Once compromised, an attacker can then access players' personal information, buy in-game virtual currencies, and purchase game equipment that would then be transferred to a separate account controlled by the attacker and resold.

The Fortnite game lets its players log in to their accounts using third-party Single Sign-On (SSO) providers, such as Facebook, Google, Xbox, and PlayStation accounts.Īccording to the researchers, the combination of cross-site scripting (XSS) flaw and a malicious redirect issue on the Epic Games' subdomains allowed attackers to steal users' authentication token just by tricking them into clicking a specially crafted web link. The reported Fortnite flaws include a SQL injection, cross-site scripting (XSS) bug, a web application firewall bypass issue, and most importantly an OAuth account takeover vulnerability.įull account takeover could be a nightmare, especially for players of such a hugely popular online game that has been played by 80 million users worldwide, and when a good Fortnite account has been sold on eBay for over $50,000. An Android release is also planned for summer 2018.Check Point researchers have discovered multiple security vulnerabilities in Fortnite, a massively popular online battle game, one of which could have allowed remote attackers to completely takeover player accounts just by tricking users into clicking an unsuspectable link.

Jake Bates and his mother, Amy Bates, have reportedly filed a complaint with Epic Games but it’s unclear whether the developer has been in touch yet.įortnite is available for PC, PS4, Xbox One, and iOS devices. As the teen had spent hundreds of dollars on Fortnite skins, it also meant that the hacker had access to Bates’ credit card details as well as the personal information found in his emails. For the PS4, click the word ‘Connect’ underneath it. For those with a Nintendo Switch account, it should be automatically synced into the system. Go through the username and click on ‘Account’. When Bates was chatting with another player in the game, they convinced the teen that they could give him more Fortnite skins if the teen handed over his username and password.īates obliged, and this seemingly benevolent player then proceeded to hijack the teen’s Fortnite account as well as his email account, even changing the passwords (including the recovery passwords) and phone number preventing him from getting it back. Log in to the website and sign in with the e-mail and password. An Ohio news station reports that Jake Bates, a 13-year old Fortnite player from Mason, OH recently found himself being duped by a fellow player.

Fortnite accounts hacked xbox one