Gaming firms become lucrative hunting grounds for cybercriminals

Take to Hack reflects the growing trend of cyberattacks on gaming firms, both small and large. As more users spend money on games and add money to their digital wallets of these games, in addition to adding personal data to gaming accounts, hackers are turning their attention to such firms to steal data, credentials and much more. are.

Domestic mobile gaming Unicorn Mobile Premier League (MPL), for example, has been facing an increase in “failed cyber attacks” over the past few months, said Ruchir Patwa, vice president of security and compliance at MPL. Patwa said such examples include social engineering attacks, where hackers try to posing as employees or company officials to gain unauthorized access to internal systems.

Suman Saraf, chief technology officer of cloud gaming platform BlueStacks, agreed, saying that the “steady expansion” of in-game purchases has led to increased cyberattacks against both gamers and gaming companies — often referred to as microtransactions. “Attackers are constantly looking for credentials, in-game currency and assets, payment details and personally identifiable information,” warned Saraf.

The gaming industry, which is currently said to be bigger than Hollywood, makes the bulk of its earnings from the sale of digital items, access passes, subscriptions, etc. For example, in November last year, Sequoia, a reporting firm by Boston Consulting Group and Ventures, said that the Indian gaming industry alone generated $1.8 billion in revenue in 2020. Experts noted that most of the revenue came from micro-transactions – one rupee here, ten there, and so on.

Like fintech applications, gaming firms also conduct Know Your Customer (KYC) checks to verify users and store the data in the internal system. They also use mobile numbers to sign in, and have built-in digital wallets where gamers can store their money to make it easier to buy digital items. Oliver Jones, co-founder of Bengaluru-based gaming firm Bombay Play, said the attacks are mostly against real-money firms, as opposed to those making free-to-play games.

According to a report by EY and Federation of Indian Chambers of Commerce and Industry (FICCI), India had 91 million gamers as of March 2021, and is said to be the largest gaming market (mobile, console and PC combined) after China. This is expected to triple to $3.9 billion by 2025, according to KPMG’s 2021 report.

In August, cloud services firm Akamai Technologies said in a report that attacks on gaming firms globally more than doubled between Q1 2021 and Q1 2022. India was the third most targeted country after the US and Switzerland. “If they can hijack a million transactions a month, they can make millions,” said Dean Houri, director of security technology and strategy, Asia Pacific & Japan, Akamai Technologies.

He also pointed out that “the problem is that with the sudden high demand, you also need to find a scalable platform”.

“Many people in the gaming industry have moved to the cloud and that has increased the attack surface,” said Houri. The attack surface is the number of points of entry for a hacker into a firm’s system.

“Also, because of the scale, many security teams don’t have visibility over all assets developed in the cloud, which basically opens the door for a lot of new vulnerabilities and attack surfaces,” he said.

“Often the number of users on their platform is so high that they avoid paying for a security solution that can verify each and every user,” Jones said in Bombay Play. Security solutions usually cost more as a platform scales, with typically few fees. Thousands to few lakhs per application.

Many gaming firms in India have become unicorns, but they remain small businesses in operation. Like most startups, they are focusing on growth over other things. The co-founder of a security firm said he charges small businesses 20,000 per application, 30-40 people company cost at least 5 lakhs. For large platform providers with millions of users, this could put their security costs in the hundreds of millions.

,