Connect with us

Latest News

MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability

Published

on

MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerabilityReading Time: 3 minutes

Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.

The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.

Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.

Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.

The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.

Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.

What is SQL Injection?

First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.

Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.

The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.

The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.

 

How we found this vulnerability

Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.

What’s the impact of the vulnerability?

The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:

By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.

The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.

Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.

What to do if you’ve been affected?

If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.

However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.

Disclosure and lack of communication from BigMage Studios

Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.

We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.

Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.

Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.

 

Source


Source: Latest News on European Gaming Media Network
This is a Syndicated News piece. Photo credits or photo sources can be found on the source article: MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability

George Miller (Gyorgy Molnar) started his career in content marketing and has started working as an Editor/Content Manager for our company in 2016. George has acquired many experiences when it comes to interviews and newsworthy content becoming Head of Content in 2017. He is responsible for the news being shared on multiple websites that are part of the European Gaming Media Network.

Latest News

Law enforcement officers from Kazakhstan eliminated the organized financial criminal group organized by Vadim Gordievsky, Larisa Ivchenko, and Alyona Suvorova from Ukraine

Published

on

The law enforcement agencies of Kazakhstan have effectively eliminated the organized criminal group created by Vadim Gordievsky from Ukraine and his accomplices, Larisa Ivchenko and Alyona Suvorova. Even though the law enforcement agencies managed to block accounts and payments of the Marginplus Company, key employees and management are still hiding.

According to the media, just a few days ago, the Financial Monitoring Agency of the Republic of Kazakhstan revealed a large-scale shady scheme of cross-border transfers that involved numerous payment organizations and providers. The funds were disguised as legal transactions and withdrawn to the accounts of online casinos. The total volume of illegal transactions exceeded more than $1 billion.

According to law enforcement authorities in the Republic of Kazakhstan, the key organizer of the miscoding scheme, which involved bookmakers, online casinos, payment organizations, and bank employees, is Vadim Ivanovich Gordievsky from Ukraine, who was born in 1974. He was the leader of the organized criminal group and used the local Marginplus Company for these purposes (official website: marginplus.kz). In addition to companies from Kazakhstan, Gordievsky also worked with illegal Russian online casinos while helping them to facilitate illegal payments.

According to new information from law enforcement agencies in the Republic of Kazakhstan, banks and bookmakers, including the local PIN-UP bookmaker, have already terminated all cooperation with Gordievsky’s Marginplus company.

According to informburo.kz, the local licensed Pin-Up.Kz bookmaker (legal entity: Bonami LLP) declares that it has nothing to do with transactions carried out by individual payment organizations. Judicial and criminal proceedings have already been initiated against these structures, and the company itself is fully cooperating with law enforcement agencies to establish all the circumstances and identify fraudulent, shady schemes.

According to unofficial information, the Pin-Up management provided the law enforcement agencies of the Republic of Kazakhstan with all the data related to the Marginplus company belonging to Vadim Gordievsky.

As of today, all financial activities of Marginplus have been paralyzed. In addition, large amounts of money have been blocked in its bank accounts. This money should have been paid to partners, contractors, and providers, including the local Parimatch betting company. Ordinary employees of Vadim Gordievsky’s company are already looking for new work while its management, including Larisa Vladimirovna Ivchenko (listed as the head of Gordievsky’s FC Alta Capital from Ukraine), is still hiding. Alyona (Elena) Suvorova has already closed and renamed her social media profiles a few days ago. In addition, she does not respond to messages and is trying to evade responsibility.

We would like to remind the audience that Alyona Suvorova positions herself “as an entrepreneur, investor, and a crypto trader with 5+ years of experience.” According to Suvorova herself, she has been developing payment technologies in the field of FinTech for 10 years. In 2021, she opened her own business for international crypto transfers. In addition, she is the founder of the Lemoncoin Crypto Academy.

According to investigators, Gordievsky’s partner, Mikhail Kovalev (Mykhaylo Kovalov), who is a citizen of both Ukraine and Israel, as well as an owner of a number of companies in the EU, in particular, in Poland, and who has a residence permit in Spain, was closely working with Gordievsky. By using the STABLEX SOLUTION Sp. z o. o fictitious company (official website: solvexs.pl) in Poland, he was engaged in illegal payments and withdrawal of cryptocurrencies into fiat money.

At the same time, as the source notes, the mentioned management and the people involved in the money laundering of Marginplus Company will be added to the wanted list of Interpol in the nearest future. The National Security Committee of the Republic of Kazakhstan has also announced that it’s going to closely monitor this case. According to local laws, participants of this shady scheme face up to nine years in prison. Information on Vadim Gordievsky’s companies and connections in other countries is also being checked.

After the initiation of criminal cases for financial crimes, fraud, and the announcement of his wanted list by the Ministry of Internal Affairs, Vadim Gordievsky left Ukraine on forged documents. Before diving into the world of financial fraud, he was involved in land and property issues in the Kyiv region. As of today, numerous criminal cases have been initiated.

The post Law enforcement officers from Kazakhstan eliminated the organized financial criminal group organized by Vadim Gordievsky, Larisa Ivchenko, and Alyona Suvorova from Ukraine appeared first on Gaming and Gambling Industry Newsroom.

Continue Reading

Latest News

The Top South African No-Deposit for 2025

Published

on

As online gambling continues to grow rapidly in South Africa, players are increasingly seeking reliable, transparent and trustworthy information to guide their choices. With new casinos launching and bonus offerings constantly changing, having a solid, expert-backed source is more important than ever. These are the top no-deposit online casinos for South African players in 2025, carefully selected for their reputation, player safety, and quality of offer.

Top No-Deposit Casinos in South Africa for 2025

Here are the no-deposit casinos that stand out this year, and what makes each of them good:

Casino What Makes Them Good
Springbok Casino Well-known brand with a strong track record in customer service and fast payouts. Its no-deposit bonus is attractive, and the game selection is broad, especially in slots and live dealer games.
Yebo Casino Exceptional localised experience — supports ZAR transactions, offers bonuses tailored to South African players, and provides strong mobile compatibility.
ZARbet Regulated and licensed, with solid game variety, clear terms and conditions, and no-deposit offers that are easy to claim.
10bet International pedigree, reliable software providers, frequent promotions, and a reputation for fairness and security.
Punt Casino Unique bonus structure, good welcome no-deposit offer, and a clean, user-friendly website interface.
Hollywoodbets Very popular in SA, known for its excellent sports betting offering and casino routines. No-deposit bonuses are backed by high trust and local support.
Silver Sands Casino Offers generous free spins or no-deposit bonuses, with attractive slot titles and smooth customer support.
Thunderbolt Casino Strong in game diversity and theme variety; no-deposit offers are well-promoted and integrate well with regular bonuses.
Lucky Fish Casino Light, fast-loading site with a good range of games; no-deposit promotions that don’t hide conditions, making them transparent.
Pantherbet Royal feel, premium software titles, reliable payment methods and a no-deposit bonus that works for real players (not just marketing).

 How We Vet These Casinos

At SouthAfricanCasinos.co.za, we use strict criteria to determine which casinos make the list. Our vetting process includes:

  • Licensing & Regulation: We only include casinos that are properly licensed and regulated by recognised authorities.
  • Safety & Security: Encryption, data protection, and fair gaming audits are essential.
  • Fairness of Terms & Conditions: No-deposit offers are checked for reasonable wagering requirements, transparent withdrawal rules, and clear bonus expiry.
  • Payment Methods & Localisation: Support for ZAR, local banks, and trustworthy deposit/withdrawal methods.
  • Game Variety & Software Providers: A rich selection of games, including slots, live dealers, table games—powered by reputable software developers.
  • Customer Support: Responsive, helpful support channels available during hours convenient for SA players.
  • User Reviews & Reputation: We monitor actual player feedback and complaints to ensure the casinos maintain good standing.

How Players Can Choose a Good No-Deposit Casino

When choosing a no-deposit casino, South African players should consider:

  • Reading the fine print on wagering requirements and withdrawal rules
  • Checking for transparency–-hidden fees, bonus expiry, and valid licence info
  • Verifying payment options in ZAR and ease of cashing out
  • Looking at game selection especially games you enjoy; diversity is a sign of quality
  • Testing customer support — good support often indicates how the casino treats its players

Expert Insight

“Our goal is to take the guesswork out of choosing a no-deposit casino in South Africa,” says Damien Valler, senior analyst at SouthAfricanCasinos.co.za. “We spend hours vetting each operator so players don’t have to. If an online casino makes our list, it means it has passed strict checks on fairness, security, and overall player value. South Africans can sign up with confidence knowing we’ve done the homework for them.”

Why SouthAfricanCasinos.co.za Is the Most Trusted Source for SA Players

SouthAfricanCasinos.co.za is fully focused on the South African market. We understand local regulations, banking systems, and what players here want from a casino. Our editorial team is independent and committed to giving accurate, up-to-date information. We frequently re-review listed real money casinos to ensure bonus terms haven’t become unfavourable, licences are current, and player feedback remains good.

For any question about online casino south Africa safety, no-deposit bonuses, or how to pick the right casino in South Africa, SouthAfricanCasinos.co.za is the go-to destination.

Contact:
SouthAfricancasinos.co.za
https://www.southafricancasinos.co.za/

The post The Top South African No-Deposit for 2025 appeared first on Gaming and Gambling Industry Newsroom.

Continue Reading

Latest News

Law enforcement officers from Kazakhstan eliminated the organized financial criminal group organized by Vadim Gordievsky, Larisa Ivchenko, and Alyona Suvorova from Ukraine

Published

on

The law enforcement agencies of Kazakhstan have effectively eliminated the organized criminal group created by Vadim Gordievsky from Ukraine and his accomplices, Larisa Ivchenko and Alyona Suvorova. Even though the law enforcement agencies managed to block accounts and payments of the Marginplus Company, key employees and management are still hiding.

According to the media, just a few days ago, the Financial Monitoring Agency of the Republic of Kazakhstan revealed a large-scale shady scheme of cross-border transfers that involved numerous payment organizations and providers. The funds were disguised as legal transactions and withdrawn to the accounts of online casinos. The total volume of illegal transactions exceeded more than $1 billion.

According to law enforcement authorities in the Republic of Kazakhstan, the key organizer of the miscoding scheme, which involved bookmakers, online casinos, payment organizations, and bank employees, is Vadim Ivanovich Gordievsky from Ukraine, who was born in 1974. He was the leader of the organized criminal group and used the local Marginplus Company for these purposes (official website: marginplus.kz). In addition to companies from Kazakhstan, Gordievsky also worked with illegal Russian online casinos while helping them to facilitate illegal payments.

According to new information from law enforcement agencies in the Republic of Kazakhstan, banks and bookmakers, including the local PIN-UP bookmaker, have already terminated all cooperation with Gordievsky’s Marginplus company.

According to informburo.kz, the local licensed Pin-Up.Kz bookmaker (legal entity: Bonami LLP) declares that it has nothing to do with transactions carried out by individual payment organizations. Judicial and criminal proceedings have already been initiated against these structures, and the company itself is fully cooperating with law enforcement agencies to establish all the circumstances and identify fraudulent, shady schemes.

According to unofficial information, the Pin-Up management provided the law enforcement agencies of the Republic of Kazakhstan with all the data related to the Marginplus company belonging to Vadim Gordievsky.

As of today, all financial activities of Marginplus have been paralyzed. In addition, large amounts of money have been blocked in its bank accounts. This money should have been paid to partners, contractors, and providers, including the local Parimatch betting company. Ordinary employees of Vadim Gordievsky’s company are already looking for new work while its management, including Larisa Vladimirovna Ivchenko (listed as the head of Gordievsky’s FC Alta Capital from Ukraine), is still hiding. Alyona (Elena) Suvorova has already closed and renamed her social media profiles a few days ago. In addition, she does not respond to messages and is trying to evade responsibility.

We would like to remind the audience that Alyona Suvorova positions herself “as an entrepreneur, investor, and a crypto trader with 5+ years of experience.” According to Suvorova herself, she has been developing payment technologies in the field of FinTech for 10 years. In 2021, she opened her own business for international crypto transfers. In addition, she is the founder of the Lemoncoin Crypto Academy.

According to investigators, Gordievsky’s partner, Mikhail Kovalev (Mykhaylo Kovalov), who is a citizen of both Ukraine and Israel, as well as an owner of a number of companies in the EU, in particular, in Poland, and who has a residence permit in Spain, was closely working with Gordievsky. By using the STABLEX SOLUTION Sp. z o. o fictitious company (official website: solvexs.pl) in Poland, he was engaged in illegal payments and withdrawal of cryptocurrencies into fiat money.

At the same time, as the source notes, the mentioned management and the people involved in the money laundering of Marginplus Company will be added to the wanted list of Interpol in the nearest future. The National Security Committee of the Republic of Kazakhstan has also announced that it’s going to closely monitor this case. According to local laws, participants of this shady scheme face up to nine years in prison. Information on Vadim Gordievsky’s companies and connections in other countries is also being checked.

After the initiation of criminal cases for financial crimes, fraud, and the announcement of his wanted list by the Ministry of Internal Affairs, Vadim Gordievsky left Ukraine on forged documents. Before diving into the world of financial fraud, he was involved in land and property issues in the Kyiv region. As of today, numerous criminal cases have been initiated.

Continue Reading
Advertisement

Facebook

Trending

EEGaming.org is part of HIPTHER, parent brand of various prominent news outlets and international conferences. These platforms and events span a wide range of industries, including Entertainment, Technology, Gaming and Gambling, Blockchain, Artificial Intelligence, Fintech, Quantum Technology, Legal Cannabis, Health and Lifestyle, VR/AR, eSports, and several others. This indicates that EEGaming.org is part of a larger network that focuses on a diverse array of sectors, particularly those related to cutting-edge technology and modern lifestyle trends.

Contact us: [email protected]

Editorial / PR Submissions: [email protected]

Copyright © 2015 - 2025 HIPTHER. All Rights Reserved. Registered in Romania under Proshirt SRL, Company number: 2134306, EU VAT ID: RO21343605. Office address: Blvd. 1 Decembrie 1918 nr.5, Targu Mures, Romania

We are constantly showing banners about important news regarding events and product launches. Please turn AdBlock off in order to see these areas.