Fortnite Users are Vulnerable to Hacking, Says Research

The vulnerability can also allowed for a massive invasion of privacy as an attacker could listen to in-game chatter.

The beta version will roll out for Android devices this week itself. For now, its just for Samsung users.

(Photo Courtesy: Epic Games)

A cyber security solutions provider has found out a vulnerability in Epic Games' Fortnite: Battle Royale game that could have affected any player of the online battle game, with nearly 80 million active users and 200 million registered users.

The game is popular across platforms – smartphones, PlayStation, Xbox and PCs. Apart from those who play the game for leisure, Fortnite is also played by professional gamers.

The research conducted by Check Point Software Technologies reveals that the vulnerability would have given the attacker full access to a user’s account and their personal information as well as enabling them to purchase virtual in-game currency using the victim’s payment card details.

The vulnerability would have also allowed for a massive invasion of privacy as an attacker could listen to in-game chatter as well as surrounding sounds and conversations within the victim’s home or the location of play.

While Fortnite players had previously been targeted by scams that deceived them into logging into fake websites that promised to generate Fortnite’s ‘V-Buck’ in-game currency, these new vulnerabilities could have been exploited without the player handing over any login details.

Researchers outlined the process in which an attacker could have potentially gained access to a user’s account through vulnerabilities discovered in Fortnite’s user login process.

Due to three vulnerability flaws found in Epic Games’ web infrastructure, researchers were able to demonstrate the token-based authentication process used in conjunction with Single Sign-On (SSO) systems such as Facebook, Google and Xbox to steal the user’s access credentials and take over their account.

Users fell victim to this attack by simply clicking a phishing link that appeared to be coming from an Epic Games domain, to make everything seem transparent, though sent by the attacker. Once clicked, the user’s Fortnite authentication token could be captured by the attacker without the user entering any login credentials. According to Check Point’s researchers, the potential vulnerability originated from flaws found in two of Epic Games’ sub-domains that were susceptible to a malicious redirect, allowing users’ legitimate authentication tokens to be intercepted by a hacker from the compromised sub-domain.

“Fortnite is one of the most popular games played mainly by kids. These flaws provided the ability for a massive invasion of privacy,” said Oded Vanunu, head of products vulnerability research for Check Point.

“Together with the vulnerabilities we recently found in the platforms used by drone manufacturer DJI, show how susceptible cloud applications are to attacks and breaches. These platforms are being increasingly targeted by hackers because of the huge amounts of sensitive customer data they hold. Enforcing two-factor authentication could mitigate this account takeover vulnerability.”

Oded Vanunu, head of product vulnerability research, Check Point

The release says that the researchers notified Epic Games of the vulnerability which has now been fixed. However, it is not clear if the fix was AFTER Check Point researchers notified the company of the vulnerability.

The Quint also reached out to Epic Games for a response. This article will be updated if and when we receive a response.