Steam compromised

[Omgwtfbbqkitten]

Re: Steam compromised

Lulzsec hacked Nintendo, MS, Sony and several others early last year after the Anonymus PSN hack. The point was to see not only if they could be compromised but the user information was protected.

Nintendo has MyNintendo.com and the various Ware Shops along with the eShop. Lulzsec couldn't compromise any credit card data because the data is wiped when the transaction is complete on Nintendo's services. Even after the November update, the CC info is only saved on the client side of the transaction, which can't really be hacked at all. NIntendo's system still wipes the info on their in upon transaction. In Nintendo's case its a system that is seemingly behind the times, but 100% effective all the same. The transaction is encrypted and wiped as opposed to Sony's unencrypted and stored on their network. At least, that's how Sony's was until they got caught with their pants down.

Also, Feba, Nintendo Network is the new initiative. Theatrhythm and Fire Emblem are the first games utilizing the network - launching soon in Japan - getting DLC and such. Iwata detailed the goals of the network just two weeks ago. From the sounds of it, its in the ballpark of what Live and PSN... er... Sony Entertainment Network (sorry, lame new name to adjust to), but they're looking to have retail offerings online simultaneous to physical releases for both Wii U and 3DS.

No date was set on when it actually starts up, but both Fire Emblem and Theatrhythm are slated for March in Japan, so its lanching soon there.

[Feba]

Re: Steam compromised

How on earth could anyone compromise Nintendo's online network? They would need to have one first

[Malacite]

Re: Steam compromised

....... -,- I wonder if it is the same group that is hacking all the companies....

Anonymous said they did the PSN.... but then after that SE again, PSN 2 more times, and then XBLIVE and now Steam -.- this is getting ridiculous

you forgot SEGA & Microsoft, they got nailed too and I think even Nintendo a little while back.

[Taskmage]

Re: Steam compromised

A minor update on this was posted today: News - Message from Gabe to Steam Community

Dear Steam Users and Steam Forum Users:

We continue our investigation of last year's intrusion with the help of outside security experts. In my last note about this, I described how intruders had accessed our Steam database but we found no evidence that the intruders took information from that database. That is still the case.

Recently we learned that it is probable that the intruders obtained a copy of a backup file with information about Steam transactions between 2004 and 2008. This backup file contained user names, email addresses, encrypted billing addresses and encrypted credit card information. It did not include Steam passwords.

We do not have any evidence that the encrypted credit card numbers or billing addresses have been compromised. However as I said in November it's a good idea to watch your credit card activity and statements. And of course keeping Steam Guard on is a good idea as well.

We are still investigating and working with law enforcement authorities. Some state laws require a more formal notice of this incident so some of you will get that notice, but we wanted to update everyone with this new information now.

Gabe

[Aeni]

Re: Steam compromised

And to be fair, it wasn't Steam itself that was hacked. The only way you're likely to be in any danger is if you used the same username and pass for both Steam and its forum, which is bad security practice in the first place but probably extremely common.

---------- Post added at 08:39 PM ---------- Previous post was at 08:37 PM ----------

Actually, reading it again I may have misinterpreted that.

It wouldn't even matter. Some of the moderators were probably employees of Valve's network operations (e.g. Steam) and had likely registered with their work email, namely that of Valve's domain signature. Thus, it stands to reason, that you can take that and attempt to log-in through the more sensitive areas of the site with these credentials. And we all know that, despite all warnings and education, people will end up being lazy and use 1 password for pretty much a lot of what they do. That's the lucky break that would be the compromise (or at least one scenario)

We still don't know if they also were able to drop a back door with root access into the servers. I think part of the reason why the forums are still down is that they are trying to track back where information are being transmitted to and I wouldn't be surprised if they got the Feds involved as well. Also of importance for them is to nail down any zero-day exploits and malware/trojans.

[Raydeus]

Re: Steam compromised

Jormy looks constipated... did you feed him Time Mage hats (again)?

[Taskmage]

Re: Steam compromised

Customer Complaints Department

[Raydeus]

Re: Steam compromised

MPK button?



PS > And it seems still nothing so far about problems outside the forums, encrypted passwords are encrypted.

[Yygdrasil]

Re: Steam compromised

So, what did Tasky do this time?

This is why we need an UN-Thank button. It should give negative forum experience points.

[Raydeus]

Re: Steam compromised

So, what did Tasky do this time?

[Taskmage]

Re: Steam compromised

And to be fair, it wasn't Steam itself that was hacked. The only way you're likely to be in any danger is if you used the same username and pass for both Steam and its forum, which is bad security practice in the first place but probably extremely common.

---------- Post added at 08:39 PM ---------- Previous post was at 08:37 PM ----------

Actually, reading it again I may have misinterpreted that.

[Icemage]

Re: Steam compromised

Well at least they had encryption and didn't wait like two weeks to tell everyone about it. You know, unlike a certain network.

Actually the time frame was pretty similar. Sony discovered PSN was hacked on April 20, announced it on April 26.

Valve's forums were hacked on November 5, and they announced this today on November 10.

The primary difference is that (for now at least) Steam remains online and operational.

Gabe even broke the news himself. Just further proof Valve is a class act.

There we agree.


Icemage

[Omgwtfbbqkitten]

Re: Steam compromised

Well at least they had encryption and didn't wait like two weeks to tell everyone about it. You know, unlike a certain network. Gabe even broke the news himself. Just further proof Valve is a class act.

[Icemage]

Re: Steam compromised

True story: Had a guy who claims to be a hacker try to recruit me last week. Pretty surreal.

I can remember a time many years ago when the hacker community was more like the International Brotherhood of Magicians. Secrets were just that - secrets - passed or traded carefully from one member to another, and there wasn't this sort of widespread desire for infamy and/or monetary gain.

Nowadays, hackers come more often in one of two flavors: internet trolls on steroids, or more nefarious scum motivated by greed (read: usually organized crime).

This doesn't mean that there isn't an elite cadre of hackers out there who still operate more like a secret society than Amway, but they're definitely in the minority these days.


Icemage

[Kailea]

Re: Steam compromised

....... -,- I wonder if it is the same group that is hacking all the companies....

Anonymous said they did the PSN.... but then after that SE again, PSN 2 more times, and then XBLIVE and now Steam -.- this is getting ridiculous