Nintendo takes Wii U games 'Mario Kart 8' and 'Splatoon' offline over security issues

engadget.com:

Nintendo has taken Wii U titles Mario Kart 8 and Splatoon offline indefinitely while it attempts to resolve security issues. "This network service is currently unavailable due to urgent maintenance required to fix a vulnerability related to online play," reads a message posted to Nintendo's website at 11:30PM ET on Thursday. "We do not yet have information on when network services can be restored. We apologize for any inconvenience caused."

As VGC notes, the vulnerability could be related to an exploit that allows an attacker to take control of a victim's system simply by way of being matched with them in an online multiplayer game. Dataminer OatmealDome suggested the issue is “almost certainly” due to ENLBufferPwn.

Mario Kart 7 on the 3DS was previously vulnerable to that exploit. Several Switch games apparently were too, including Mario Kart 8 Deluxe, Animal Crossing: New Horizons, Nintendo Switch Sports and Splatoon 2 and 3. Nintendo has seemingly patched all of those titles to protect them against the exploit.

A video posted by YouTuber PabloMK7 in December shows ENLBufferPwn in action on Mario Kart 7. It's used to inject custom firmware onto the targeted console. PabloMK7 wrote on GitHub that "it would be theoretically possible" to steal an account or credit card information and to record a victim using the 3DS' mic and cameras.

With nearly 8.5 million copies sold, Mario Kart 8 was the biggest-selling game on the Wii U. The original Splatoon sold almost 5 million. Those who are still playing the games on the discontinued system might be disappointed that the online features are currently unavailable, but it seems Nintendo was left with little choice but to take them offline for now.

The issue emerged only a few weeks