Microsoft – Microsoft reportedly fixes Xbox bug that would have leaked person e mail IDs via gamer tag- Know-how Information, Firstpost

FP TrendingNov 30, 2020 13:12:16 IST

Microsoft has patched a bug within the Xbox web site that would have led risk actors to hyperlink Xbox gamer tags to the actual e mail addresses of the customers. In response to a report by ZDNet, the vulnerability was reported lately to Microsoft via the corporate’s lately launched Xbox bug bounty program. In an interplay with ZDNet, Joseph ‘Doc’ Harris, one of many a number of safety researchers who reported the problem to Microsoft, acknowledged that the bug was situated on enforcement.xbox.com, the net portal the place Xbox customers go to view strikes in opposition to their Xbox profile and file appeals in the event that they really feel they’ve been unfairly punished for his or her behaviour on the Xbox community.

As per the report, as soon as customers log in to the web site, the Xbox Enforcement web site creates a cookie file of their browser replete with particulars about their internet session in order that the gamer doesn’t need to re-authenticate the subsequent time they go to the location once more.

Harris revealed that the portal’s cookie file contained an Xbox person ID discipline that was unencrypted. Harris, subsequently edited the XUID discipline and changed it with the XUID of a take a look at account he created and had used for testing as a part of the bug bounty program.

A Microsoft spokesperson revealed that the repair was deployed server-side and there aren’t any extra steps that customers should be taken to remain protected.

As per the report, a safety analyst working for Microsoft‘s Safety Response Centre, which trials bug stories, revealed that the bug was not coated by the Xbox bug bounty program, however the firm nonetheless agreed to characteristic Harris on its Bug Bounty Corridor of Fame as a contributor.