Latest News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Reading Time: 3 minutes
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Source: Latest News on European Gaming Media Network
This is a Syndicated News piece. Photo credits or photo sources can be found on the source article: MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Reading Time: < 1 minute
- bet-at-home integrates ZEAL Instant Games titles into its German website
- First selection of ZEAL slots now available
- Partnership boosts reach, portfolio strength, and growth for both companies
ZEAL Instant Games, a brand of the ZEAL Group and a provider of online games, announces a new strategic partnership with online gaming operator bet-at-home. As part of the collaboration, bet-at-home seamlessly integrates the growing portfolio of ZEAL slots into its website. The first titles are already available to customers on bet-at-home.de.
Stronger together: Premium content meets established brand presence
Both partners stand to benefit from the collaboration: While bet-at-home expands its portfolio offering with ZEAL titles – enhancing its appeal and reach within the online games segment – ZEAL Instant Games gains another prominent partner whose market presence accelerates the brand’s dynamic growth and enables access to a broader user base.
In addition to best-selling ZEAL titles such as “The Bookmaker”, “Crime Scene”, “Vegas Blaze“, and other premium slots, the portfolio will continue to grow steadily in the coming months.
Shared perspectives
“Our mission is to make innovative, high-quality games accessible to the widest possible audience,” says Alex Green, Vice President Games at ZEAL. “With bet-at-home, we are gaining a partner that has held a strong position in the market for many years. This collaboration opens up new opportunities for expanding our reach and underscores the enormous potential of our growing games portfolio.”
From bet-at-home’s side: “We are delighted to have ZEAL Instant Games as a partner known for quality, creativity, and reliable performance,” says Claus Retschitzegger, CEO, bet-at-home. “The new ZEAL titles are a great addition to our offering and provide our customers with exciting and varied gaming experiences. This partnership is an important element of our growth strategy.”
The post ZEAL and bet-at-home launch joint gaming initiative appeared first on European Gaming Industry News.
Reading Time: 2 minutes
All reels lead to Rome in ELA Games’ newest atmospheric and bold slot.
ELA Games creates an immersive adventure in its latest title, Roman Fortune. Players battle for glory and honour in the heart of ancient Rome, where every spin carries the might of an empire.
Roman Fortune takes place in a roaring Colosseum under Caesar’s watchful eye, where fortunes wait for the victors. Designed with ELA Games’ signature visual richness and refined gameplay, this new title balances entertaining gaming experiences with operator-focused value, building on previous successes, such as Piñatas Festival.
Caesar’s Riches: Features that Favour the Brave
Roman Fortune offers several features that build excitement and depth for the player, ensuring action on every spin.
- Scatter Symbols: Collect Scatters to earn Free Spins — the more you collect, the greater the prize.
- Caesar Wilds: At any moment, a Caesar Wild may appear to spread wealth across the reels or even trigger the Hold & Win Bonus.
- Hold & Win Bonus: In this feature, players encounter Red, Blue, and Green Coins, each with their own imperial strengths. Red Coins multiply prizes, Blue Coins unlock Jackpots, and Green Coins collect all visible values for greater wins.
Gladiators can activate all of these features at once, where glory and honour will rain down on the victor.
An Experience Built for Impact
Just like the actual intense clashes that occurred in the Colosseum in ancient Rome, Roman Fortune is crafted for players who enjoy an atmospheric experience with excitement, tension, and memorable moments.
The game’s 95.99% RTP and high volatility ensure that even the base game has plenty of action. Roman Fortune embodies ELA Games’ game creation philosophy, where creativity and strategic development work together to deliver a product that delivers sustained engagement and strong performance for its partners
Marharyta Yerina, Managing Director of ELA Games, commented on the release, “Roman Fortune is a visually forward title that captivates players’ imaginations with thrilling battles in an ancient arena. Every detail exists to create a world players can step into and instantly feel connected to. The game’s bold theme, supported by strategic mechanics and layers of atmosphere, shows what our team does best: creating experiences players enjoy while providing value for our partners.”
Enter the Arena For Eternal Glory
Step into the Colosseum and fight for your place in history.
The post Glory & Honour Await the Strongest Gladiators in ELA Games’ Newest Game, Roman Fortune appeared first on European Gaming Industry News.
Latest News
GR8 Tech Expands Virtual Sports Portfolio with New Basketball Offering, Deepens Localization Strategy
Reading Time: 2 minutes
GR8 Tech has expanded the virtual sports lineup within its ULTIM8 Sportsbook with a new range of virtual basketball, continuing a year of investment in the category that has already seen the addition of virtual horse racing and virtual cricket roulette—a unique format blending casino mechanics with the sport of cricket.
The expansion builds on GR8 Tech’s established strength in cricket, where the company developed one of the industry’s most comprehensive betting lines. Virtual cricket was designed to fill gaps between real-world tournaments, giving operators a way to maintain player engagement year-round—a model now being applied to basketball for markets where the sport dominates.
This content independence stems directly from GR8 Tech’s in-house trading capabilities.
“One of the things that GR8 Tech stands out for is the quality of the trading and the fact that we perform extremely well in very difficult environments, like Asia,” said Dinos Doxiadis, Head of Sportsbook Business at GR8 Tech. “Even our clients’ players in these challenging markets don’t behave like typical players in ‘easier’ regions such as Latin America, we still manage to achieve some of the highest margins there.”
That trading foundation enables GR8 Tech to build and localize content for specific markets rather than relying solely on third-party providers.
“We already have a very strong sportsbook, and now we’re scaling our processes and output capabilities to take it even further,” Doxiadis explains. “We’re improving the product and creating the conditions to localize very quickly and offer a truly localized experience across the world.”
GR8 Tech is also investing in infrastructure to give operators greater control over how they deploy this content.
“The goal is to put even more power into the hands of our operators so they can tailor the product exactly as they want. As we move forward with new data and content agreements, they’ll gain an even greater ability to adapt the sportsbook to their specific needs—on top of what they can already do today.”
Personalization is central to that roadmap. “We have delivered quite a few recommendation models, and right now we can serve custom content on a user level, and we will continue working in this direction,” said Doxiadis. “We have a very good infrastructure and baseline to invest in.”
The post GR8 Tech Expands Virtual Sports Portfolio with New Basketball Offering, Deepens Localization Strategy appeared first on European Gaming Industry News.
-
Latest News3 months ago
Duels for Friends in Trophy Hunter. Invite your friends and create a shared space for fun and competition.
-
Latest News2 months ago
Announcement: 25th September 2025
-
Latest News3 months ago
Flamez – A Fiery New Online Casino Contender from Ganadu
-
Latest News3 months ago
GR8 Tech’s Bet It Drives Wraps Season 1 with Stephen Crystal—From Las Vegas Legends to Global Gaming Leadership
-
Latest News2 months ago
AI-Powered Gamification Arrives on Vegangster Platform via Smartico
-
Latest News2 months ago
The Countdown is On: Less Than 3 Months to Go Until The Games of The Future 2025 Kicks Off in Abu Dhabi
-
Latest News3 weeks ago
JioBLAST Launches All Stars vs India powered by Campa Energy: A New Era of Creator-Driven Esports Entertainment
-
Latest News2 months ago
Adidas Arena Set to Welcome the 2026 Six Invitational
You must be logged in to post a comment Login