Industry News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Powered by WPeMatico
Welcome to our weekly roundup of American gambling news again! Here, we are going through the weekly highlights of the American gambling industry which include the latest news and new partnerships. Read on and get updated.
Latest News
AU10TIX announced the launch of a free Child Safety Age Assurance Risk and Readiness Assessment and Age Assurance Readiness Guide designed to help businesses better understand their risk and tailor their strategy to meet regulatory obligations. They support AU10TIX’s Selfie-based Age Estimation service, which delivers the industry’s most precise and unbiased age assessment in just two seconds. In the US, federal legislation such as the Children’s Online Privacy Protection Act (COPPA) requires parental consent for users under 13, while the California Consumer Privacy Act mandates age verification for websites accessed by users under 16. Additionally, 19 U.S. states now enforce mandatory age checks for adult content and gambling platforms. Similar regulations are impacting social media and online services in the UK, EU and Australia.
Caesars Entertainment has launched its third fully in-house developed proprietary online casino title: Signature American Roulette. Now live in New Jersey, the game is available across Caesars Palace Online Casino, Caesars Sportsbook & Casino and Horseshoe Online Casino, bringing another standout addition to the Company’s Signature table game series. Developed by Empire Creative, Signature American Roulette reflects Caesars’ growing investment in building its own proprietary content, a cornerstone of its online casino strategy aimed at delivering a best-in-class player experience. Signature American Roulette follows the recent launches of fan-favourite Signature titles, Caesars Palace Signature Multihand Blackjack Surrender in May and Signature Blackjack Surrender in June, both also developed by Empire Creative.
Novig announced the successful close of an $18 million Series A funding round. The round was led by Forerunner, with participation from existing investors Y Combinator, NFX, Perceptive Ventures and Gaingels. Founded by Jacob Fortinsky and Kelechi Ukah, Novig is reimagining sports predictions as a transparent and fair marketplace. Unlike traditional sportsbooks, Novig allows users to trade directly with one another, rather than against the house, eliminating hidden fees, biased odds and the risk of being penalised for winning.
Partnerships
IGT announced that it has secured a multi-year sports betting technology and services agreement with Hipodromo de Agua Caliente SA de CV and Distribuidora Internacional de Equipos de Juego, S. De R.L. De C.V. that will significantly extend IGT PlaySports’ footprint to Mexico and Latin America via Corporación Caliente. Per the agreement, 42 Caliente sportsbooks in Mexico will leverage the IGT PlaySports platform and services from the Company’s Trading Advisory Services Team. Through a phased rollout, Caliente will also be able to provide select sportsbooks operators throughout Latin America access to IGT PlaySports’ technology, extending the technology’s reach to more than 100 additional venues across eight countries.
CT Interactive has announced a strategic partnership with Ondiss. Through this collaboration, CT Interactive’s top-performing titles are now integrated into the Ondiss platform, significantly expanding the company’s reach within the region’s regulated iGaming market. This integration adds value to the broad Argentine audience of Casino & Hotel Casino Magic S.A., which successfully uses the Ondiss platform. With CT Interactive’s certified and player-favourite content now available, operators on the platform are empowered to diversify their offerings and meet the increasing demand for engaging, high-quality games.
The post Gaming Americas Weekly Roundup – August 11-17 appeared first on European Gaming Industry News.
PAGCOR, the Philippine gaming regulator, has opposed a proposed ban on online gambling, despite mounting nationwide calls to criminalise it over soaring numbers of addiction, debt and mental health cases.
The online gambling sector in the Philippines has been growing exponentially, with gross revenues jumping from $140M in 2022 to $2.4B in 2024, according to Senate Committee on Games and Amusement data.
The committee held a hearing last week, highlighting the human cost of the industry, with its members demanding to outlaw it, saying the country was facing a full-blown public health and social crisis.
Sen. Erwin Tulfo, who led the hearing on online gambling, warned that “as long as online gambling exists, we are breeding the next generation of addicts, debtors, and broken families.”
He called for a ban and to “prosecute not only the operators, but also the enablers — in the government and in the private sector — who profit from this misery.”
PAGCOR, which is both an operator and regulator, said it “is not in favor of a total ban and instead advocates for stricter regulation.”
The regulator said that illegal operators are the real problem.
“Unfortunately, many of these unregulated online operators are based overseas who target Filipinos, most of whom do not realize that the sites they are playing on are not licensed by PAGCOR. This is where problems arise, especially regarding age restrictions.”
But a survey cited by senators indicates that age was not the main issue. It indicated that 66% of Filipinos aged 18 to 40, and 57% of those aged 41 to 55 were engaged in online gambling. Nearly a third bet multiple times a week, some wagering up to $53 per session.
Majority Leader Joel Villanueva warned online gambling is a “growing national crisis” in the Philippines.
“People are not just risking their hard-earned money. They are putting their futures, families, and lives on the line. The lure of instant wealth has already led many down a path of addiction, debt, and despair,” he said.
“Online gambling is not just a matter of financial loss. It is strongly associated with serious mental and physical health issues, broken relationships, family conflict, increased cases of domestic violence and suicide, crime against persons and property, and ultimately, the erosion of opportunities and dignity in the lives of many Filipinos.”
The post PAGCOR Opposes Online Gambling Ban Amid Pressure to Criminalise the Industry appeared first on European Gaming Industry News.
The UNLV International Gaming Institute has launched a new AI Research Hub (AiR Hub) to tackle some of the most pressing challenges facing the gaming industry’s digital transformation.
Co-founder Kasra Ghaharian, the institute’s director of research, said the AiR Hub will address critical questions reshaping the sector: How is artificial intelligence transforming gaming operations? What governance frameworks should guide AI implementation in this traditionally regulated industry? Which emerging technologies must operators master to stay competitive? And how can the sector effectively integrate responsible AI practices with cutting-edge academic research?
“So all of these things that you might expect a research institution to do,” Ghaharian said, “we wanted to do specifically for this intersection of AI with gambling.”
While scattered research around AI in gaming has existed, Ghaharian said there hasn’t previously been a central hub for it. He and AiR Hub co-founder Simo Dragicevic, an International Gaming Institute (IGI) adjunct fellow, saw the opportunity to generate evidence, research and insight that could help the industry better understand and navigate AI technology.
“I think IGI has always had this place to be a thought leader in terms of knowledge, insights for the breadth of stakeholders across the gambling industry. And with the growth and expansion of this new technology, which is artificial intelligence, I think it’s important for us to continue that reputation,” Ghaharian said.
AI is and will continue to have a fundamental impact on all aspects of society, said Dragicevic, who is an industry veteran with experience in gaming software, regulation and AI.
As the gaming industry naturally focuses on product innovation and growth, it’s important someone is also looking at the potential safety aspects that may arise from AI — and AiR Hub is prepared to take on this critical role, Dragicevic said.
“Given the arguably controversial nature of the gambling industry and the gambling product, when it intersects with this technology — which, in and of itself, is controversial — I think that highlights the need for scrutiny; for some research to help guide the ship,” Ghaharian said.
The AiR Hub has received financial support from a variety of industry stakeholders, Ghaharian said. Founding industry members will also serve on an industry advisory panel to ensure that what the hub is doing is practical and relevant.
“It’s kind of that analogy of the ivory tower, right?” he said. “We don’t want to be just in a silo, not speaking to the industry, doing research that we think is relevant, that might not be applicable.”
There’s a reason the new entity is called a “hub” and not a “lab,” Dragicevic said, and that’s to emphasize its collaborative nature.
AiR Hub will build a framework and tools for regulators to help them ask the right questions before making any decisions on whether regulations need to adapt to change, he said, by inviting them to work with academics and partner universities in the early stages of projects.
It will also be important to engage the industry to ensure framework and tools are practical and factor in the complexities and nuances of the industry, Dragicevic said.
The post UNLV International Gaming Institute Launches New AI Research Hub appeared first on European Gaming Industry News.
-
Australia7 days agoVGCCC Imposes $80,000 Fine on Online Bookmaker QuestBet
-
illegal gambling7 days agoColjuegos Transfers More Than $127M to the Subsidized Health System in Colombia During H1 2025
-
Altenar7 days ago
Inspired Launches V-Play Football Brazil with EstrelaBet via the Altenar Sportsbook
-
Asia7 days ago
Faster Guest Entry at Korea’s INSPIRE Entertainment Resort’s Casino, Powered by Regula’s Technology
-
Arizona Department of Gaming7 days ago
Arizona Department of Gaming Launches First-Ever Statewide Campaign to Empower and Protect Consumers
-
gamanzaengage6 days ago
Gamanza Engage signs major regional agreement with Grupo Jer
-
Latest News5 days ago
Be Heard Above the Noise: Booming Games’ Dorota Gruszka on Standing Out in the Crowded Slot Studio Market
-
Latest News7 days ago
AI-powered iGaming customer service firm Tugi Tark signs strategic partnership agreement with WebPrefer
