Posts Tagged

gaming

The EA Hack

Elizabeth Uncategorized November 19, 2021

The EA hack isn’t a special case. Not anymore. Hack, after hack, after hack, data leak after data leak, stolen game engine and asset, one after another. Game companies are being targeted deliberately for IP and code theft because it’s one of the few things that hackers can still steal with relative ease.

EA’s Track Record

This hack was due to a mix of authentication fraud and social engineering – it also seems to be their first major hack, if the lack of news about anything else is any evidence. Even Wikipedia doesn’t have much to say about past security instances. The one chance hackers had to get customer data was sealed off back in 2019, when a white-hat hacker group discovered the vulnerabilities and then alerted them that a sufficiently capable team would be able to get in, and then steal all of their customers’ payment data. EA’s record is cleaner than the industry average.

EA has a good track record with overarching security – many companies in the same worth bracket, including other game companies, can’t say that! Fellow gaming company Capcom got dinged with Ragnar ransomware, and while it “only” lost about 350,000 people’s worth of account data, it also lost its internal logs and couldn’t tell if they also lost credit card data. Blizzard, another big company with a good track record, suffers from persistent bot plagues that they’re unable to clear out. Human players then lose their data to particularly conniving bots and data thieves directly, no middleman hacked server necessary.

This Particular Hack

This hack was especially devious. A hacker used authentication cookies (cookies that “remember” the device or browser being authenticated with a code) to get into an EA slack channel, and then socially engineered their way past IT into the company’s internal network.

From there, downloading stuff was easy.

More than 780 GB of data (most of it source code) was captured, but the hacker group states that they couldn’t find a buyer. Source code is often trademarked, after all, and the consequences of buying another company’s coding aren’t worth having it. Many hackers would much rather have payment personal info than code. They then tried to extort EA by promising to release it, and uploading a little bit of the next FIFA game as proof that they were capable. After EA refused to pay the ransom, they released the remainder of the code as promised. Once again, using another company’s source code just doesn’t make sense in the long run, so it’s unclear what the long-term consequences will be for the company. However, they’re not the first ones to get extorted in this way: CD Projekt Red’s failed ransom should have served as a warning!

The CD Projekt Red Hack

CD Projekt Red, the game studio that created such classics as CyberPunk 2077 and Witcher 3, was hacked early last year. At that time, the hacker group responsible stole their game engine, and not much else – their customers were surprisingly uncompromised after the incident. The hacking team seemed to have a personal grudge against Projekt Red, so I can only assume the customer information was better-secured than the game engines themselves: who wouldn’t steal customer data if they were trying to completely trash a company’s reputation?

EA similarly partitioned customer data away. This is a good thing! Sort of like in a cruise  ship, separating data means that the entire company isn’t compromised as long as a gate somewhere stops the water from getting into other rooms.

And Other Examples

A Blizzard hack snatched emails (but not the unscrambled passwords) of an estimated 12 million players in 2012. This was easy to recover from – resetting the password was good enough for most accounts, but having those emails made the players unfortunately vulnerable to password stuffing attacks in the long run.

In 2011, an even bigger attack on Sony’s Playstation Network compromised the details of approximately 77 million users. This one stands out because both encrypted and unencrypted data was taken – credit card information that was encrypted wasn’t theoretically unscramble-able, but Sony, even with a week-long delay, couldn’t determine how much a hacker could actually squeeze from that data. Unencrypted data, which was basically all of the other personal details that could be attached to a player, was useable as soon as the hackers obtained it. Events like these served as warning for Blizzard, who encrypted much more, and then eventually for Xbox, Microsoft, CD Projekt Red, etc. as hacks became more prevalent.

Sources:

https://therecord.media/hackers-leak-full-ea-data-after-failed-extortion-attempt/

https://www.newsweek.com/electronic-arts-ea-origin-account-takeover-hacking-cybercrime-check-point-cyberint-1445976

https://www.ea.com/security

Gaming and Gambling: Microtransactions And Lootboxes

Gambling is widely considered an adult activity, and for good reason. It’s addictive, it has the potential to eat a lot of money, and it’s often difficult to stop!

However, these are also great reasons to introduce gambling into places where it doesn’t belong if the business likes money more than its ethics.

 

Games and Skins

 

When you see someone refer to a ‘skin’ in a game, they’re talking about the image used for the surface of the in-game item. Character skins change out clothing, while weapon skins might change the weapon’s color. Traditionally, skins aren’t supposed to do much, but sometimes the skins in a promotional package come with minor boosts to the weapon’s stats. Nothing that would tilt the see-saw into ‘impossible to beat’ territory, but just noticeable enough to add a nice bonus for pre-ordering the game.

Skins are one of the few things a game can go buck-wild with that won’t ruin the playstyle.

For a healthy group-gaming experience, games shouldn’t have the option to simply buy the good items with real money, and most games acknowledge that. In-game currency is one thing – looting crates and enemies is available to all players. When in-game currency is used, the best and most-well-regarded games don’t allow players to purchase it, or purchase too much of it at one time, to keep ‘whale’ players who have a lot of money to spend from stomping out beginners, or players who have more self-control. Games that don’t limit it aren’t usually very well-liked. It’s pay-to-win, not win-to-win. As such, most good game studios limit what you can actually buy with real money.

Skins are a rare exception to the real money rule because they don’t alter the playstyle, they’re purely cosmetic. If a game wants to offer up a 19.99$ knife skin that doesn’t make it stab any faster, players will buy it for fun, and players who don’t buy it don’t have any complaints. That’s totally reasonable. You don’t have to buy the skin to win. Skins became a way to show off money, and just like any real-money item, they became trading tokens, but otherwise most players were happy with the arrangement. Show off money, whatever – I’ve got a game to win.

 

The Curse of the Loot Box

 

Loot boxes are widely considered a scourge. They started out almost as a fundraiser, a way to keep money coming in from free-to-play games without overloading the end user with ads. However, it soon turned into a primary source of revenue for online and mobile games, and from there it transmuted into a monster. Games realized that people like gambling. For the rest of the population who didn’t, well, too bad! The game-makers take the fun nature of simply buying a stupid skin for your in-game weapon, and turn it into a slog, or worse – a paywall, depending on how long it takes to get your desired item. It’s fun for some of the players, but most have mixed feelings about them.

I’m not saying it’s a conspiracy that nobody gets the skin in the first box, but it’s certainly incredibly rare. But wait, the game could solve this by just offering the skin in the store, right? It’s fun to try and win a 15$ item with a 2.50$ loot-box when you have the fallback of simply buying it instead. You know what’s not fun? Gambling for something you really want with no promise of receiving it even if you do spend what it’s worth on loot boxes. Guess what a bunch of games do instead of offering a store.

In that case, the player could just not play for the skin, right? They could just… not buy the lootboxes, and not care about the skin? That’s where the issue with gambling comes in – that’s only a viable option if everyone behaves perfectly rationally. Players want the skin irrationally, and they’ll say “I’ll buy five boxes and then quit”. And then when the fifth box doesn’t have the ultra-rare item they want, they’ll either stop or keep going. “Well, maybe the sixth box”. “I’m feeling lucky number seven”. It keeps going in spite of their own judgement, and soon the player has blown way more money than they intended to, and sometimes they still don’t have the skin! Not everyone gambles, but enough people do to fund the game and create issues for the FTC.

Even Worse.

 

But wait – it gets even worse! Star Wars Battlefront II allowed players to play as characters from Star Wars, and it cost as much as a triple-A studio game usually costs, about 60$. However, there was one noticeable issue: microtransactions and lootboxes woven into the game. The lootbox mechanic allowed some players an obvious advantage over other players, and lootboxes were purchasable with real money. Suddenly it was super hard to have fun without spending money. Players were paying 60$ just to get stomped to death by another player who spent 200$ to win.

Most games with lootboxes that allow advantages are at least free-to-play, meaning you can enter for free and spend money on upgrades or lootboxes as you desire. It’s a trade-off: no upfront fee, smaller optional fees later on. Plague, Inc., a free-to-play mobile game, has extra content behind a paywall, but the game itself is complete without that extra content. It’s still possible to win without it (and it’s also much cheaper). Star Wars Battlefront II is charging a door fee to lose to someone with more money, and EA, when questioned on Reddit, responded with “too bad”.

 

 

That comment got them the single-most disliked comment in Reddit history, and they were forced to move away from their lootboxes and microtransactions to get their players back. It just goes to show how warped the gaming industry’s idea of their players is! People don’t have to buy games, and big game studios were getting a little too complacent with microtransactions.

Addictive – For What?

 

Loot boxes are an easy way to take advantage of the addictive nature of gambling, without trading anything of real value to the player for their money, even when it is just skins. At a casino, you know what you’re walking into, and they’re required to have a certain return rate. Some casinos even advertise that they’re ‘looser’ than the state requirement out here in Vegas. You win money if you win, and if you don’t, then at least you got to play the game knowing what the odds were.

Game loot boxes are a totally different beast. You sit down to play a ‘game’ against a computer that doesn’t have a law-specified return rate, so you have no idea if you’re actually capable of winning what you want. You can lose 40 dollars and get common skins or minor boosts for items over and over and over again. Well, you might not have meant to spend that much money, but – just like a casino – the game hijacks common sense and rational thought.

All the addictive science of the casino, none of limitations associated with going out to one. If someone comes into a casino with only cash, and they left their cards at home so the ATMs wouldn’t tempt them, they’re going to find it much harder to stop when the game only takes a credit card. Cash has a hard limit, either you have physical money or you don’t. Digital cards are immaterial to an addict.

In fact, skin-gambling in games like CSGO is such an issue that a gray market of skin-trading has popped up. People who have the money to drop on lootboxes over and over and over again can rustle up some rare skins to sell into the market, where horse-betting levels of money get involved. The FTC doesn’t like these sites very much, but it’s difficult to actually get them on anything – the closest they can get is charging them with failures to disclose sponsoring. Speaking of which, sponsoring and advertising is also a big issue with lootbox systems!

 

Ethical Issues with Loot Boxes

 

‘Mystery boxes’ started appearing IRL. To be perfectly clear – I’m not talking about blind bags. Blind bags are little toys in packaging that keeps the buyer from seeing inside until it’s opened. The toys can all be differing levels of rarity and collectability, but they A) don’t usually cost more than ten dollars and B) give a real item no matter what. It’s incredibly low-stakes, even if you do get a repeat of a common item, you still receive a physical toy. These ‘mystery boxes’ don’t promise to pay out with anything, which – given the cost – is horrifying.

See the scandal with Youtubers like RiceGum and Jake Paul advertising a gambling service to their largely underaged audience, via a website called Mystery Brands. Sure, you could win a car for 50$ – but the odds are lottery-levels of unlikely. Verging on statistically impossible. Most people who studied the incident called it a scam, as it might literally be impossible to win some of the prizes, like a house the site advertises even though they don’t own the deed. Even if you do win, you might not get what you ‘won’ – users complain of fake products and boxes that don’t ever ship.

 

Kids don’t know that.

 

A small study from Australia shows that children misperceive ‘winning’ in gambling as a skill, instead of pure luck. They literally don’t understand how much the odds are stacked against them, which is exactly why they’re being targeted. Personalities sell things all the time, but most of the time the endorsement is for, like, cereal. It’s dangerous to put gambling mechanisms in front of kids and say ‘buy this!’. It’s why the FTC works to prevent these things. Loot boxes and mystery boxes are close cousins, and both appeal to the same part of the brain that answers to gambling.

 

For the Children

 

Intermittent rewards are the most rewarding of rewards. Give a rat a treat every time it presses a lever, and it will only press that lever til it’s full – give a treat to the rat on random intervals of lever-pulling, that rat’s just going to sit there and pull the lever all day. Gambling engages this behavior in humans, which is why gambling addiction is such a real issue.

Not to go all “Think of the children!” on this, but it really is a danger to them. The link between violent video games and violence IRL is basically nonexistent in studies, but gambling in games? Develop an addiction to gambling via these lootbox games, and it will follow them for life. Not to mention the harm done to them in the ‘now’! Teens are the perfect mix of impulsive, emotional, and easily misled by idols (and popular games!!!) for gambling companies to latch onto and suck dry, which is why they got Jake Paul and Ricegum to sell it, two Youtubers popular with the under-eighteen crowd. If they wanted adults playing these games, they would have sponsored someone else.

Loot boxes evade parents because they don’t look like gambling. And yet, loot boxes take real money. Even though the stakes are smaller, it’s still offering up the same gambling mechanism to kids with the same addictive rewards output. The prize doesn’t have to be a full-blown car for it to turn into an addiction, it just has to stimulate that part of the brain that wants rewards and is uncertain about getting them; it only gets easier to siphon cash from them as they get older. Game companies looking to make a quick buck are hooking kids into spending real money on immaterial rewards.

Look at it like smoking – kids who make it to 18 without smoking are much less likely to ever start, and cigarette companies used to make ads with fun cartoon characters to try and suck kids in before then. Gambling is much the same: start early, and potentially create a life-long habit of gambling in games.

Sources:

https://www.theverge.com/2019/1/3/18165291/jake-paul-ricegum-mystery-brand-youtube-gambling-ethan-klein-kavos-memology101-loot-box

https://www.wired.co.uk/article/loot-boxes-new-gambling

https://royalsocietypublishing.org/doi/10.1098/rsos.171474

https://www.psychologicalscience.org/publications/observer/obsonline/video-game-mechanics-aggression.html

https://www.theguardian.com/society/2019/oct/22/clamp-down-on-fortnite-loot-boxes-urges-childrens-commissioner

https://www.ftc.gov/news-events/blogs/business-blog/2017/09/three-ftc-actions-interest-influencers

https://harmreductionjournal.biomedcentral.com/articles/10.1186/s12954-017-0136-3