Latest News

Popular Gambling App Exposed Millions of Users in Massive Data Leak

Published

4 years ago

July 8, 2020

Reading Time: 5 minutes

Led by Noam Rotem and Ran Locar, vpnMentor’s research team discovered a data breach on casino gambling app Clubillion.

The breach originated in a technical database built on an Elasticsearch engine and was recording the daily activities of millions of Clubillion players around the world.

Aside from leaking activity on the app, the breached database also exposed private user information.

With this information publicly available, Clubillion’s users were vulnerable to fraud and various online attacks with potentially devastating results.

Company Profile

Clubillion is a free online casino game available for iOS and Android, offering players 30+ free slot games. While each app is listed under a different developer – Ouroboros on iOS and T7 Games on Android – these are most likely owned by the same company.

Both versions of Clubillion were released in 2019 and became instant hits. Each is now ranked the #1 ‘social slots’ casino app on Google Play and the App Store, with a 4.8 star on both.

Timeline of Discovery and Owner Reaction

Sometimes, the extent of a data breach and the owner of the database are obvious, and the issue quickly resolved. But rare are these times. Most often, we need days of investigation before we understand what’s at stake or who’s leaking the data.

Understanding a breach and its potential impact takes careful attention and time. We work hard to publish accurate and trustworthy reports, ensuring everybody who reads them understands their seriousness.

Some affected parties deny the facts, disregarding our research, or playing down its impact. So, we need to be thorough and make sure everything we find is correct and accurate.

In this case, the database was built on Elasticsearch and hosted on Amazon Web Services (AWS), with Clubillion’s name on its apps, and links to assets owned by the company.

Once Clubillion was confirmed as the owner of the database, we reached out to the developers. While awaiting a reply, we also contacted AWS with details of the leak. It was closed a few days later.

Date discovered: 19th March 2020

Date vendors contacted: 23rd March 2020

Date of contact with AWS: 31st March 2020

Date of Action: Approx. 5th April 2020

Example of Entries in the Database

Clubillion’s exposed database contained technical logs for millions of Clubillion users around the world, on both iOS and Android devices. Every time an individual player took any action on the app, a record was logged. Examples of records include:

“enter game”
“win”
“lose”
“update account”
“create account”

During our investigation of the database, new entries continued to appear continuously. We estimated an average of approximately 200 million records per day – and sometimes, considerably more.

In total, this amounted to over 50GB of exposed records in the database every single day.

Within many of these records, were various forms of user Personally Identifiable Information (PII) data, including:

IP addresses
Email addresses
Winnings
Private messages

This data breach was truly global, with millions of records originating from Clubillion’s daily users all over the world. The following list is just a sample of countries affected, along with the average number of daily users from each country:

USA – 10,000+
UK – 2,475+
France – 1,650+
Israel – 408+
Germany – 1,582+
Spain – 1,026+
Italy – 2,407+
Netherlands – 622+
Australia – 6,251+
Canada – 7,792+
Brazil – 3,859+
Sweden – 191+
Russia – 547+

Other countries affected included Uzbekistan, India, Poland, Romania, Vietnam, Lebanon, Indonesia, Philippines, Pakistan, Thailand, Austria, Hungry, and Latvia.

As you can see, on a single day, 10,000s of individual Clubillion players were exposed. Each one of these players could be targeted by malicious hackers for fraud and cyberattacks – along with millions more whose records were also contained in the database.

Data Breach Impact

Studies have shown that free gambling and gaming apps are especially prone to attacks and hacking from cybercriminals. They are routinely targeted for theft of private data and embedding malicious software on users’ devices.

Despite their popularity, gambling and casino apps often lack transparency, and it can be impossible to know what steps they’re taking to prevent cybercriminals successfully targeting their users.

One study of 23,000 free gambling apps found that: 3,200 posed a ‘moderate risk’ to users; 379 had known security vulnerabilities; 52 contained malicious software.

Any of these issues could be exploited to target app users in a wide range of frauds and cyberattacks, and Clubillion is no different.

With the exposed user PII and knowledge of their activity on the app, hackers could create elaborate schemes to defraud users. For example, some entries also included transaction errors for attempted card payments on Clubillion.

With the information in these transaction errors, hackers could target users with phishing campaigns, with the following aims:

Trick them into providing their credit card details
Trick them into providing additional PII to be used against them in further fraud
Clicking a link that embeds malware, spyware, or ransomware onto their device.

If cybercriminals used Clubillion to embed malware or similar onto a user’s phone, they could potentially hack other apps, access files stored on the device, make calls, and send texts from the hacked device. They could even access a user’s phone contacts and steal the PII data of their friends and family.

Worse still, as people across the globe now find themselves under quarantine or self-isolation, as a result of the Coronavirus pandemic, the impact of a leak like this is potentially even more significant.

Clubillion stands to gain many new users, along with regular users playing more frequently. Hackers will be aware of this and looking for opportunities to exploit any vulnerabilities in the data security of such a massively popular app.

Had criminal hackers discovered Clubillion’s database, they could have targeted millions of people around the world, with devastating results.

Impact on Clubillion and it’s Developers

The most immediate risk for Clubillion is the loss of players. Data security is a growing concern for everyone these days, and this leak could turn many players off the app. Clubillion is not unique, and players have plenty of other choices for free gambling apps.

With fewer players, Clubillion will lose advertising revenue and reduced profits.

As many of Clubillion’s players reside within the EU, the app is under the jurisdiction of GDPR. The rules of GDPR also apply to apps, and Clubillion will need to take specific actions to ensure the regulatory body in charge doesn’t reprimand it.

Finally, Clubillion could also potentially be removed from Google Play and the App Store. Both Apple and Google are clamping down on apps that pose a risk to their users, removing apps embedded with malware, and taking data leaks much more seriously.

Each of these outcomes has a different likelihood of happening, but they would all negatively impact Clubillion’s revenue and business.

Advice from the Experts

Clubillion’s developers could have easily avoided this leak if they had taken some basic security measures to protect the database. These include, but are not limited to:

Securing their servers.
Implementing proper access rules.
Never leaving a system that doesn’t require authentication open to the internet.

Any company can replicate the same steps, no matter its size.

For a more in-depth guide on how to protect your business, check out our guide to securing your website and online database from hackers.

For Clubillion Users

If you play on Clubillion and are concerned about how this breach might impact you, contact the app’s developers directly to find out what steps it’s taking to protect your data.

To learn about data vulnerabilities in general, read our complete guide to online privacy.

It shows you the many ways cybercriminals target internet users, and the steps you can take to stay safe.

How and Why We Discovered the Breach

The vpnMentor research team discovered the breach in Clubillion’s database as part of a huge web mapping project. Our researchers use port scanning to examine particular IP blocks and test different systems for weaknesses or vulnerabilities. They examine each weakness for any data being leaked.

Our team was able to access this database because it was completely unsecured and unencrypted.

Whenever we find a data breach, we use expert techniques to verify the owner of the database, usually a commercial company.

As ethical hackers, we’re obliged to inform a company when we discover flaws in their online security. We reached out to Clubillion’s developers, not only to let them know about the vulnerability but also to suggest ways in which they could make their system secure.

These ethics also mean we carry a responsibility to the public. Clubillion users must be aware of a data breach that exposes so much of their sensitive data.

The purpose of this web mapping project is to help make the internet safer for all users.

Source

Gambling in the USA

Kambi Group plc extends Mohegan partnership with on-property sports betting agreement in Pennsylvania

Published

19 hours ago

May 2, 2024

GamingAmericas.com

kambi-group-plc-extends-mohegan-partnership-with-on-property-sports-betting-agreement-in-pennsylvania

Kambi Group plc (“Kambi”), the world’s trusted sports betting partner, has agreed a long-term on-property sportsbook partnership with Mohegan to provide its award-winning sportsbook at two retail locations in the state of Pennsylvania.

The partnership will see Mohegan utilise Kambi’s cutting-edge retail sportsbook offering across more than 20 kiosks in sportsbook locations at Mohegan Pennsylvania and Mohegan Pennsylvania at Lehigh Valley Race and Sportsbook.

The deal further strengthens Kambi’s relationship with Mohegan, which already utilises Kambi’s suite of sports betting products at ilani in Washington, as well as online and on-property in the Canadian province of Ontario at Fallsview Casino Resort and Casino Niagara.

Kristian Nylén, Kambi CEO and Co-founder, said: “With several successful partnerships with Mohegan already in place, we are pleased to agree this new partnership as we continue to build on our strong relationship.

“This latest deal further reinforces Kambi’s position as the sportsbook provider of choice for tribes across North America, and we look forward to our ongoing collaboration with Mohegan.”

Tony Carlucci, President & GM of Mohegan Pennsylvania, said: “Mohegan Pennsylvania is excited to continue utilising the same Kambi technology platform that existed under our Kindred partnership, which will help to create a seamless process as the Sportsbook at Mohegan Pennsylvania fully rebrands later this Spring.”

Blockchain

JuicyBet Launches Its Innovative GambleFi Platform

Published

19 hours ago

May 2, 2024

GamingAmericas.com

juicybet-launches-its-innovative-gamblefi-platform

JuicyBet, a Web3 startup, announced the launch of its GambleFi platform. This platform combines finance technology and gambling via blockchain to create unique opportunities and experiences for users. The company strives to revolutionize the principles of the online betting industry and the interaction between platforms and users in this market.

What is GambleFi?

GambleFi uses blockchain technology to ensure the fairness and transparency of games and betting outcomes and for players to get their share of the platform’s earnings and participate in its governance and day-to-day by holding its tokens.

How JuicyBet works

JuicyBet fully utilizes blockchain technology to establish a new ecosystem that has never been seen in the gambling industry. It is centered around user participation and transparency while providing gambling thrills and quality entertainment.

All game records on the platform are kept in a public blockchain, while a set of smart contracts automates gaming outcomes and payouts and provides for the platform governance via the DAO model. This reduces fraud risks and operational costs, making JuicyBet a more efficient platform.

However, the platform’s main feature is the unprecedented level of user engagement via the platform’s native tokens.

First, the tokens provide access to betting.
Second, token holders get their share of the platform’s profit.
Third, token holders can vote on key decisions on the platform’s development in JuicyBet DAO.
And finally, DAO participants can also perform the role of oracles for bets and earn rewards.

In other words, JuicyBet doesn’t try to be just another gambling platform. It establishes a new ecosystem where users are in control of the platform and bets and are the beneficiaries of the platform.

In addition, JuicyBet offers additional earning opportunities, such as Double Farming and staking for token holders.

JuicyBet has already been noticed by users and investors – the platform’s 3-month turnover has exceeded $1,5 million, according to on-chain data available via Dune, and multiple centralized exchanges and launchpads have listed it.

Latest News

Rivalry Announces 2023 Annual Letter to Shareholders and Filing of 2023 Annual Financial Statements

Published

19 hours ago

May 2, 2024

GamingAmericas.com

Rivalry Corp. (the “Company” or “Rivalry”) (TSXV: RVLY) (OTCQX: RVLCF) (FSE: 9VK), the leading sportsbook and iGaming operator for Gen Z, is pleased to announce its 2023 annual letter to shareholders and the filing of its financial results for the three (3) and 12-month period ended December 31, 2023. All dollar figures are quoted in Canadian dollars.

2023 Annual Letter to Shareholders

To our Shareholders,

This time last year I spoke about Rivalry’s evolution from a market leader in esports to a diversified Company setting the standard for Gen Z betting entertainment broadly.

Today, we have a business with revenue distribution across casino, sports, and esports betting, growing market share in new geographies, with increased velocity in core regions, and the strongest customer KPIs in Rivalry’s history.

In 2023, Rivalry recorded $423.2 million in betting handle¹, up 82% from the previous year. Similarly, gross gaming revenue² and net revenue both saw 34% and 66% respective increases, while the introduction of higher margin products released in H2 such as Same Game Combos and Quick Combos are continuing to improve overall sportsbook hold and guide Rivalry closer to profitability.

Our deepened product suite now includes fantasy, additional sports coverage, and new proprietary casino games. All of which are uniquely driving growth among a targeted customer segment and widening our opportunity set in 2024 and beyond – from a 60% increase in traditional sports betting to a burgeoning B2B game vertical. The potential for how far our brand can go is just beginning to unfold.

The year ahead is rife with new, innovative product releases arriving in Q2 and continuing throughout 2024. We are doubling down on core growth opportunities in sports that resonate with our audience, such as basketball and soccer. Further, we are building on a successful casino segment which already represents 50% of our business, enhancing variety, depth, and accessibility, as well as developing new original games which blur the lines between betting and entertainment. We are in the process of additional geographic expansion, and pursuing new licenses to broaden our total addressable market, positioning Rivalry to own the Gen Z gambling opportunity globally.

While Rivalry’s operations have expanded into new high-growth verticals, our north star has remained the same: to define the future of online gambling for a generation born on the internet.

Online gambling in 2024 is radically different than it was just six years ago when Rivalry launched. In that time we’ve seen gaming and internet culture reshape how consumers engage with technology. That shift is broadening the definition of gambling, where product design is influenced by video games, or it exists fully embedded within social apps like Telegram, where content creators are the new affiliates, and much more.

Over the same period, the rise of cryptocurrency and blockchain technology has introduced a new level of speed, access, and security to web-based consumer experiences. Industry estimates now put crypto wagers at up to one quarter of global betting handle³, with 30% year-over-year growth in 2024⁴, and showing no signs of slowing down.

The development of this ecosystem has commercially unlocked online gambling unlike anything since its first transition from land to online many years ago. It has brought in a new global audience, and enriched the customer experience from end-to-end.

Alongside the growth of this technology has emerged new methods of gambling, taking wallet share from more traditional forms at an accelerated rate. The shift in consumer behavior and the signal from our users is clear – interactive, volatile, and crypto-infused product experiences will set the precedent for how the next generation gambles online.

Rivalry, with a brand steeped in internet culture and living at the intersection of this digital economic renaissance, is well-positioned to access this growth opportunity. There is high overlap between Gen Z, gamers, gamblers, and a fast-growing audience of over 420 million crypto users worldwide⁵ organically aligned with our audience and brand. And we believe that more than half of this audience globally is already wagering with crypto.

It will be Rivalry’s ability to understand, implement, and adapt to this shift more rapidly than our peers that we expect to create first-mover advantages for us. It is for that reason that our vision is now bolder than ever for what’s possible in the online gambling category.

Soon, we will reveal plans for a crypto-enabled product set to enhance alignment between Rivalry and its users, increase network effects, and generally deliver a consumer experience that lives on the internet of 2024.

To that effect, the success of our first-party games and their ability to acquire and engage a captive audience of Gen Z bettors online has validated our original game development strategy amongst industry peers. This has unlocked a new commercial opportunity for Rivalry to license its IP, opening up another line of revenue for the business that has great potential for global scale.

The year ahead is poised to be one of our most ground-breaking, with a myriad of innovative product releases across all of Rivalry’s verticals, adding more dimension to our business, operations, and addressable audience, and building on our competitive moat as the market leader in Gen Z betting entertainment.

We look forward to sharing more details about these upcoming initiatives, the opportunities they will unlock for our Company, and delivering on our promise to create long-term shareholder value and reach profitability. Thank you all for your continued support.