Hackers target video game publishers for ransom and source code

Each attack involved data theft, with timelines for future Capcom releases posted on darknet forums for games such as Resident Evil Village and Street Fighter.

Hackers claim to have stolen the source code of popular games such as EA’s FIFA series and CD Projekt’s Cyberpunk 2077, as well as the libraries of code and digital assets known as game engines used to create them.

Rather than demand a ransom for not releasing the source code, the hackers instead said they would auction it on the darknet.

“When you have the keys to the realm and understand how the code is written and how the applications are used, it’s obviously more visibility than I want,” said Mark Ostrowski, Engineering Manager at Check Point Software. Technologies Ltd.

, a cybersecurity vendor who has worked with video game companies on their security, including EA.

In response to the ransomware attack, CD Projekt said in a June 10 statement that it had redesigned its core IT infrastructure, upgraded firewalls, expanded its internal security team, and hired third-party specialists to help with cybersecurity. A spokesperson for the company did not respond to a request for comment.

A spokeswoman for EA said the company lost a limited amount of game source code and associated tools in the attack, and that it did not believe player data was at risk. EA has established a full-time internal penetration testing team, she said, and follows best practices such as those outlined in President Biden’s May 12 cybersecurity executive order.

Capcom said in an April 13 report that it has upgraded its technology and created a committee to oversee cybersecurity. A Capcom spokeswoman referred questions about the attack to the company’s report.

Video game studios, however, face a number of challenges unique to their industry. The need to stream large amounts of data to and from the servers, which power online games, means that security tools are often customized for a studio.

Additionally, the digital nature of valuable assets, such as source code, means that in the event of a hacker intrusion, critical intellectual property can be targeted and stolen.

“There isn’t a single game company that doesn’t focus on protecting assets in one way or another,” said Steve Ragan, security researcher at cybersecurity firm Akamai Technologies. Inc.

which specializes in the video game market.

High staff turnover in the video game industry, where entire teams can be hired for contract work or fired after a project is completed, means that managing user access to sensitive systems can be difficult, a said Eric Milam, vice president of research and intelligence at technology company BlackBerry Ltd.

This increases the risk that accounts with access to sensitive data will remain open, or disgruntled former employees may present insider risk, Mr Milam said. “Just because they let these people go doesn’t mean they forget how to access certain things,” he said.

Hackers could sell the source code or use it to launch attacks in several ways, the researchers said. For example, by exploiting the essential functions of a game, hackers could create tools that allow them to impersonate support staff and then send phishing emails to players to gain access to accounts. operate or sell on the darknet, said Hank Schless, a senior executive. manager at the cybersecurity company Lookout Inc.

Additionally, alternate versions of games containing malware could be distributed to gamers, Mr. Schless said. Popular app stores such as Alphabet Inc.

Google Play and Apple Inc.

The iOS App Store has strong protections, but such versions of impostor games could sell out on third-party platforms with weaker oversight, he said.

Criminals may also be able to develop tools that wreak havoc in games, Mr. Ragan said. “If you’re in the market to sell tips and cracks for a certain game, the source code is going to help you identify ways to get around the protections. It’s the very big fear, ”he said.

While cheating disrupts the enjoyment of the game, it also jeopardizes the growing revenue of esports if sophisticated tools become mainstream.

Gaming research firm Newzoo International BV estimated in March that esports market revenues will first reach $ 1 billion in 2021, with a global audience of 474 million people. The video game industry as a whole generated higher revenue than US movies and sports combined in 2020, according to estimates from market research firm International Data Corp.

Ongoing updates, subscriptions, and in-game savings, known as live services, also provide a lucrative source of revenue for games well beyond their initial sale value, and could be vulnerable to damage. hackers through attacks on players or attacks designed by analyzing the source code of a game.

EA’s live services accounted for 71% of its net revenues, to just over $ 4.01 billion, in its 2021 fiscal year, according to regulatory documents. About $ 1.62 billion came from FIFA’s Ultimate Team mode.

The EA spokeswoman said the company does not expect the recent attack to have a significant impact on its games or business.

Write to James Rundle at [email protected]