Gamers are one of the largest communities on the internet. YouTube’s most subscribed channel caters to players, 100 million of them watch gameplay streaming on Twitch.tv every month, and Pokémon Go has just conquered the world. But this robust online presence has also sparked interest from another group: cybercriminals.
Recently, the computer game Minecraft was hacked. This attack was conducted by OurMine Team, the same group responsible for penetrating into Mark Zuckerberg’s Twitter account and shutting down the Pokémon Go servers. Given their public proclamations after each incident, it’s likely this foray into Minecraft was, in part, motivated by an increase in attention.
The exploit was first announced on OurMine Team’s website. There, a video showcases them cracking into user accounts of Mojang, the company behind PC and Mac versions of the game. The most disturbing fact, however, was that the perpetrators only needed the victim’s email address to gain entry. By getting their hands on website cookies, the crooks got all the other necessary information to tap into the account.
That’s a bold claim, but unfortunately, it’s backed by truth. Those claims were verified by IDG news service, who contacted the cybercriminal group. After IDG created a new user account, the group entered and renamed the profile “OurMine Team.” Despite their attention-grabbing tactics and intentions, the rogues aren’t bluffing.
On the whole, however, many of OurMine Team’s claims fall apart under scrutiny. They assert to be a firm concerned with raising cybersecurity awareness, merely testing companies’ and celebrities’ security. Supposedly, that’s why they broke into many CEOs’ Twitter accounts and attacked games like Pokémon Go and Minecraft. In fact, there’s actually a financial motive: OurMine offers website scans for $1,000 and company audits for $5,000. This makes their actions blackmail, and a means of unusual advertising.
Motivated by gaining notoriety, OurMine Team was attracted to Minecraft’s popularity. While they didn’t go after players this time, this situation could have easily turned out worse. Over 21 million people have purchased Minecraft, and 1 million players are active at any given moment. That’s a lot of gamers who could’ve been compromised—simply from their email address.
Keep yourself safe from these types of threats, by following these steps:
- Clear your cookies. Every time you visit a website, information is saved in your browser. Sometimes this contains sensitive data, so it’s a good idea to delete these periodically. While OurMine Team didn’t obtain cookies directly from users in this case, in other instances, your browser’s stored information can potentially pose vulnerabilities.
- See if your email is exposed. These days, our contact information is publicly available—some data more than others. When breaches happen, such as when LinkedIn’s user data was released, crooks will scour those data dumps for email addresses and/or passwords to try on other websites. Regularly check if your email shows up in those breaches. Try this free search tool from Troy Hunt.
- Don’t let excitement cloud your judgement. The thrill of gaming can make us blind to security concerns, which many cybercriminals count on. Just look at a recent example, with Pokémon Go. Keep your cool and be levelheaded. Anything you’d be suspicious of outside of games, be suspicious of within them.
And, of course, stay on top of the latest consumer and mobile security threats by following me and @McAfee on Twitter, and ‘Like’ us on Facebook.
Stay Updated
Follow us to stay updated on all things McAfee and on top of the latest consumer and mobile security threats.
