With the world of cybersecurity in a continuous flux, it’s important to keep up to date with the latest stories and learn how to stay protected against such dangerous attacks.
The battle between hacking collectives and the security systems preventing such attacks continues to escalate, so we thought it was necessary to be keep informed of what may be out there threatening your business, and how to minimize future attacks.
Twitch Breach
The streaming juggernaut service Twitch was hacked, leaking source code for the company’s streaming service, an unreleased Steam competitor from Amazon Game Studios, and details of creator payouts.
The 128 GB torrent was posted on 4chan yesterday, with the user saying it was to "foster more disruption and competition in the online video streaming space" because "their community is a disgusting, toxic cesspool." The leak included:
- 3 years' worth of details regarding creator payouts on Twitch
- The entirety of twitch.tv, “with comment history going back to its early beginnings”
- Source code for the mobile, desktop, and video game console Twitch clients
- Code related to proprietary SDKs and internal AWS services used by Twitch
- An unreleased Steam competitor from Amazon Game Studios
- Data on other Twitch properties like IGDB and CurseForge
- Twitch’s internal security tools
According to VGC, the torrent contains Unity code for Vapeworld, which appears to be chat software based on Amazon's unreleased Steam competitor Vapor, a game store that integrates several of Twitch's features. Twitch later confirmed that the leak was in fact real and that they were working on discovering what was compromised alongside a solution.
With the confirmation from Twitch, it is highly recommended that users enable two-factor authentication to be safe. This assures the user that even if your password is compromised, you will need to authenticate your identity using SMS or an authenticator app on your phone.
To turn on two-factor identification:
- Log on to Twitch, click your avatar and choose settings
- Go to Security and Privacy, then scroll down to the security setting
- Choose Edit Two-Factor Authentication to see if it’s already activated. If not, follow the instructions to turn it on (you’ll need your phone)
Twitch are further investigating the cause of the breach, particularly because the leak is labelled as “part one,” suggesting there could be more to come. Staying vigilant and secure is absolutely essential.
Naraka: Bladepoint
The action-adventure, battle royale title, Naraka: Bladepoint, has suffered countless issues with hackers. Fortunately, developer 24 Entertainment are taking the necessary steps in preventing cheaters. In their first FAQ, published in September on Steam, the developer announced that “over 1300 players have received bans to date; we will continue to operate a zero-tolerance policy for unfair play.”
While the game has also launched an anti-cheat program to help ward off most hacks, players who have been aggressively "teaming" in rated games appear to be the greater concern. Other battle royale games, such as Fortnite, have a teaming issue where players team up with other players to get an unfair edge. Because battle royale games are considered a free-for-all competition, this goes against the rules.
In-game incentives for "successfully reporting" hacking and teaming people are now available. These encourage players to not only help the developers, but also each other. Chests and even legendary cosmetics may be included in the rewards scheme.
The developers have also stated that players who report suspicious conduct must send video and photos to the game's website, “It’s vital that the video reports you submit are complete and long enough in order for us to make a correct and comprehensive judgment.”
BloodyStealer
Multinational cybersecurity firm Kaspersky recently detected a harmful malware, infamously dubbed ‘BloodyStealer’, back in March. This malware has the ability to hack users’ accounts across a variety of gaming platforms including Steam, Epic Games Store, EA Origin and several more.
The malware was discovered to have been sold across a number of Russian-speaking underground forums, being offered for sale for less than $10 per month or $40 for life. So far, BloodyStealer has had a global reach, being used in attacks across Europe, Latin America, and Asia-Pacific.
Kaspersky warned that the malware has the ability of “gathering and exfiltrating various types of data, for cookies, passwords, forms, banking cards from browsers, screenshots, log-in memory, and sessions from various applications." However, with these insights, Kaspersky also noted that BloodyStealer’s capabilities “provides value in terms of data that can be stolen from gamers and later sold on the darknet."