More than 12 billion credential stuffing attacks were launched against gaming websites in a 17-month period between 2017 and 2019, according to Akamai, making gaming one of the most targeted and fastest rising industries exploited by cybercriminals.
According to Akamai’s 2019 State of the Internet / Security Web Attacks and Gaming Abuse Report, credential stuffing attacks launched against gaming websites accounted for more than 20% of attacks launched across all industries during that period.
Go deeper with GlobalData
Credential stuffing attacks make use of data stolen in previous breaches to gain unauthorised access to accounts where the owner has used the same login credentials across multiple services, or failed to change their password after a breach has occurred. These attacks are commonly launched using botnets, which automate the testing of credentials in bulk.
According to Akamai, cybercriminals are able to compromise dozens, if not hundreds, of gaming accounts each day using this method.
Gaming accounts: a honeypot for cybercriminals
With the gaming industry undergoing radical change, this has opened up various opportunities for cybercriminals to exploit.
“One reason that we believe the gaming industry is an attractive target for hackers is because criminals can easily exchange in-game items for profit,” Martin McKeay, security researcher at Akamai and the report’s editorial director, said.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataCybercriminals are often after potentially lucrative in-game items, such as cosmetics items and powerful weapons, which can be sold for real-world currency. Compromised high-level or rare accounts are also often sold on.
There are easily accessible marketplaces on the web that facilitate the sale of in-game items. One listing seen by Verdict on a popular marketplace was attempting to sell a Fortnite account with rare items for $325. There is also a black market for gaming accounts and items on the dark web, where stolen accounts for titles such as Fortnite, Counter-Strike, and League of Legends can be purchased for as little as $1.30.
The gaming industry is also moving away from one-off payments in favour of recurring revenue streams, through the sale of subscriptions and loot boxes. This means that accounts will often have payment information, such as credit card or PayPal details, saved, which allows the hacker to purchase more items or upgrades to increase the value of the account.
“Gamers are in a niche demographic known for spending money, so their financial status is also a tempting target,” said McKeay.
A recent BBC report found that children were making thousands of pounds each week by using credential stuffing techniques to steal and sell on Fortnite accounts.
Gaming companies need to do more
While it is common to see gaming platforms making use of additional security features, such as two-factor authentication – which requires players to enter a code sent to their email address or smartphone before they can gain access to their account – McKeay feels these companies still need to do more to protect their users.
“While gaming companies continue to innovate and improve their defences, these organisations must also continue to help educate their consumers on how to protect and defend themselves,” said McKeay.
If it is possible for gaming to encourage children to get involved in cybercrime, as the BBC report suggests, then it could also be used to teach young people good password hygiene.
“Many gamers are young, and if they are taught best practices to safeguard their accounts, they will incorporate those best practices for the rest of their lives,” added McKeay.
Read more: Wajam: How a seemingly harmless browser extension morphed into unwanted adware
