Hackers Gone Phishin' for EA Games Users' Apple IDs

[TiTanOFTiTans]

Hackers Gone Phishin' for EA Games Users' Apple IDs

 

 

EA Games doesn't have time to rest up before its boss battles against cyber baddies. It's bad enough that phishing sites are trying to scam EA users into giving away their credentials. Now it turns out that one of EA's servers was recently compromised by hackers to host a phishing site. Netcraft reported the phishing madness that's affecting EA Games in a recent blog post, revealing that the fight against hackers isn't ending any time soon.

The Bait: Apple ID Accounts

The compromised EA Games server targets Apple ID account holders and is ordinarily used as a calendar based on WebCalendar 1.2.0. The 2008 version that the server uses contains numerous security vulnerabilities that have been addressed throughout the years. Not all vulnerabilities are caught though, and it's probable that one of them was used to compromise the server, because the phishing content is in the same directory as the WebCalendar application.

Victims are tricked into submitting an Apple ID and password, and then led to a second form asking for further personal information including full name, credit card number, date of birth, and phone number. After this information is provided, the victim is redirected to the legitimate Apple ID website.

The hacker behind this attack installed arbitrary PHP scripts on the EA server, which means he or she can probably access the contents of the calendar, some of the source code, and other data on the server. EA Games' Origin users are also under attack; cyber crooks behind the phishing attacks that target EA Games are trying to steal users' credentials. Old software is incentive for hackers to target systems and look for further vulnerabilities or dig deeper into the internal network.

Reeling In Protection

While companies are responsible for ensuring proper security for their consumers, users have to be prepared to prevent and face phishing attacks as well. Many security suites offer powerful phishing protection. Norton Internet Security (2014), an Editors' Choice, does a consistently fine job of identifying and blocking phishing sites.

Browsers have surprisingly good phishing protection as well, so it's a good idea to make sure that the phishing protection is turned on in both your security software and browser. Fighting phishing attacks is like any other boss battle: you have to level up in order to beat the villain.