13 replies to this topic

[Joshua McEvedy]

A new wrinkle on Epic...

Quote

Epic Games, the developer of Fortnite, is being sued in a class-action lawsuit after a security breach allowed hackers to access the personal information of users with Epic Games accounts.

The class-action lawsuit was filed by Franklin D. Azar & Associates in US District Court in North Carolina. The suit cites Epic's "failure to maintain adequate security measures and notify users of the security breach in a timely manner." It goes on to mention that there are more than 100 class members involved in the lawsuit.

Epic acknowledged the breach back in January, surmising that a bug in Fortnite may have exposed the personal information of millions of user accounts. The company fixed the issue, but the suit alleges that the company failed to notify affected users to the possibility of their personal information being compromised. The filing says that the plaintiff and anyone else affected by the breaches "have an ongoing interest in ensuring that their [personally identifiable information] is protected from past and future cybersecurity threats."

Check Point security researchers discovered the breach in November 2018 before Epic acknowledged it in January 2019. "We were made aware of the vulnerabilities and they were soon addressed," said an Epic Games spokesperson at the time. "We thank Check Point for bringing this to our attention. As always, we encourage players to protect their accounts by not reusing passwords and using strong passwords, and not sharing account information with others."

However, Check Point's report details an exploit that couldn't have been avoided by constant password changes. "By discovering a vulnerability found in some of Epic Games' sub-domains, an XSS attack was permissible with the user merely needing to click on a link sent to them by the attacker. Once clicked, with no need even for them to enter any login credentials, their Fortnite username and password could immediately be captured by the attacker."

"Even if you [had] a security product looking for anti-phishing, it wouldn't catch [the hack] because it's coming from a legitimate domain," Check Point's head of products vulnerability research Oded Vanunu said. Vanunu went on to encourage players to enable two-factor authentication for their Epic accounts. "Token hijacking is something that is happening on all major platforms," Vanunu continued. "We are starting to see malicious attackers looking for tokens more."

https://www.gamespot...g/1100-6469051/

[Ssamout]

So how this ugly american style of suing rich businesses in hope of monetary compensation is relevant to mwo?

Edited by Ssamout, 15 August 2019 - 11:37 AM.

[Bombast]

Ssamout, on 15 August 2019 - 11:37 AM, said:

So how this ugly american style of suing rich businesses in hope of monetary compensation is relevant to mwo?

No MW5 forum, so people post MW5 stuff here. Then the mods move the topic to the Battletech forum.

[Gristle Missile]

epic has piss-poor security that doesn't work and also somehow screws over legitimate accounts

2FA is a good idea in general and pretty much the only way Id feel sort of secure, but at the same time you give more of your info to china

[Tordin]

As long as it dosent ruin the livelyhood for the employers in general ( no, those on top I couldnt give a F about ), that they get to find other jobs besides Epic AND that MW5 survives to be released on Steam, GOG etc.

I find this very good news and bask in damage rejoice, however cruel it sounds. They did it to themself and now, hopefully comes the payback.

[GeminiWolf]

So from what I just read, the User had to get an email with a link that the user had to click which read some information on that users computer. Who in this day and age just clicks some random link in an email they received? Typical, blame someone else for your own stupidity.

[VonBruinwald]

Place your bets Valve were the perpetrators of the hacking....

GeminiWolf, on 15 August 2019 - 04:19 PM, said:

So from what I just read, the User had to get an email with a link that the user had to click which read some information on that users computer. Who in this day and age just clicks some random link in an email they received? Typical, blame someone else for your own stupidity.

12 year olds do the clicking. The parents look for someone else to blame... can't have the blame falling on their shoulders for leaving their kids unsupervised on the internet.

[Tarl Cabot]

VonBruinwald, on 15 August 2019 - 04:21 PM, said:

Place your bets Valve were the perpetrators of the hacking....

12 year olds do the clicking. The parents look for someone else to blame... can't have the blame falling on their shoulders for leaving their kids unsupervised on the internet.

Sadly it is not just 12 years old... though sad parents likely thought it was their kids fault initially, then they do want to blame someone else for their bad judgements...

[BROARL]

I bet everyone who is scared of having their info stolen and of being spied on also has a phone on them at all times... *slow clap*

[LordNothing]

Gristle Missile, on 15 August 2019 - 12:36 PM, said:

epic has piss-poor security that doesn't work and also somehow screws over legitimate accounts

2FA is a good idea in general and pretty much the only way Id feel sort of secure, but at the same time you give more of your info to china

im no fan of 2 factor. i see it as a crutch for people with poor password practices and a total ignorance of how social engineering works. its also a cya for sites that use it while introducing other security problems, like exposing even more information.

what i worry about is cascade failures though. having your phone stolen for example leads to someone being able to get into your bank account and so on. one service getting compromised leads to others falling in turn. its better if the services you use are completely ignorant of the others.

i usually take a circles of hell approach with my critical stuff behind a randomly generated hash from an unorthodox seed source (like the current gps coordinates of my cats) at the center with less critical bs on the outskirts with an easy to remember password that meets the bare minimum of requirements. no circle should know of the existence or contents of the one inside it. with so many video games requiring logins and with all the micro transactions that require the storing of financial information it puts something that should be in the outer ring near the center. its just not something people think about.

[Curccu]

Gristle Missile, on 15 August 2019 - 12:36 PM, said:

epic has piss-poor security that doesn't work and also somehow screws over legitimate accounts

2FA is a good idea in general and pretty much the only way Id feel sort of secure, but at the same time you give more of your info to china

LOL one more china conspiracy fanatic.

LordNothing, on 16 August 2019 - 01:37 AM, said:

having your phone stolen for example leads to someone being able to get into your bank account and so on.

Your phone isn't protected?
Your bank software doesn't require any kind of login? I would be way more worried about that banks security than EPICs.

[LordNothing]

Curccu, on 16 August 2019 - 02:02 AM, said:

Your phone isn't protected?
Your bank software doesn't require any kind of login? I would be way more worried about that banks security than EPICs.

its protected simply by not existing. and if i did own one i certainly wouldn't tell the bank. i wouldn't tell the phone about the bank either. thus breaches in security are contained. best way to ensure data is not stolen is to hold no data.

Edited by LordNothing, 16 August 2019 - 04:47 AM.

[Tarl Cabot]

LordNothing, on 16 August 2019 - 04:38 AM, said:

its protected simply by not existing. and if i did own one i certainly wouldn't tell the bank. i wouldn't tell the phone about the bank either. thus breaches in security are contained. best way to ensure data is not stolen is to hold no data.

Ie, he would not download bank app to his cell...

[Mystere]

LordNothing, on 16 August 2019 - 01:37 AM, said:

i usually take a circles of hell approach with my critical stuff behind a randomly generated hash from an unorthodox seed source (like the current gps coordinates of my cats) ...

You just reminded me of the time I used serial numbers of totally unrelated products as passwords. Heck, my wireless password still uses one of those.