Thursday, November 10th 2011
Steam Hack More Severe Than Thought: Change Your Password NOW
Gabe Newell of Valve has issued a statement that the forum hack they experienced over the weekend actually goes much deeper than they thought. The criminals accessed the main database containing such goodies as user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. Apparently, no personally identifying information was taken - but we await the result of the full investigation before breathing a sigh of relief. Due to this serious breach, TechPowerUp advises all Steam users to change their account password immediately. People starting up their Steam client will now see the following message from Gabe Newell about this:
10 November 2011
Dear Steam Users and Steam Forum Users:
Our Steam forums were defaced on the evening of Sunday, November 6. We began investigating and found that the intrusion goes beyond the Steam forums.
We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating.
We don't have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely.
While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login. If you have used your Steam forum password on other accounts you should change those passwords as well.
We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords (which are separate from forum passwords). However, it wouldn't be a bad idea to change that as well, especially if it is the same as your Steam forum account password.
We will reopen the forums as soon as we can.
I am truly sorry this happened, and I apologize for the inconvenience.
Gabe.
127 Comments on Steam Hack More Severe Than Thought: Change Your Password NOW
I think you need a new tin foil hat.
I think you need to posses some brain before you resort to a cheap attack, but at this rate I've no reason to believe you do. ;)
And the reason you state above doesn't even make any sense offhand (at least as related to allowing a hack or whatever it is you are claiming exactly) though regardless it's laughable if that's the best you can do with the likes of Activision, EA and Ubisoft in the industry. You know, publishers/devs who actually DO screw over their customers and deserve such ire...
First off, the number of people who would remake their account and purchase all of their stuff again is small, if not non-existant. It's much more likely those people will go to steam and get their account sorted out if they can't access it. Furthermore, they said the hackers had access to the database that contained your credit card information. Though encrypted, It's much more likely more people will delete their CC off of steam and leave steam because their CC information was exposed than it is for people to buy all their games again. "Hey, this company screwed up and got my CC information exposed, I'm going to buy crap from them again. They obviously deserve my money still" - Yeah, I'm not seeing it.
This isn't a publicity thing to get people, if anything this is a deterrent to using steam. I know what encryption is, and how their service works. I'm not worried, my information is one of millions and millions of users. But the less computer-savvy people out there might look at this and leave because they don't understand what's going on.
The fact that this information was exposed at all is bad and shouldn't be taken lightly. While I wouldn't up and cancel your CC just yet (Though I can't blame you if you do), I would watch your statement and news on this event to keep up to date.
:slap:
As for buying the game again, you don't have to use your CC. You can just buy it off the store and use the key. I'm not concerned about any of this. Even the way Gabe's message is written is cheesy. Like how he's "hacked and truly sorry" about it. No, it's not. Read back the thread, this has been hashed out endlessly. People speculated like "it must be Anon" and such. Again, I repeat, WE can only speculate since we don't have info from the inside. I think you're spouting off nonsense to make yourself look right, fatty. You're being silly. Grow up.
As far as knowing who did it, prove it. Because their advertisement was on the forums? That doesn't mean anything. Some one else could have done it to draw attention to those people as a distraction. You don't know what happened, nor who hacked their database or what they really had access to. Unless, of course, you personally know these hackers? In which case I hope some one comes to question you soon.
I'm not concerned about them getting into "steam", however I think you need to define that term if you're going to continue to use it. The fact is none of us really has any idea how their network is laid out, for all we know they merged the tables containing the forum user data with the account data for some kind of "convenience". We don't know. It seems to me the CC/billing information should be on an internal server that is accessed only when purchasing a game or adding another payment method, and is only accessed through the/an internal steam server acting as a layer to separate the CC information from being directly accessible to the internet (Not some web application tied to a forum created by a third party). Until we know how it's laid out and what layers were broken into, we can't say they didn't get access to it. And to say otherwise is just foolish and and flies in the face of any good consumer security practice. You should be cautious, always. If it turns out to be some false alarm, great, some kids hacked the forum and I don't care. Otherwise, some one at Valve should have their butt on the line for dropping the ball. These companies shouldn't be lacking in security, anywhere.
As for what the CEO says, I have no reason to believe you over him. If he says the encrypted CC information was exposed, why do I have any reason not to believe him? All this does it make negative hype for steam and create a deterrent for using it. Furthermore he didn't say sorry to us because he was hacked, he said sorry because HIS COMPANY (according to his own letter) caused our CC information to be exposed to an unauthorized third party. He was saying sorry to the community for the company failing to do part of it's job, keeping our information secure.
No, you don't have to use a CC to buy a game off of steam. That's not what you said, though. If I went to the store and bought a CD key it kind of defeats your theory of "They are hyping it so valve gets more money from people buying all their games again". Furthermore, I can't think of anyone who would purchase all of their stuff again from a company who screwed up. Seriously, that's some backwards logic. "Oh, their insecure and won't help me get my account back? Sure! I'll buy all my stuff off of your service again" - totally.
As such, VALVe didn't "screw up". Steam is driven off different content servers from all across the globe, unlike the forum which is a vBulletin ran off Washington from VALVe HQ (ping it/look at Steam settings).
You don't know what you're talking about. That's a pretty absurdist statement... also, I assumed it's fkn0wned themselves to take attention (buy their private hacks). It was worded that way, yes, it may be someone else, BUT, Steam is running perfect and please read Gabe's message again. He says "might be/just in case, and we think". He's not sure and is assuming. So it's not to be relied on. Like I said, not everyone thinks that way. Lots of people go on about cheating, getting VAC banned then buying a new game again. VAC for example uses delayed bans (a few weeks) which makes doing that act possible. As such, it's not unnormal to think of some people to buy their games again. The majority of people are uninformed. They'd think like; this account is banned, gone. Have to open a new one. Whenever they can't login in such case. You're thinking of yourself, not the average majority.