Epic's Fortnite fail: Ancient UT2004 server used for login-stealing proof-of-concept

Crafty infosec bods exploited XSS vulns on dusty corners of Epic Games’ web infrastructure to steal Fortnite gamers’ login tokens and compromise their accounts – using a genuine Epic Games URL to phish their marks. Infosec biz Check Point discovered the XSS vuln, which, when combined with a login redirect attack, had the …

[Anonymous Coward]

"Epic has patched the vulns, according to Check Point, which disclosed them to the game publisher before going public."

The fact that it was patched so quickly shows the incident handling works well. Sadly, why wasn't this old server picked earlier?

[iron]

How quickly? The article contains no indication when the bug was first reported to epic, it could have been over a year ago. All we know is it has now been patched.

[Anonymous Coward]

That explains something...

Back in April last year, I started getting lots of "Epic Games - Help Protect Your Account" e-mails saying my account had "been locked" due to multiple invalid login attempts.

The e-mails appear to be genuine, but I never did anything about them as it was just a throwaway account to download an SDK. This would appear to be very old news.

[Lyle Dietz]

Re: That explains something...

I got something similar, saying there were lots of failed attempts to log into my account, and my account could get locked. It also asked me to turn on 2FA. I ignored them because I wasn't too worried about that account, and the password is unique.

Now I'm curious, and I'll have to check the link that was sent to me in the email to see if it was a phising attempt.

[MrMerrymaker]

Re: That explains something...

Same. They were not phishing links either. They included the IP address of who, what was making the attempts and when.

[steviebuk]

Re: That explains something...

Probably not old news as in now only gone public.

[adam payne]

Older readers will remember the classic Unreal Tournament line of PC-based first-person shoot-em-ups.

I still play them now. I am however a little miffed that Epic has shelved the new version of UT to concentrate on Fortnite.

[Graham 2]

Somehow I doubt that UT is making money hand over fist in the same way that Fortnite is.

[Anonymous Coward]

>I still play them now.

So do I but UT99 only with Nali Weapons 3, great mod and made UT99 interesting again.

[jaffa99]

Agreed, I like the new UT, I'm too old for Fortnite.

When I lived in the US (not that long ago) my colleagues didn't even know what a fortnight (the corrrect spelling) was.

[Captain Scarlet]

upper-bracket millennials

I'm a what now!

I'm so annoyed I am tempted to reinstall UT2004 and redownload some classic UT2004 mods from FilePlanet!

[rmason]

Re: upper-bracket millennials

Yeah I fall in that bracket too.

People use the word "millennial" to mean "teenager" or "young person".

I'm 37 this year. I'm a millennial.

[phuzz]

Re: upper-bracket millennials

I'll be 39 this year, I think that still makes me a millennial.

In fact, after talking to friends around my age, we came up with a more specific qualification rather than just age.

If you're from the UK, and you had to pay fees at university, then you're a millennial. (Fees came in to force in July 1998 fyi).

If you're older than that then you had a fundamentally different time at uni (you probably even got a grant), and if you're younger then you probably left uni with five figures of debt (3 x £9k).

But of course we can't afford houses because we're all eating avocado on toast right?

[Nick Ryan]

Re: upper-bracket millennials

Try being in the crossover period when students were being lied to about the loans not being, and never going to, replace student grants.

They were touted as a "top up" to allow a student to live between terms during which the grant was meant to provide all the money that a student needed. Except for the slight hitch that due to the disparity between grants and hall fees many a student would have been left with £10 a term for everything else (not at all Uni's of course).

What type of sour dough artisan toast are you having today? :)

[Jack 12]

Re: upper-bracket millennials

There was a cross-over period where you didn't receive any grants, but fees were capped at ~£1k per year and loans at something like 3x that, so you didn't necessarily have five figure debts on leaving. This may or may not be the same cross-over period Nick refers to.

[phuzz]

Re: upper-bracket millennials

That was when I graduated, I 'only' owed SLC about £9k.

Of course, by the time I was earning enough to actually pay that off, it was up to £11,000...

[Anonymous Coward]

Re: upper-bracket millennials

Look at you and your fancy degrees.

[adam payne]

Re: upper-bracket millennials

ChaosUT mod