Critical Authentication Flaw Found in Fortnite’s Login System Leaking Private Data

  • Security research company found a major bug in Fortnite’s authentication system that could put all users’ private data at risk.
  • The bug essentially allows attackers to steal login tokens by tricking users into clicking a link.
  • The security issue has already been fixed by Epic Games, which means that no user action is needed.

Fortnite has become a major target for cybercriminals thanks to the massive player base that the popular battle royale game commands. With over 78.3 million monthly players playing the game, there is a lot of private user information at stake and Check Point Research identified a critical exploit recently that has already been patched out.

Check Point revealed that the bug takes advantage of cross-site scripting (XSS) to trick Fortnite players into clicking on malicious links during the authentication process, which allows the attacker to steal login tokens. This is quite different from how attackers stole Facebook’s login tokens last year as Epic Games account holders need to manually enter their login credentials for cybercriminals to be successful.

According to Check Point: "With the access token now in the hands of the attacker, he can now log-in to the user’s Fortnite account and view any data stored there, including the ability to buy more in-game currency at the user’s expense. He would also have access to all the user’s in-game contacts as well as listen in on conversations taking place during gameplay.

Even though the attack is not particularly complicated, people using the exploit need to have the technical know-how and also knowledge about old domains that Epic Games once owned. The Fortnite developers have a number of old sub-domains that attackers used to search for valuable data.

The interest of attackers lies primarily in Fortnite’s virtual currency also known as V-Bucks. 1000 V-Bucks is worth $10, but once attackers get access to financial information of their victims, they purchase the digital currency and sell them to other players at a discount. This results in cybercriminals profiting from the transactions while the victims’ accounts get banned.

What do you think about cybercriminals targeting Fortnite players? Let us know in the comments below. Also, don’t forget to follow us on Facebook and Twitter. Thanks!

REVIEW OVERVIEW

Latest

How to Watch Moon Knight on Disney Plus: Release Date, Cast, Trailer, Plot

Marvel Studios' Moon Knight series launch date and trailer were announced recently, and everyone is super excited to see it. This is...

My Hero Academia Battle Royale Coming Soon – Check Out The Gameplay

Good news for anime and gaming fans across the world: My Hero Academia is about to get its own Battle Royale game!...

One Punch Man Chapter 157 Release Date, Time and Where to Read Online

One Punch Man Chapter 157 is about to release soon, and we've got all the information you need to catch up! One...
For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: Chrome, Edge, Firefox, Safari