A hacker managed to breach the official forum of the popular mobile game “Clash of Kings.” This way he obtained approximately 1.6 million accounts.
The hack was carried out on July 14 by an unknown hacker, who posted a copy of the database on LeakedSource.com, a website that allows users to search for their names and email addresses in a treasure trove of stolen and hacked data.
The database contains (among other things) usernames, email addresses, IP addresses (which can often identify a user's location), device identifiers, as well as Facebook details along with access tokens (if the user used the social network to log in). The passwords in the leaked database are hashed and salted
“Clash of Kings” is one of the most popular mobile games with over 100 million installations on the Android platform.
The forum is currently still down for repairs.
The hack reportedly took advantage of the company's lax approach to user security, such as not using basic HTTPS encryption.
The hacker exploited a known vulnerability in the forum software, an older version of vBulletin from late 2013. The vulnerability is so old that tools to exploit it are freely available online.
