Industry News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Powered by WPeMatico
Reading Time: 2 minutes
Welcome to our weekly roundup of American gambling news again! Here, we are going through the weekly highlights of the American gambling industry which include the latest news and new partnerships. Read on and get updated.
Latest News
VGO Promo, a long-standing platform known for bridging the worlds of cryptocasinos, cryptocurrency exchanges and CSGO skins gaming, has announced a comprehensive expansion of its verification framework designed to bring transparency to online promotional offers. The updated system enhances how users evaluate bonuses across three intersecting ecosystems. Founded during the peak of the CSGO skins economy, VGO Promo originally provided referral codes for case opening websites and virtual item platforms. As the industry evolved towards blockchain based gaming, Bitcoingambling and crypto trading, VGO Promo expanded its scope to support modern platforms including Roobet, Stake, Rollbit, CSGORoll, Duelbits, Binance, OKX, ByBit, Bitget and various case opening services within the CSGO community. The updated verification framework applies a structured, cross industry methodology to help users navigate rapidly changing promotional conditions.
FanDuel has announced the launch of Pass The Leg, a first-of-its-kind in-app feature that transforms traditional parlay betting into a shared, social experience just in time for holiday gatherings. Pass The Leg allows customers to build a single group parlay collaboratively, with each participant adding their own leg before placing individual bets using their own funds. Designed to bring friends and family together around one of the biggest football days of the year whether near or far, the feature allows users to start or join a Group Build, invite others to contribute picks, and then add the completed parlay to their personal betslip. Each contributor can also take advantage of a dedicated Pass The Leg Profit Boost, amplifying the excitement and potential payout of the shared pick. Available exclusively for the three NFL games taking place on Thanksgiving Day, Pass The Leg marks the first true multi-user parlay-building experience offered by a major U.S. sportsbook operator.
Partnerships
The St. Louis Blues announced an agreement designating DraftKings an Official Sports Betting and Daily Fantasy Operator of the Blues. The announcement comes ahead of the launch of legal sports betting in Missouri scheduled for Dec. 1, 2025. DraftKings has been an Official Sports Betting, Daily Fantasy Sports and iGaming Partner of the National Hockey League since 2021. As part of the agreement, DraftKings will spotlight responsible gaming through a pregame, in-arena feature, encouraging fans to play responsibly, have fun and access DraftKings’ comprehensive suite of responsible gaming tools and resources. DraftKings will have rights to use St. Louis Blues intellectual property — including team trademarks and logos — across marketing and promotional materials. The collaboration will feature in-arena signage, brand integrations across television and radio and exclusive hospitality experiences throughout the season, all designed to elevate fan engagement at the Enterprise Centre and beyond.
Signature Systems Inc (SSI) has announced a new partnership with Yellow Dog Software. The integration connects Yellow Dog’s advanced inventory capabilities with SSI’s PDQ POS system, enabling operators to streamline operations, improve cost control and gain real-time visibility across their properties. The partnership was initiated to meet the inventory needs of Osage Casinos, a major name in tribal gaming. The integration, which went live in September, was first deployed to support convenience store reporting and ordering across the properties.
The post Gaming Americas Weekly Roundup – November 24-30 appeared first on European Gaming Industry News.
Balkans
EGT Digital Wins “Online Platform of the Year” for the Second Consecutive Year at the Golden Spade’s Awards 2025
Reading Time: 2 minutes
EGT Digital celebrated a remarkable achievement at this year’s Golden Spade’s Awards, securing the prestigious title “Online Platform of the Year” for its modular platform X-Nave for the second year in a row. The award was accepted by Georgi Mihaylov, Deputy CEO of EGT Digital, marking another milestone in the company’s continued progress and commitment to technological excellence.
In 2025, X-Nave distinguished itself through the integration of EGT Digital’s proprietary in-house AI core, developed entirely by the company’s data science team. This innovation transformed X-Nave into a holistic, intelligent ecosystem with capabilities such as real-time player protection, predictive churn prevention, intelligent campaigns, personalized game recommendations, automated bonus optimization, and enhanced QA through simulated behavior. Combined with its modular structure – comprising the CRM Engine, Gaming Aggregator, Sport Product, and Payment Gateway – X-Nave continues to serve as one of the most advanced and reliable platforms in the industry.
Accepting the award, Georgi Mihaylov expressed his gratitude: “These awards are an exceptional recognition of our work. On behalf of the EGT Digital team, a huge thank you, and I can’t wait for us to come back again next year.”
Special Recognition for Industry Leadership
The Golden Spade’s Awards also honored Mr. Vladimir Dokov, CEO of both EGT Digital and EGT, with the distinguished title “Outstanding Contribution to the Development of the Gaming Industry.” This accolade recognizes his long-term leadership, strategic vision, and significant impact on the growth and evolution of both the Bulgarian and global gaming sectors.
Mr. Dokov accepted the award with a message dedicated to his team:
“What we have achieved is not thanks to me, but thanks to our team of 4,300 people and this award belongs to them.”
A Milestone Year for the EGT Group
These recognitions highlight an exceptional year for both EGT Digital and EGT, reflecting their shared commitment to innovation, responsibility, and delivering impactful solutions for partners and players worldwide.
The post EGT Digital Wins “Online Platform of the Year” for the Second Consecutive Year at the Golden Spade’s Awards 2025 appeared first on European Gaming Industry News.
Reading Time: 2 minutes
Entain’s Pitching In initiative has beaten off fierce competition to be named Grassroots Initiative of the Year at the Global Football Industry Awards. Launched by Entain in 2020, the trailblazing initiative has made a huge impact at the non-league level of England’s national game.
Pitching In is the title sponsor of the Isthmian, Northern Premier and Southern Leagues – collectively known as the Trident Leagues – that comprise 264 clubs at Steps three and four of the non-league pyramid.
Pitching In, however, has always been about more than a flagship sponsorship. At the heart of the initiative is the ambition to enhance engagement between football clubs and their local communities. This led to Entain being the founding partner of the Trident Community Fund (TCF).
The TCF was launched to help clubs establish and expand community initiatives, maximising the remarkable impact that grassroots football clubs have on their local area. Every club in the Trident Leagues is encouraged to apply for a grant of up to £5000 annually to support community initiatives. The TCF has now supported more than 150 such projects, helping to expand youth, women’s and walking football, as well as supporting initiatives focusing on local upskilling, tackling anti-social behaviour and supporting local veterans and food banks.
In 2022, Pitching In launched the Volunteer Hub to provide a one-stop online portal for clubs to post volunteering vacancies and for local people to sign up and get involved.
Pitching In’s contribution to the grassroots game has now been recognised at the Global Football Industry Awards, a landmark global ceremony which brings together industry giants and trailblazers from every corner of the football ecosystem.
Pitching In was up against the likes of McDonalds, Barclays, Adidas, Nike and Coca-Cola, who were among the other shortlisted nominees for the Grassroots Initiative of the Year prize. Hosted by football royalty – Jamie Carragher and Peter Crouch – the awards celebrate the visionaries, pioneers and change-makers powering world football from behind the scenes.
Stella David, CEO of Entain, said: “We are delighted to see Pitching In recognised in this manner. Football is central to our business, which is why we feel it is so important to invest in the sport at the grassroots level, playing our part in bringing clubs and their communities closer together.
“When we started this project back in 2020, non-league clubs – and English football more generally – were staring into an uncertain future amid the Covid-19 pandemic.
“The grants Pitching In provided at that time proved crucial and we have continued to grow our relationship with the more than 260 clubs, who are the backbone of the English game, over the time since. We love supporting grassroots football and are excited by how this partnership can grow and evolve further.
“We would like to thank the Northern Premier League, Isthmian League and Southern League for their continued support, along with every single volunteer who gives up their time for their local football club. The game at this level could not run without you and Pitching In will continue to do what we can to highlight your invaluable contributions.”
Carmen Alexander from the Global Football Industry Awards added: “Congratulations to Entain and all 2025 Global Football Industry Award winners.
“Our judges were impressed by the commitment Entain has shown to grassroots football over a prolonged period of time and particularly the Trident Community Fund, which continues to make a tangible difference to non-league clubs across the country. Entain is very worthy of this recognition.”
The post Entain’s Pitching In Initiative Crowned Grassroots Sports Initiative of the Year appeared first on European Gaming Industry News.
-
Australia7 days agoCrown Melbourne Fined for Exclusion Breach
-
Balkans7 days ago
EGT Digital Wins “Online Platform of the Year” for the Second Consecutive Year at the Golden Spade’s Awards 2025
-
ELA Games6 days ago
Glory & Honour Await the Strongest Gladiators in ELA Games’ Newest Game, Roman Fortune
-
Amusnet5 days ago
Amusnet Celebrates Double Victory at the Golden Spades Awards 2025
-
Helge Løken6 days ago
Helge Løken Resigns as CTO of Norsk Tipping
-
Asia6 days ago
Stricter rules help shape a more responsible E-Games sector – PAGCOR
-
Asia6 days ago
BetConstruct AI to Participate in SiGMA South Asia 2025
-
Asia6 days ago
S8UL Esports Secures iQOO as Title Sponsor for its Pokémon UNITE and MOBA Legends 5v5 Rosters
