaming advertisers with a more data-grounded, efficient and scalable environment for user acquisition.
The post HilltopAds Introduces Dedicated iGaming Feature Suite and Managed Performance Service appeared first on European Gaming Industry News.
Reading Time: < 1 minute
FUN88, a leading platform in igaming and sports entertainment, announced the launch of USDT (Tether) as a new payment option. This addition provides users with a faster, more secure way to manage funds, ensuring smooth transactions from deposits to withdrawals. Supported by major exchanges like Binance, USDT enhances the FUN88 experience with speed, reliability and convenience.
Key Benefits of Using USDT on FUN88:
• Reliable Protection: Secure transactions, keeping the financial information private and safe.
• Fast Transactions: USDT enables instant deposits and withdrawals.
• Stable Value: Tether is tied to the US Dollar, offering a stable and predictable payment method, free from price fluctuations.
• Global Use & 24/7 Availability: USDT is accepted worldwide and available for transactions at any time, offering unlimited deposit limits.
The FUN88 KYC process follows strict anti-money-laundering policies, ensuring a safe and fair environment for all players.
FUN88 offers a secure and engaging experience with simple registration, the FUN88 app and rewarding gameplay. New players can enjoy attractive benefits, including a welcome bonus. With the integration of USDT as a payment option, FUN88 ensures a fast, secure and exciting journey for all players- from sign-up and first deposit to withdrawals.
The post FUN88 Introduces USDT Payments for Faster, Safer and More Rewarding Gaming appeared first on European Gaming Industry News.
Reading Time: 2 minutes
Welcome to our weekly roundup of American gambling news again! Here, we are going through the weekly highlights of the American gambling industry which include the latest news and new partnerships. Read on and get updated.
Latest News
VGO Promo, a long-standing platform known for bridging the worlds of cryptocasinos, cryptocurrency exchanges and CSGO skins gaming, has announced a comprehensive expansion of its verification framework designed to bring transparency to online promotional offers. The updated system enhances how users evaluate bonuses across three intersecting ecosystems. Founded during the peak of the CSGO skins economy, VGO Promo originally provided referral codes for case opening websites and virtual item platforms. As the industry evolved towards blockchain based gaming, Bitcoingambling and crypto trading, VGO Promo expanded its scope to support modern platforms including Roobet, Stake, Rollbit, CSGORoll, Duelbits, Binance, OKX, ByBit, Bitget and various case opening services within the CSGO community. The updated verification framework applies a structured, cross industry methodology to help users navigate rapidly changing promotional conditions.
FanDuel has announced the launch of Pass The Leg, a first-of-its-kind in-app feature that transforms traditional parlay betting into a shared, social experience just in time for holiday gatherings. Pass The Leg allows customers to build a single group parlay collaboratively, with each participant adding their own leg before placing individual bets using their own funds. Designed to bring friends and family together around one of the biggest football days of the year whether near or far, the feature allows users to start or join a Group Build, invite others to contribute picks, and then add the completed parlay to their personal betslip. Each contributor can also take advantage of a dedicated Pass The Leg Profit Boost, amplifying the excitement and potential payout of the shared pick. Available exclusively for the three NFL games taking place on Thanksgiving Day, Pass The Leg marks the first true multi-user parlay-building experience offered by a major U.S. sportsbook operator.
Partnerships
The St. Louis Blues announced an agreement designating DraftKings an Official Sports Betting and Daily Fantasy Operator of the Blues. The announcement comes ahead of the launch of legal sports betting in Missouri scheduled for Dec. 1, 2025. DraftKings has been an Official Sports Betting, Daily Fantasy Sports and iGaming Partner of the National Hockey League since 2021. As part of the agreement, DraftKings will spotlight responsible gaming through a pregame, in-arena feature, encouraging fans to play responsibly, have fun and access DraftKings’ comprehensive suite of responsible gaming tools and resources. DraftKings will have rights to use St. Louis Blues intellectual property — including team trademarks and logos — across marketing and promotional materials. The collaboration will feature in-arena signage, brand integrations across television and radio and exclusive hospitality experiences throughout the season, all designed to elevate fan engagement at the Enterprise Centre and beyond.
Signature Systems Inc (SSI) has announced a new partnership with Yellow Dog Software. The integration connects Yellow Dog’s advanced inventory capabilities with SSI’s PDQ POS system, enabling operators to streamline operations, improve cost control and gain real-time visibility across their properties. The partnership was initiated to meet the inventory needs of Osage Casinos, a major name in tribal gaming. The integration, which went live in September, was first deployed to support convenience store reporting and ordering across the properties.
The post Gaming Americas Weekly Roundup – November 24-30 appeared first on European Gaming Industry News.
-
Asia6 days agoPacific Online-backed Buenas PH Inks Partnership with YGS Live’s Battle of the Streamers to Support Ethical iGaming
-
Aviamasters6 days ago
BGaming’s Viral Hit Aviamasters™ Gets an Exciting X-Mas edition
-
Christmas slot6 days ago
Spinomenal marks the start of the holiday season with Majestic Santa
-
Big Sugar Bonanza Xmas6 days ago
Stakelogic adds festive flavour to fan-favourite with Big Sugar Bonanza Xmas
-
Africa6 days ago
Logifuture-powered Bet9ja releases Moses Itauma mini-series ahead of Jermaine Franklin fight
-
B2B gaming software6 days ago
Expanse Studios Secures Romanian Class 2 B2B Gaming License
-
Compliance Updates5 days agoThe UAE Gambling License May Become the Most Valuable to Get in 2026
-
Christmas slot6 days ago
Million Games Launches Rudolph’s Gone Rogue – A Frenzied Christmas Slot of Wild Wins
