Hackers reportedly used EA Games' Slack to breach network, access source code

Hackers tricked the company's IT support to get access to corporate systems, it seems.

Hackers who reportedly stole valuable source code from games company Electronic Arts did so by first infiltrating the company’s Slack, a representative for a group claiming credit for the attack told Motherboard.

For just $10, the hackers purchased a cookie that allowed them to infiltrate the $5 billion company’s Slack. They then posed as an employee to convince at IT administrator to grant them authentification to get into the company’s corporate network.

The EA hack, first reported by Motherboard, included some game source code and related tools. No player data was accessed in the breach and the company does not expect the hack to impact its games, EA said in a statement.

EA did not immediately respond to an email asking for verification of the hackers’ claims that they leveraged Slack to carry out the operation.

The attack highlights the vulnerabilities created by workplace communication technologies, which have skyrocketed in use during the pandemic. The switch to remote workspaces has created new ways for cybercriminals to target organizations, though many companies have been slow to adjust their security practices for the new reality.

“We have to update the protocols we use for ID verification because when a lot of these protocols were written we were in the office together — we could talk to each other, we could see each other’s faces,” says Rachel Tobac, a hacker and CEO of the vendor SocialProof Security.

Tobac recommends that IT professionals use two forms of communication to confirm an individual’s identity before fulfilling their request. For instance, if a user makes a request for system access over Slack, send them a reset via their corporate email.

“Many times an attacker hasn’t popped everything at once,” she says.

IT support hacks can also work in other ways. The perpetrator of a 2020 Twitter hack involving multiple high-profile accounts posed as an IT support operator to trick employees into handing over credentials.

Now, the theft of EA’s source code could create a host of problems for the company, researchers note.

“The danger of this attack lies primarily in the fact that the source code of FIFA 21 and other games has been stolen,” Boris Larin, senior security researcher at Kaspersky’s GReAT, said in a statement. “FIFA 21 is of primary interest to the attackers as the game has its own virtual currency, which is in high demand.”

The FBI has gone after hackers for allegedly defrauding the game’s currency before.

Hackers first started offering the EA source code in early May, according to researchers at Intel 471.  Other groups jumped in to offer the same data this week, though it’s unclear which group is the original source.

Researchers at Akamai have noticed a rise in attacks against the gaming industry over the past year.

“Gaming companies have an additional attack surface: the games themselves,” Steve Ragan, a security researcher at Akamai, wrote in an email. “There’s also still a big market for cheat codes, cracks, and mods in the gaming industry that criminals take advantage of every day.”

Both game makers Capcom and CD Projekt Red — best known for the game Cyberpunk 2077 — suffered ransomware attacks within the past year, with source code being auctioned off.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure