Connect with us

Latest News

MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability

Published

on

MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerabilityReading Time: 3 minutes

Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.

The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.

Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.

Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.

The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.

Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.

What is SQL Injection?

First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.

Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.

The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.

The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.

 

How we found this vulnerability

Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.

What’s the impact of the vulnerability?

The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:

By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.

The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.

Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.

What to do if you’ve been affected?

If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.

However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.

Disclosure and lack of communication from BigMage Studios

Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.

We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.

Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.

Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.

 

Source


Source: Latest News on European Gaming Media Network
This is a Syndicated News piece. Photo credits or photo sources can be found on the source article: MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability

George Miller (Gyorgy Molnar) started his career in content marketing and has started working as an Editor/Content Manager for our company in 2016. George has acquired many experiences when it comes to interviews and newsworthy content becoming Head of Content in 2017. He is responsible for the news being shared on multiple websites that are part of the European Gaming Media Network.

Latest News

Nagoshi Studio Unveils GANG OF DRAGON, a New Action-Adventure Game from Director Toshihiro Nagoshi

Published

on

Tokyo, Japan. December 12th, 2025-Led by Toshihiro Nagoshi, Nagoshi Studio unveiled the first teaser trailer for its upcoming title GANG OF DRAGON at The Game Awards 2025, held on Thursday, December 11 in Los Angeles.
Teaser Trailer: youtu.be/KX2pzle9dkE?si=r591Kz3ZbPfdCzMH
Steam page: store.steampowered.com/app/4146000/

GANG OF DRAGON

 is a new action-adventure game set in Kabukicho, Shinjuku, Tokyo’s iconic nightlife district. Protagonist Shin Ji-seong is a high-ranking member of a Korean crime syndicate, and is portrayed by celebrated Korean actor Ma Dong-seok (Don Lee).

Players will engage in visceral hand-to-hand combat showcasing Shin’s overwhelming physical strength, while also wielding swords, firearms, and unleashing a wide range of combat techniques. Additionally, players can race through the vibrant streets of Shinjuku, experiencing exhilarating high-speed car chases. Lastly, the game’s scenario and overall direction are led by Toshihiro Nagoshi, who is widely recognized for his emotionally rich, character-driven storytelling.

This new story will engage players in an exciting way and showcase increadible graphics for an action packed adventure. Viewers of The Game Awards were the first to get a look at the new footage!

“I’m both relieved and deeply focused as we finally reach the day to unveil GANG OF DRAGON. This project depicts, with unwavering honesty, the lives of outlaws who inhabit the real streets of Kabukicho. Through gameplay, my team and I are committed to delivering a powerful new human drama born from this world. What is shown in this teaser represents only a small part of what G.O.D. truly has in store, and we look forward to sharing much more with you in the future.” Said Toshihiro Nagoshi.

About Toshihiro Nagoshi

Toshihiro Nagoshi is a veteran game creator and President of Nagoshi Studio. Since joining SEGA in 1989, he has worked on many titles including Daytona USA. In 2005, he launched the Yakuza (Like a Dragon) series, serving as General Director for the mainline entries up through Yakuza: Like a Dragon. He founded Nagoshi Studio in 2021 and now leads the development of GANG OF DRAGON.

The post Nagoshi Studio Unveils GANG OF DRAGON, a New Action-Adventure Game from Director Toshihiro Nagoshi appeared first on Gaming and Gambling Industry Newsroom.

Continue Reading

Latest News

Blask & Gamblers Connect Enter A New Media Partnership

Published

on

Gamblers Connect, the award-winning iGaming affiliate and media platform, is proud to announce a new media partnership with Blask, a leading AI-powered analytics ecosystem dedicated to the iGaming industry.

This collaboration marks a pivotal step in the company’s mission to provide the most accurate, transparent, and data-backed content. Under the terms of this agreement, Blask will provide Gamblers Connect with complete access to its cutting-edge market intelligence platform.

This suite includes the Blask Index and real-time data tracking across more than 100 jurisdictions, allowing for granular analysis of market dynamics, brand performance, and player behaviour. By integrating these professional-grade tools into the editorial process, Gamblers Connect will elevate the depth and precision of its industry reporting.

The cornerstone of this partnership is a commitment to sharing knowledge with the wider iGaming community. Gamblers Connect will produce four exclusive case studies throughout 2026. Released once per quarter, these comprehensive reports will utilise Blask’s advanced analytics to uncover emerging trends, benchmark operator performance, and provide actionable insights for industry stakeholders.

This alliance represents a shared vision for a more transparent iGaming sector. By combining Blask’s technological prowess with Gamblers Connect’s editorial expertise, the aim is to set a new standard for data-driven journalism.

Max Tesla, Blask CEO, commented: “Partnering with Gamblers Connect is a natural step for Blask. We are building an ecosystem of transparent analytics that empowers the industry, and GC is one of the few media partners that truly values data and knows how to work with it. I’m confident this collaboration will strengthen both sides and deliver more accurate, trustworthy, and insight-driven content to the iGaming community.”

Gjorgje Ristikj, Founder & CEO at Gamblers Connect, added: “Partnering with Blask allows us to combine their strong analytical framework with our media expertise. It’s a collaboration grounded in trust and mutual respect, with the shared goal of delivering meaningful and measurable results to the industry.”

The post Blask & Gamblers Connect Enter A New Media Partnership appeared first on Gaming and Gambling Industry Newsroom.

Continue Reading

Latest News

Law enforcement officers from Kazakhstan eliminated the organized financial criminal group organized by Vadim Gordievsky, Larisa Ivchenko, and Alyona Suvorova from Ukraine

Published

on

The law enforcement agencies of Kazakhstan have effectively eliminated the organized criminal group created by Vadim Gordievsky from Ukraine and his accomplices, Larisa Ivchenko and Alyona Suvorova. Even though the law enforcement agencies managed to block accounts and payments of the Marginplus Company, key employees and management are still hiding.

According to the media, just a few days ago, the Financial Monitoring Agency of the Republic of Kazakhstan revealed a large-scale shady scheme of cross-border transfers that involved numerous payment organizations and providers. The funds were disguised as legal transactions and withdrawn to the accounts of online casinos. The total volume of illegal transactions exceeded more than $1 billion.

According to law enforcement authorities in the Republic of Kazakhstan, the key organizer of the miscoding scheme, which involved bookmakers, online casinos, payment organizations, and bank employees, is Vadim Ivanovich Gordievsky from Ukraine, who was born in 1974. He was the leader of the organized criminal group and used the local Marginplus Company for these purposes (official website: marginplus.kz). In addition to companies from Kazakhstan, Gordievsky also worked with illegal Russian online casinos while helping them to facilitate illegal payments.

According to new information from law enforcement agencies in the Republic of Kazakhstan, banks and bookmakers, including the local PIN-UP bookmaker, have already terminated all cooperation with Gordievsky’s Marginplus company.

According to informburo.kz, the local licensed Pin-Up.Kz bookmaker (legal entity: Bonami LLP) declares that it has nothing to do with transactions carried out by individual payment organizations. Judicial and criminal proceedings have already been initiated against these structures, and the company itself is fully cooperating with law enforcement agencies to establish all the circumstances and identify fraudulent, shady schemes.

According to unofficial information, the Pin-Up management provided the law enforcement agencies of the Republic of Kazakhstan with all the data related to the Marginplus company belonging to Vadim Gordievsky.

As of today, all financial activities of Marginplus have been paralyzed. In addition, large amounts of money have been blocked in its bank accounts. This money should have been paid to partners, contractors, and providers, including the local Parimatch betting company. Ordinary employees of Vadim Gordievsky’s company are already looking for new work while its management, including Larisa Vladimirovna Ivchenko (listed as the head of Gordievsky’s FC Alta Capital from Ukraine), is still hiding. Alyona (Elena) Suvorova has already closed and renamed her social media profiles a few days ago. In addition, she does not respond to messages and is trying to evade responsibility.

We would like to remind the audience that Alyona Suvorova positions herself “as an entrepreneur, investor, and a crypto trader with 5+ years of experience.” According to Suvorova herself, she has been developing payment technologies in the field of FinTech for 10 years. In 2021, she opened her own business for international crypto transfers. In addition, she is the founder of the Lemoncoin Crypto Academy.

According to investigators, Gordievsky’s partner, Mikhail Kovalev (Mykhaylo Kovalov), who is a citizen of both Ukraine and Israel, as well as an owner of a number of companies in the EU, in particular, in Poland, and who has a residence permit in Spain, was closely working with Gordievsky. By using the STABLEX SOLUTION Sp. z o. o fictitious company (official website: solvexs.pl) in Poland, he was engaged in illegal payments and withdrawal of cryptocurrencies into fiat money.

At the same time, as the source notes, the mentioned management and the people involved in the money laundering of Marginplus Company will be added to the wanted list of Interpol in the nearest future. The National Security Committee of the Republic of Kazakhstan has also announced that it’s going to closely monitor this case. According to local laws, participants of this shady scheme face up to nine years in prison. Information on Vadim Gordievsky’s companies and connections in other countries is also being checked.

After the initiation of criminal cases for financial crimes, fraud, and the announcement of his wanted list by the Ministry of Internal Affairs, Vadim Gordievsky left Ukraine on forged documents. Before diving into the world of financial fraud, he was involved in land and property issues in the Kyiv region. As of today, numerous criminal cases have been initiated.

The post Law enforcement officers from Kazakhstan eliminated the organized financial criminal group organized by Vadim Gordievsky, Larisa Ivchenko, and Alyona Suvorova from Ukraine appeared first on Gaming and Gambling Industry Newsroom.

Continue Reading
Advertisement

Facebook

Trending

EEGaming.org is part of HIPTHER, parent brand of various prominent news outlets and international conferences. These platforms and events span a wide range of industries, including Entertainment, Technology, Gaming and Gambling, Blockchain, Artificial Intelligence, Fintech, Quantum Technology, Legal Cannabis, Health and Lifestyle, VR/AR, eSports, and several others. This indicates that EEGaming.org is part of a larger network that focuses on a diverse array of sectors, particularly those related to cutting-edge technology and modern lifestyle trends.

Contact us: [email protected]

Editorial / PR Submissions: [email protected]

Copyright © 2015 - 2025 HIPTHER. All Rights Reserved. Registered in Romania under Proshirt SRL, Company number: 2134306, EU VAT ID: RO21343605. Office address: Blvd. 1 Decembrie 1918 nr.5, Targu Mures, Romania

We are constantly showing banners about important news regarding events and product launches. Please turn AdBlock off in order to see these areas.