An analysis of security vulnerabilities of the Xbox 360 and Xbox Live mobile network

Living Room Connected Devices: Opportunities, security challenges and privacy implications for users and industry

“…this method may already be employed by cybercriminals (Engebretson et al 2013). While managing data storage is a standard and relatively straightforward feature of all major games consoles, we did not find evidence whether UK users are aware of the simple methods that exist to delete personal data from games consoles.…”

“…While our research was only able to uncover one study, conducted by a team of university researchers led by Engebretson (Engebretson et al 2013), into the ways in which cybercriminals could exploit LRCDs as means to commit identity theft or fraud, it seems likely that games consoles will constitute particularly attractive means to such criminals due to the associated potential for resale. Specifically, Engebretson and his colleagues (2013) suggest that the emerging second-hand games console market has the potential to lead to rising rates of identity theft.…”

“…Engebretson and his research team (Engebretson et al 2013), for example, have reported that in early 2012 cybercriminals gathered gamer tags (i.e., individual online gamer signifiers) from the Xbox online gaming platform, Xbox Live, and were able to extract user information of Xbox live account holders, including credit card details and account information for other online services. Their study (Engebretson et al 2013) further reports that this was accomplished by searching for similar tags on the Internet and rapidly testing password combinations. The compromised accounts were then hacked to enable fraudulent purchases.…”

“…Often a single authentication can prove identity to several services. For instance, academic security researchers Engebretson et al (2013) discovered that once a user accesses their Xbox Live service, messages sent from their account are assumed to be from that particular user. While these features are useful in supporting service usability (the argument is made that re-authentication for every action would be inconvenient), they also rely significantly on a single approach to delivering security.…”

“…For example, the instructions for Sony's update process for its Bravia range of TVs describe a complex and irreversible range of steps involving downloading an update to the firmware to a USB drive, extracting the file and then installing it . However, as pointed out by information security researchers Engebretson et al (2013), the frequency and availability of these patches may not be consistent across devices. Their efficiency, however, also depends on the willingness and skills of users to update and install more secure software or update the settings on their devices.…”