Fortnite Bugs Gave Hackers Access To Millions of Player Accounts, Researchers Say

Researchers at cybersecurity firm Check Point say three vulnerabilities chained together could have allowed hackers to take control of any of Fortnite's 200 million players. 'The flaws, if exploited, would have stolen the account access token set on the gamer's device once they entered their password,' reports TechCrunch. 'Once stolen, that token could be used to impersonate the gamer and log in as if they were the account holder, without needing their password.' From the report: The researchers say that the flaw lies in how Epic Games, the maker of Fortnite, handles login requests. Researchers said they could send any user a crafted link that appears to come from Epic Games' own domain and steal an access token needed to break into an account.

Here's how it works: The user clicks on a link, which points to an epicgames.com subdomain, which the hacker embeds a link to malicious code on their own server by exploiting a cross-site weakness in the subdomain. Once the malicious script loads, unbeknownst to the Fortnite player, it steals their account token and sends it back to the hacker. 'If the victim user is not logged into the game, he or she would have to log in first,' a researcher said. 'Once that person is logged in, the account can be stolen.' Epic Games has since fixed the vulnerability.

Read more of this story at Slashdot.