STEAM HACKED - CHANGE YOUR PASSWORD !

T4HO · 26 Jul 2015 at 02:38

So I snoop around the internet why my account wasn't working and I have found that there was the exploit which allowed anyone knowing your account name on steam to restart the password without using the e-mail. The bug is fixed from what I can tell.

So guys change your passwords and additionally set-up 2-way factor authentication by using smartphone app.

Bloomfield · 26 Jul 2015 at 10:46

If my password still works why would I need to change it?

On Holiday · 26 Jul 2015 at 10:51

Bloomfield said:
If my password still works why would I need to change it?

This..

But yeah, everybody should be using 2-step for everything that supports it anyway.

NO PASSWORD CHANGE REQUIRED. JUST MAKE SURE YOU HAVE STEAM GUARD ENABLED.

Unless you've been received Steam Guard authentication emails in which case, yeah, you do need to change your password.

Glanza · 26 Jul 2015 at 10:59

If you've got steam guard enabled wouldn't that have stopped them?

On Holiday · 26 Jul 2015 at 11:50

Glanza said:
If you've got steam guard enabled wouldn't that have stopped them?

I imagine it would have, but then I question why these big streamers would have steam guard disabled.

T4HO · 26 Jul 2015 at 12:09

Glanza said:
If you've got steam guard enabled wouldn't that have stopped them?

From what I know that they still were able to change your password regardless if you had steam guard turned on or off as password recovery is done by e-mail anyway so if they changed your password and you have steam guard turned on they couldn't simply login into your account as they needed the code sent by SMS.

Archeum said:
I imagine it would have, but then I question why these big streamers would have steam guard disabled.

Most of the Celebrities either on Internet (KSI for instance) or real life like Taylor Swift etc needs to be educated more towards computer security as they don't give a damn about it at all I would say.

PsychoPigeon · 26 Jul 2015 at 12:09

can't believe how simple it is, how did it not get picked up

Vulcan · 26 Jul 2015 at 12:09

Archeum said:
I imagine it would have, but then I question why these big streamers would have steam guard disabled.

Such as? But I'm guessing it's because they are stupid.

T4HO said:
From what I know that they still were able to change your password regardless if you had steam guard turned on or off as password recovery is done by e-mail anyway so if they changed your password and you have steam guard turned on they couldn't simply login into your account as they needed the code sent by SMS.

So they still couldn't login, so Steam Guard did it's job?

Vinno · 26 Jul 2015 at 12:20

I'm sick of changing my passwords for things. It seems like it's almost a weekly occurrence that something gets hacked or leaked.

I won't be doing it this time seen as everything seems to be in order and I have the steam guard thing set up anyway.

Very odd how such a simple exploit was allowed to slip through the net though lol.

arknor · 26 Jul 2015 at 12:23

so why do I need to change my password? and how was valve hacked?

can he op has a temp ban for misleading daily mail thread topic?

On Holiday · 26 Jul 2015 at 12:24

Longbow said:
Such as? But I'm guessing it's because they are stupid.

Such as.. Sodapoppin for example, he's been hacked enough times (through no fault of his own) to know he should have Steamguard enabled.

KIA · 26 Jul 2015 at 13:41

Proof?

T4HO · 26 Jul 2015 at 13:42

Longbow said:
So they still couldn't login, so Steam Guard did it's job?

Yes, since you have turned 2 way verification via Steam Guard you should be alright. They shouldn't be able to login into your account even if they change the password as two way verification sends you short code via SMS which later on you must input into textbox field to get access to your account. Here it is how does it actually works:

https://blogs.zoho.com/wp-content/uploads/2013/12/zoho-two-factor-authentication1.png

No hotlinking of images, if you want to post an image please rehost on your own webspace. Thank you.

but if you didn't had two way verification and someone knows your steam account name and try to hack your account you are basically ****ed just like the streamers, lol.

Vinno said:
I'm sick of changing my passwords for things. It seems like it's almost a weekly occurrence that something gets hacked or leaked.

I still laugh at Ashley Madison hack from few days back, it's funny as hell, lol. I guess it's how does technology goes, someone makes a system with pretty good security or screw up a simple thing like the one with Steam and hacks goes from left to right. The one witch good security usually got fixed immediately tho.

arknor said:
can he op has a temp ban for misleading daily mail thread topic?

LMFAO ...

. . . . . . . . . . . . . . . . . . . ________
. . . . . .. . . . . . . . . . . ,.-‘”. . . . . . . . . .``~.,
. . . . . . . .. . . . . .,.-”. . . . . . . . . . . . . . . . . .“-.,
. . . . .. . . . . . ..,/. . . . . . . . . . . . . . . . . . . . . . . ”:,
. . . . . . . .. .,?. . . . . . . . . . . . . . . . . . . . . . . . . . .\,
. . . . . . . . . /. . . . . . . . . . . . . . . . . . . . . . . . . . . . ,}
. . . . . . . . ./. . . . . . . . . . . . . . . . . . . . . . . . . . ,:`^`.}
. . . . . . . ./. . . . . . . . . . . . . . . . . . . . . . . . . ,:”. . . ./
. . . . . . .?. . . __. . . . . . . . . . . . . . . . . . . . :`. . . ./
. . . . . . . /__.(. . .“~-,_. . . . . . . . . . . . . . ,:`. . . .. ./
. . . . . . /(_. . ”~,_. . . ..“~,_. . . . . . . . . .,:`. . . . _/
. . . .. .{.._$;_. . .”=,_. . . .“-,_. . . ,.-~-,}, .~”; /. .. .}
. . .. . .((. . .*~_. . . .”=-._. . .“;,,./`. . /” . . . ./. .. ../
. . . .. . .\`~,. . ..“~.,. . . . . . . . . ..`. . .}. . . . . . ../
. . . . . .(. ..`=-,,. . . .`. . . . . . . . . . . ..(. . . ;_,,-”
. . . . . ../.`~,. . ..`-.. . . . . . . . . . . . . . ..\. . /\
. . . . . . \`~.*-,. . . . . . . . . . . . . . . . . ..|,./.....\,__
,,_. . . . . }.>-._\. . . . . . . . . . . . . . . . . .|. . . . . . ..`=~-,
. .. `=~-,_\_. . . `\,. . . . . . . . . . . . . . . . .\
. . . . . . . . . .`=~-,,.\,. . . . . . . . . . . . . . . .\
. . . . . . . . . . . . . . . . `:,, . . . . . . . . . . . . . `\. . . . . . ..__
. . . . . . . . . . . . . . . . . . .`=-,. . . . . . . . . .,%`>--==``
. . . . . . . . . . . . . . . . . . . . _\. . . . . ._,-%. . . ..`\

TheVoice · 26 Jul 2015 at 13:47

They weren't "hacked" and I won't be changing my password.

mortals · 26 Jul 2015 at 14:03

T4HO said:
So I snoop around the internet why my account wasn't working and I have found that there was the exploit which allowed anyone knowing your account name on steam to restart the password without using the e-mail. The bug is fixed from what I can tell.

So guys change your passwords and additionally set-up 2-way factor authentication by using smartphone app.

arknor said:
so why do I need to change my password? and how was valve hacked?

can he op has a temp ban for misleading daily mail thread topic?

exactly this^^

There was/is a 0day which allows a hijacker to bypass steamguard (I contacted steam regarding it in April with full malware analysis & links to the source)
This however required the client to install malware (which in this case was a teamspeak installer with the malware)

So the whole "STEAM HACKED - CHANGE YOUR PASSWORD !" seems a bit wrong

"allowed anyone knowing your account name on steam to restart the password without using the e-mail"
Also seems unlikely (without first infecting the target machine)

update: just wanted to add that the malware found was also sent to antivirus vendors and is now detected by most (22 / 56 on virustotal)

FloppyPoppy · 26 Jul 2015 at 14:11

People who wonder how they get infected with this sort of **** and how there ID's get robbed.

This is how they get hacked.

10/10 LEGIT no hacks promise XD

Bloomfield · 26 Jul 2015 at 14:51

mortals said:
exactly this^^

There was/is a 0day which allows a hijacker to bypass steamguard (I contacted steam regarding it in April with full malware analysis & links to the source)
This however required the client to install malware (which in this case was a teamspeak installer with the malware)

So the whole "STEAM HACKED - CHANGE YOUR PASSWORD !" seems a bit wrong

"allowed anyone knowing your account name on steam to restart the password without using the e-mail"
Also seems unlikely (without first infecting the target machine)

According to a youtube video I looked at it was true, just google "steam hacked" and it should be the youtube video at the top under the "in the news" section.

I'd explain it, since it only takes one sentence to do, but the mods removed it from the OP already

.

All you needed was the account name.

mortals · 26 Jul 2015 at 15:06

Bloomfield said:
According to a youtube video I looked at it was true, just google "steam hacked" and it should be the youtube video at the top under the "in the news" section.

I'd explain it, since it only takes one sentence to do, but the mods removed it from the OP already .

All you needed was the account name.

The video looks fake

Good way to get views/likes tho I guess.

If the thread was about that video, how does a pw reset bug equate to "STEAM HACKED" and also how would changing your password help anything? :confused:

Bloomfield · 26 Jul 2015 at 15:27

Vulcan · 26 Jul 2015 at 15:53

T4HO said:
LMFAO ...

Why are you laughing at him? He's completely right. Passwords were never leaked so they do not need changing, unless you cannot login in.

Valve have enough security in place to take advantage of. If someone has gained access to your account, it's your fault.

Also you're talking about Steam Guard Mobile Authenticator, Steam Guard sends an e-mail, not SMS.