securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.co/wordpress/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.co/wordpress/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


MUST READ

Headlines
 * Microsoft Exchange ProxyToken flaw can allow attackers to read your emails
 * US DoJ announces the creation of Cyber Fellowship Program
 * ISRAELI FIRM ‘BRIGHT DATA’ (LUMINATI NETWORKS) ENABLED THE ATTACKS AGAINST
   KARAPATAN
 * CISA urges enterprises to fix Microsoft Azure Cosmos DB flaw
 * Boston Public Library discloses cyberattack
 * New variant of Konni RAT used in a campaign that targeted Russia



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


ESKYFUN DATA LEAK, OVER 1 MILLION ANDROID GAMERS IMPACTED

August 28, 2021  By Pierluigi Paganini




VPNMENTOR’S RESEARCHERS REPORTED THAT THE CHINESE MOBILE GAMING COMPANY ESKYFUN
SUFFERED A DATA BREACH, OVER 1 MILLION GAMERS IMPACTED. 

vpnMentor’s researchers discovered that the Chinese mobile gaming company
EskyFun suffered a data breach, information of over 1 million gamers were
exposed on an unsecured server. 



EskyFun developed several Android games including Rainbow Story: Fantasy MMORPG,
Adventure Story, The Legend of the Three Kingdoms, and Metamorph M. The games
affected in the data leak were: Rainbow Story: Fantasy MMORPG (500,000+
downloads); Metamorph M (100,000+ downloads); Dynasty Heroes: Legends of
Samkok (1,000,000+ downloads).

“EskyFun’s server was storing a rolling log of the previous 7 days’ user records
from 3 separate games. At the end of each day, any data older than 7 days was
automatically deleted to make room for fresh data.” reads the data breach
published by the researchers. “As a result, our investigation focuses on just 7
days’ worth of data and any players exposed in that short window. However,
despite only covering 7 days, the server still contained over 360 million
records from players. This is an enormous amount of data collected from a few
small, not well-known mobile games.”On Thursday, the team said that users of the
following games were involved in the data leak: Rainbow Story: Fantasy MMORPG,
Metamorph M, and Dynasty Heroes: Legends of Samkok. Together, they account for
over 1.6 million downloads.  

The experts pointed out that the gaming firm uses “aggressive and deeply
troubling tracking, analytics, and permissions settings” collecting an
impressive amount of data when users install their games.

vpnMentor reported that the server was containing 134GB of data, exposed records
include:

 * IP address
 * IMEI number
 * Mobile application package doing the tracking
 * Device screen size – whether a device is ‘rooted’*
 * Device model
 * Phone number (if any)
 * Platform (Android/iOS)
 * NetType (WiFi or cellular)
 * Events (open,login,level_up, etc)





The experts attempted to report their discovery to the gaming, but received no
response, for this reason they also contacted the Hong Kong CERT to secure the
data. The good news is that EskyFun secured the server on July 28.

“If you’re a player on any of EskyFun’s games and are concerned about how this
breach might impact you, contact the company directly to determine what steps
it’s taking to protect your data.” concludes vpnMentor.

Follow me on Twitter: @securityaffairs and Facebook



Pierluigi Paganini

(SecurityAffairs – hacking, data leak)









Share this...

Facebook
Twitter
Linkedin


SHARE THIS:

 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 
 * 


data breachdata leakEskyFunhacking newsinformation security newsIT Information
SecurityPierluigi PaganiniSecurity AffairsSecurity News


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

Boffins show PIN bypass attack Mastercard and Maestro contactless payments

NEXT ARTICLE

Some Synology products impacted by recently disclosed OpenSSL flaws

--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


MICROSOFT EXCHANGE PROXYTOKEN FLAW CAN ALLOW ATTACKERS TO READ YOUR EMAILS

August 31, 2021  By Pierluigi Paganini

US DOJ ANNOUNCES THE CREATION OF CYBER FELLOWSHIP PROGRAM

August 30, 2021  By Pierluigi Paganini






 * SPONSORED CONTENT

 * 


 * PIXFUTURE


 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER




More Story

BOFFINS SHOW PIN BYPASS ATTACK MASTERCARD AND MAESTRO CONTACTLESS PAYMENTS

Boffins from the Swiss ETH Zurich university demonstrated PIN bypass attack on
contactless cards from Mastercard and Maestro....
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me

This site uses cookies, including for analytics, personalization, and
advertising purposes. For more information or to change your cookie settings,
click here.

If you continue to browse this site without changing your cookie settings, you
agree to this use.
Accept Read More
Privacy and Cookies Policy
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT