An Xbox bug could have let hackers link gamer tags with the players’ emails

This particular Xbox bug could have been exploited by playing around a browser’s developers console and editing a cookie field.

By: HT TECH
| Updated on: Aug 21 2022, 00:10 IST
Microsoft did not classify this bug as “worthy of a monetary reward because the bug couldn't be used to hijack Xbox”, the bug could have allowed hackers to link any Xbox gamer tag to a gamer's real email address.
Microsoft did not classify this bug as “worthy of a monetary reward because the bug couldn't be used to hijack Xbox”, the bug could have allowed hackers to link any Xbox gamer tag to a gamer's real email address. (Pixabay)

Microsoft has patched a bug in the Xbox website that could have allowed hackers to link Xbox gamer tags (usernames) with the users' email addresses. The vulnerability was reported to Microsoft through their Xbox bug bounty program.

One of the security researchers, Joseph “Doc” Harris, who reported the issue to Microsoft, shared his findings with ZDNet. Harris said that the bug was located on enforcement.xbox.com, the web portal where Xbox users “go to view strikes against their Xbox profile” and also file appeals if they feel “they have been unfairly reprimanded for their behaviour on the Xbox network”.

You may be interested in

MobilesTablets Laptops
7% OFF
Apple iPhone 15 Pro Max
  • Black Titanium
  • 8 GB RAM
  • 256 GB Storage
28% OFF
Samsung Galaxy S23 Ultra 5G
  • Green
  • 12 GB RAM
  • 256 GB Storage
Google Pixel 8 Pro
  • Obsidian
  • 12 GB RAM
  • 128 GB Storage
Apple iPhone 15 Plus
  • Black
  • 6 GB RAM
  • 128 GB Storage

Once users log into this website, the Xbox Enforcement site creates a cookie file in their browser with details about the web session. This is done for easier log in the next time and users do not have to re-authenticate details when they log in again.

Also read
Looking for a smartphone? To check mobile finder click here.

Also Read: PS5 users are facing a bug that's preventing them from downloading games, apps

Harris told ZDNet that Xbox Enforcement's cookie file included an Xbox user ID (XUID) field that was unencrypted. This XUID field could easily be edited and replaced with the XUID of a test account as Harris demonstrated with tools that come on all modern browsers. This test account was one that Harris had created for the Xbox bug bounty program.

"Tried replacing the cookie value and refreshing, and suddenly I was able to see other (users') emails," Harris told ZDNet in an interview. He also shared a video of the bug:

Microsoft fixed this bug by encrypting the XUID.

A Microsoft spokesperson said in an email that the fix was deployed on the server-side and added that there are no other steps that users need to take themselves to be protected.

Harris has pointed out that no other Xbox subdomain suffers from the same bug.

According to reports, a security analyst working for Microsoft's Security Response Center said the bug wasn't covered by the Xbox bug bounty program, but Microsoft agreed to feature Harris on their Bug Bounty Hall of Fame as a contributor.

Also Read: Microsoft's latest patch fixes more than 100 vulnerabilities

Microsoft did not classify this bug as “worthy of a monetary reward because the bug couldn't be used to hijack Xbox”, the bug could have allowed hackers to link any Xbox gamer tag to a gamer's real email address.

Linking email accounts to gamers' real-world identities has led to instances of harassment. The fact that most gamers use the same email address for most of their online accounts also helps hackers a lot as is seen in this tweet -

Catch all the Latest Tech News, Mobile News, Laptop News, Gaming news, Wearables News , How To News, also keep up with us on Whatsapp channel,Twitter, Facebook, Google News, and Instagram. For our latest videos, subscribe to our YouTube channel.

First Published Date: 27 Nov, 17:20 IST
Tags:
NEXT ARTICLE BEGINS