11 ms·

Steam loses user database

386 points by taylorbuley 15y ago

primesuspect 15y ago
And suddenly it's a bad day at Valve :(
- DiabloD3 15y ago
  And there goes HL2:Ep3 for another year.
theDoug 15y ago
I'm a Steam user, Steam forums user, and Valve customer and have received no email or notification. This story may not be as all-encompassing as it appears.
- elliottcarlson 15y ago
  Same here - no email received (and checking with co-workers, neither have they)
  - joshuacc 15y ago
    I haven't received an email either.
- jarquesp 15y ago
  Same here, I haven't gotten any email from Steam. Luckily I also don't have my CC number on my account since I use PayPal. I also enabled authentication via email a while ago so it sends me a code to log in. I guess it's a good idea to change your password and check CC statements either way.
  - Keyframe 15y ago
    Paypal here too. For situations like these I've opted to use paypal on steam and psn cards on psn. Now I'm glad I did, because both were compromised.
- jigs_up 15y ago
  They have a lot of users to email, maybe it's coming? I still haven't anything either.
- deleted 15y ago
  [deleted]
- zokier 15y ago
  Steam forums have that same message on their front page.
- primesuspect 15y ago
  It's been confirmed on Steam forums. The letter said the messages will go out via Steam IM.
- mdmalinowski 15y ago
  I just opened up the Steam app and it displayed that message from Gabe.
- dholowiski 15y ago
  I haven't gotten the email either, but if the user database, including your email address and personal information has been stolen I would be _highly_ suspicious of any email I receive from Steam
  - uxp 15y ago
    Another "me too" to the haven't received notice of this yet, however a link over at r/gaming on Reddit points to this screenshot of the standard Steam Update News splash that pops up every time you login to the Steam Client. http://i.imgur.com/EcEUJ.png http://i.imgur.com/EcEUJ.png
- dylangs1030 15y ago
  NB: This email is in the works, it didn't mean it was already sent out. The audience reading this is full of Steam users, so part of the point of the article is forewarning before that email is sent out. But yes, the message is displayed on the front page of Steam as well.
- ahlatimer 15y ago
  FTA: "Today a message will be going out to all Steam users." I assume "will" means that it hasn't been sent, yet, but it will be at some point in the future. I haven't gotten one either, FWIW.
- stonemetal 15y ago
  I haven't gotten an email but the pop up with new offers from steam displayed it a few minutes ago for me.
- Natsu 15y ago
  Fortunately, I have my account registered with a spamtrap email address, a username/password that I have never used elsewhere, and a very low limit credit card. Yeah, I'm glad I know better than to use a debit card. I'll be watching to see if anyone starts spamming me, because that spamtrap email is unique to my Steam account and has not been published elsewhere. Guess it pays to be paranoid.
  - bh42222 15y ago
    Fortunately, I have my account registered with a spamtrap email address, a username/password that I have never used elsewhere, and a very low limit credit card. Same here. But I am a bit sad that my paranoia has been confirmed yet again.
    - MichaelApproved 15y ago
      Doesn't it stop being paranoia if you are correct?
      - Natsu 15y ago
        It's a matter of perspective. To most others, this still appears are paranoia. But I wouldn't be doing it if my experience didn't say that such problems occur far too often.
Aqwis 15y ago
I have not received a mail.
- estel 15y ago
  Nor I, but I imagine it just takes a little while to send tens of millions of emails.
starnix17 15y ago
At least they're honest about it, compare this to the PS3 compromise.
orblivion 15y ago
Wait, why would I change my Gmail password?
- DiabloD3 15y ago
  Because a lot of people use the same password everywhere. I really really really wish they wouldn't.
  - orblivion 15y ago
    Ok, so if I don't do this I should be fine. I think the guy should have qualified his statement. Thanks.
  - Silhouette 15y ago
    As long as we routinely use dozens of services that rely on "memorable" data to authenticate us, this is as inevitable as people who try to use different passwords for everything writing them down. Password stores are one possible improvement, but most people don't know enough to use one, and they are probably far too fiddly for most people anyway. And of course, ultimately you're still talking about using a single set of credentials to authorise everything in that case, it's just a different target (which if ever compromised will undermine your entire identity). Multi-factor authentication is a much better solution, but the technology to make it ubiquitous in a way that is neither excessively expensive nor creepy on privacy grounds isn't there yet. There are some problems in security that we know how to solve, at least to the extent that no-one has any idea how to crack them directly today and the effort to brute force them is effectively infinite. I'm really hoping that one of these days, the combination of mobile technology and the Internet will provide us with an easily portable device that can integrate with everything and render obsolete the current mess of hundreds of on-line identities, "memorable data" to authenticate for every financial service I use, etc.
- karteek 15y ago
  A lot of users tend to use same password for various accounts. So, if the hacker gets one password, it means he can gain access to other accounts owned by the user.
estel 15y ago
I'd find it reassuring in times like this if company's could post details of how securely they hash and salt user passwords. It'd be good to know...
defen 15y ago
Just yesterday I received a notification from Facebook that my account had been accessed from a suspicious location and was locked as a security precaution. I had no idea how this could have happened, but I did have the same email address + password for Steam and Facebook. Hardly proof, but certainly a plausible theory.
- mburns 15y ago
  http://keepass.info/ http://keepass.info/ - It is easy to have unique, complex passwords for each and every service. And with Dropbox (or kin) you can sync to iPhone, Android, Mac, Linux or Windows. Plus plugins for browsers to make easier.
  - timerickson 15y ago
    Is there a Mac equivalent?
    - AdamGibbins 15y ago
      KeePassX works on OSX. https://www.keepassx.org/downloads https://www.keepassx.org/downloads There's also others like 1Password that are popular on OSX.
      - shaggyfrog 15y ago
        I use 1Password in conjunction with Dropbox to keep my passwords secure and synced between OS X, Windows (XP and 7) and iOS. It's a fantastic product.
    - aiscott 15y ago
      I use splashid. Not free but it works and they have an iPhone version. I also believe an older version of keepass was ported to Mac with the name KeePassX. Edit: typo
    - Terretta 15y ago
      1Password, which also is a Windows and Android equivalent: https://agilebits.com/onepassword https://agilebits.com/onepassword
machinespit 15y ago
no email, but the forum page shows the message: http://forums.steampowered.com http://forums.steampowered.com
jcapote 15y ago
Confirmed by Gabe here: http://au.pc.ign.com/articles/121/1212201p1.html http://au.pc.ign.com/articles/121/1212201p1.html All passwords are salted and hashed (hope they are using bcrypt), and all CC's are encrypted. EDIT: updated comment to clarify what I meant with the bcrypt
- verroq 15y ago
  Whatever encryption for CCs, I think its going to have to be reversible or there wont be any point of storing them.
  - orblivion 15y ago
    Unless they keep the keys somewhere unrelated?
    - jasonlotito 15y ago
      The keys generally aren't kept anywhere. In fact, the encryption keys for a company valve's size should be split among multiple key company officials. The idea being, you should be able to steal the box that contains the credit card data and/or the machine that does the actual encryption and not have access to the keys (which, technically, aren't stored anywhere).
  - rapind 15y ago
    One technique is to store another string (a pepper) outside of the database (assuming the salt is stored with the records) which is used along with the salt to encrypt each password. This way, if only the database is compromised, and not the config file or env variable holding the pepper you're in better shape.
    - jaequery 15y ago
      if they got to the database!, what makes you think they didn't get to the app server?
dabit 15y ago
Wait, how do you change your Steam password?
- nchaimov 15y ago
  This took me a while to figure out. You have to open the Steam client, go to Settings (in Windows) or Preferences (in Mac OS X) and click the change password button in there under the Account tab.
  - inportb 15y ago
    What if you don't have (or can't use) the Steam client?
    - Natsu 15y ago
      I don't think you can access your account at all without the client? At least, none I know of. Forum accounts are separate, after all.
- dholowiski 15y ago
  Has the site been secured yet? Would it be wise to change your password before there is confirmation that steam's site is safe? Instead I would change the password on any other accounts that use the same password as your steam account.
Karunamon 15y ago
:( Very sad.. but I suppose it was just a matter of time. At least the CC and passwords were protected correctly.
callmevlad 15y ago
The title seems to be very misleading. There is a big difference between losing a user database (all user info gone, no backups, can't log in, etc) and database information being compromised (information leaked, fraudulent activity, etc).
- skeletonjelly 15y ago
  Agreed. Assumed this was going to be a story of data loss, and how they have good backups and managed to restore with no problems. This is unfortunately much graver.
elliottcarlson 15y ago
"While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login." I am assuming here that this means certain passwords were cracked at that point - does this mean that the nonce/salt in their password storage was discovered? And how long until they have a cracked user/password file?
danilocampos 15y ago
I admire the absolute hell out of Valve and have for a long time. Gabe Newell is, for my money, the biggest mensch in tech. Let's take a moment and look at how this was handled: The message communicates exactly what happened in clear terms that don't try to cover anyone's ass. They explain which data was compromised and the potential implications. No double-talk. This could be an email you got from a friend or colleague. The message conveys Valve's hope that the credit cards are secure but makes clear that users should be nonetheless vigilant about watching for suspicious activity. Just in case. The message is signed by the head honcho of the company. Not some communications or PR weasel. It's in your inbox, not on some obscure blog. Finally, it closes with: "I am truly sorry this happened, and I apologize for the inconvenience." Accepting responsibility, acknowledging that it's a fuckup, and showing some empathy for the fact that this completely sucks for their customers. Sony, Adobe and their ilk could learn a lot from this company.
- ltamake 15y ago
  I absolutely agree. I would rather be told the bad news with all the facts than a sugar-coated "oh-we-were-hacked-but-its-not-our-fault-and-you-customers-are-screwed" response.
- sdkmvx 15y ago
  You are absolutely right, and I really appreciate this from Valve. There is only one thing that would have made it better: even more info. He says passwords were "hashed and salted." This could be anything from the naïve MD5(pass+salt) to the more secure bcrypt or PBKDF2. Now, I have every reason to believe that Valve is smart enough to not use methods like the first, but information is always welcome in a scenario like this. There should be no reason to hide your cryptography method provided that it is secure. > Sony, Adobe and their ilk could learn a lot from this company. And unfortunately they won’t listen…
  - Duff 15y ago
    The issue may be more complex. Steam has been around for awhile now -- there may be an Amazon.com like issue where new passwords are secure, but older passwords are using crypt or something!
onosendai 15y ago
For the last 7 years or so of making payments online I've had an iron clad rule which I have yet to break: only use one time credit card numbers with a low spending limit which are provided on demand by my bank. It's a service tailored specifically for working around the problem of having your CC details stored indefinitely on poorly secured databases of every two-bit company out there. And with each major (and minor) data breach I'm more happy I use it.
- dholowiski 15y ago
  Have you ever investigated in depth how much security one-time credit card numbers give you? I ask because my Paypal account was compromised last month. I cancelled my credit card, but Paypal was still able to refund money to my card even though the number was no longer valid. Also, I had pre-ordered but not paid for an iPod touch. When the touch shipped, my credit card was billed even though the old number had been cancelled, and the new one had not been activated yet.
  - DougWebb 15y ago
    One-time account numbers and cancelled/changed account numbers protect you from money going out, not money coming in. You can always get refunds.
  - X-Istence 15y ago
    I have used the one time numbers that my Bank of America card creates and have had to retire a few due to breaches and after they were retired I got a call asking me if I had authorised another charge to that now defunct account number, and I said no, so they didn't let the charge through. I know for example that credit cards with expiration dates can still be charged for a couple of months after the expiration so that users who have not had the chance to update recurring services have more time to do so. Also, it is entirely possible that Apple had placed a hold on your account for the money and when it finally shipped it went from a hold to actual transaction and that is why it was still allowed through.
    - 15y ago
shocks 15y ago
I am a Steam user, I did not receive an email. If you are a Steam user I would recommend using the two-step verification process they have. It uses a password sent to your email to verify you when logging in using a new computer. Hopefully you're Steam and associated email passwords are not the same. This is, of course, no replacement to changing your password - you should definitely do that - but allows us to relax a bit in case something similar happens again.
Margh 15y ago
Am I the only one who thinks that "Steam loses user database" isn't quite the same as "Steam database of salted data compromised"? For a moment there I thought all my Steam purchases were, you know, lost.
- deleted 15y ago
  [deleted]
cheald 15y ago
> "While there is no evidence that passwords and credit card information have been compromised, with the state of encryption cracking, it should only be a matter of time (and horsepower)." Um. What? Assuming that a PCI-compliant level of encryption was used, "matter of time" is "heat death of the universe" if you don't have the encryption keys.
- awm 15y ago
  I'm assuming they refer to somebody breaking the encryption algorithm, not brute-forcing their way through them.
  - cheald 15y ago
    You don't just "break the encryption algorithm". If the people holding the database can get through AES-256 or 128-bit triple DES, the internet as a whole has far bigger problems than Steam's database being compromised. This isn't CSI. You don't just throw encrypted text at an implausibly attractive IT guy and wait for him to furrow his brow, declare that it's military-grade encryption that will take him a little while, and then have him decrypt it by the end of the next commercial break. PCI-compliant encryption is the sort of thing that, barring incredible leaps in technology or the discovery of a significant algorithmic weakness, will never be crackable in our lifetime.
    - jasonlotito 15y ago
      Keep in mind he was referring to credit card information, not the credit card number. He mentions this here: "We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked." By credit card information, he's referring to address and name, for example, which, at last check (earlier this year) didn't necessarily require encryption. That the information had encryption is a good sign.
    - billswift 15y ago
      >will never be crackable in our lifetime. You might want to rethink this. "Will probably not be crackable in the next twenty years" is more realistic.
Hrundi 15y ago
How could they get to the [salted|hashed|whatever] payment data from hacking the forum? Why is the payment data even remotely linked to the forum software? Ok, the forum may need data from the account for validation, display name or else. You can still implement it securely. This is a big human oversight over what seems to be an insecure implementation. I just can't believe this. I would have guessed they learned the lesson from when Gabe was hacked through an Outlook vulnerability (with the HL2 code leak afterwards). It should have made a paranoid out of him. I think having chosen Paypal as a payment method was perhaps helpful for me. PS: I do own a lot of games and I very much like the platform. I definitely don't have anything against them. They presented a good notice, their high level of responsibility over this incident is irrefutable. Also, props for them for having an encryption for their preloaded games that wasn't broken so far. edit: formatting
- zerovox 15y ago
  This seems to be the first fair response. Sure, they handled it quite well, the letter is well written, but they still seem to have handled the data very poorly. Just because one is a huge fan of the brilliant service(which I certainly am), doesn't mean their poor security should be overlooked. Given the huge problem Sony has had recently, I would have thought other games companies would have been re-evaluating their data's security.
- daxelrod 15y ago
  Forum accounts are not linked to Steam accounts at all. The fact that the first sign of the intrusion was in the forum software doesn't necessarily mean it originated there. It's certainly possible that their entry point was the forum software, but simply compromising a forum account wouldn't be enough to compromise a Steam account.
- Torn 15y ago
  I don't think they are related. To me, it sounds like Steam was hacked on a number of vectors by people going after it specifically, the same way Sony was gone after.
xyzzyz 15y ago
I am gay.
ktusznio 15y ago
I am finding it pretty difficult to change my Steam password. Where the hell do you do it?
- nathanhammond 15y ago
  To change your Steam Account password do it from inside the preferences menu in the standalone application. The interface for changing your Steam Forums password is not currently available.
jccodez 15y ago
You are loosely using the term lose. I lose things when I can no longer find them.
dagnation 15y ago
so far beyond not good. Is nothing safe?
dvdhsu 15y ago
I've spent the last half hour trying to find my billing information on the Steam site. I just can't find it. It's great that Steam is letting me know that their database has been hacked. It's not so great when I can't even see if my billing information or credit card number (I obviously only want the last four digits) that Steam currently has on file for me. If I knew which credit card I had used with Steam, I could probably watch out for fraudulent charges. As it stands, there is no way for me to figure out what information I've given to Steam in the past. Arg.
- weaksauce 15y ago
  If it bothers you too much you can always buy a super cheap $1 game and see which card the charge hits. The pending charge should hit within a day and you don't need to worry too much after that.
- Lurkin 15y ago
  Go to steampowered.com and log in. Click the drop-down (Usernames' account) in the upper right corner and then Account details. The last four digits of your CC should be listed under "Your Steam Account" on the right.
giulivo 15y ago
It wouldn't have been a big issue, but they should have never ever save the credit card informations on a db. I don't know what makes people so confident they can save others credit card on a db. I would rather prefer to repost the needed details for every purchase.
tjoff 15y ago
I get the impression that credit card information is stored in the same database as login information etc. Why? My first thought is that it should be stored on, and never leave, a completely separate system where you have a very limited number of interactions available (reducing the attack vector and making it much easier to spot suspicious activity). I.e. Charge customer x with y for game z. Refund customer for purchase i (only valid within the refund-period). Add(overwrite)/delete customer data. Where all interactions must be signed. And nothing more. Anything less than that and I'm skeptical as to whether you could be considered careful of you customers data. Storing credit card information in the same database as all other user data for a service like steam should be a crime and if it's closely coupled with the forum it's even worse (not that I know if that's the case). Disclaimer: I don't know any details about this incident more than that Valve seems to be open about it taking place (great!).
- jmelloy 15y ago
  Our architecture has a front-end database and a billing database. The credit card number is stored in the billing database, and the details such as the billing address, expiration, etc are stored in the front-end database, since they need to be readable/updatable by the website. I imagine they're similar.
brunnsbe 15y ago
It wluld be interesting to find out how they noticed that someone had stole the data. I guess there must be lot of aggacks that don't get caught.
jamesgeck0 15y ago
One nice thing about the Steam client software (and store website) is that it uses two factor authentication. The first time you log in on an unfamiliar machine, you have to input a code which is emailed to you. Even if your Steam client and forum passwords were the same, your client account still secure as long as your email password is different.
tuacker 15y ago
It's worth noting that as far as I know Steam Guard is active for any user who didn't disable it. Meaning, if someone tries to log in to your Steam account on a device that isn't yours (both via the client and on the website) he'll get a prompt to enter a 4 char long code which is sent to your authorized email address. So your Steam account is save. Your email address probably isn't a secret anyway. The password is changed in a second. Which leaves your payment (encrypted) and billing info. Personally I use Click&Buy which requires a separate authorization from me and I'm actually not sure if I have any billing address associated with Steam. So for me this whole thing is just a minor annoyance in changing my password. Obviously I might treat the obtained user data different from other people.

386 points by taylorbuley 15y ago

primesuspect 15y ago

And suddenly it's a bad day at Valve :(

DiabloD3 15y ago
And there goes HL2:Ep3 for another year.

theDoug 15y ago

I'm a Steam user, Steam forums user, and Valve customer and have received no email or notification. This story may not be as all-encompassing as it appears.

elliottcarlson 15y ago
Same here - no email received (and checking with co-workers, neither have they)
- joshuacc 15y ago
  I haven't received an email either.
jarquesp 15y ago
Same here, I haven't gotten any email from Steam. Luckily I also don't have my CC number on my account since I use PayPal. I also enabled authentication via email a while ago so it sends me a code to log in. I guess it's a good idea to change your password and check CC statements either way.
- Keyframe 15y ago
  Paypal here too. For situations like these I've opted to use paypal on steam and psn cards on psn. Now I'm glad I did, because both were compromised.
jigs_up 15y ago
They have a lot of users to email, maybe it's coming? I still haven't anything either.
deleted 15y ago
[deleted]
zokier 15y ago
Steam forums have that same message on their front page.
primesuspect 15y ago
It's been confirmed on Steam forums. The letter said the messages will go out via Steam IM.
mdmalinowski 15y ago
I just opened up the Steam app and it displayed that message from Gabe.
dholowiski 15y ago
I haven't gotten the email either, but if the user database, including your email address and personal information has been stolen I would be _highly_ suspicious of any email I receive from Steam
- uxp 15y ago
  Another "me too" to the haven't received notice of this yet, however a link over at r/gaming on Reddit points to this screenshot of the standard Steam Update News splash that pops up every time you login to the Steam Client. http://i.imgur.com/EcEUJ.png http://i.imgur.com/EcEUJ.png
dylangs1030 15y ago
NB: This email is in the works, it didn't mean it was already sent out. The audience reading this is full of Steam users, so part of the point of the article is forewarning before that email is sent out. But yes, the message is displayed on the front page of Steam as well.
ahlatimer 15y ago
FTA: "Today a message will be going out to all Steam users." I assume "will" means that it hasn't been sent, yet, but it will be at some point in the future. I haven't gotten one either, FWIW.
stonemetal 15y ago
I haven't gotten an email but the pop up with new offers from steam displayed it a few minutes ago for me.
Natsu 15y ago
Fortunately, I have my account registered with a spamtrap email address, a username/password that I have never used elsewhere, and a very low limit credit card. Yeah, I'm glad I know better than to use a debit card. I'll be watching to see if anyone starts spamming me, because that spamtrap email is unique to my Steam account and has not been published elsewhere. Guess it pays to be paranoid.
- bh42222 15y ago
  Fortunately, I have my account registered with a spamtrap email address, a username/password that I have never used elsewhere, and a very low limit credit card. Same here. But I am a bit sad that my paranoia has been confirmed yet again.
  - MichaelApproved 15y ago
    Doesn't it stop being paranoia if you are correct?
    - Natsu 15y ago
      It's a matter of perspective. To most others, this still appears are paranoia. But I wouldn't be doing it if my experience didn't say that such problems occur far too often.

Aqwis 15y ago

I have not received a mail.

estel 15y ago
Nor I, but I imagine it just takes a little while to send tens of millions of emails.

starnix17 15y ago

At least they're honest about it, compare this to the PS3 compromise.

orblivion 15y ago

Wait, why would I change my Gmail password?

DiabloD3 15y ago
Because a lot of people use the same password everywhere. I really really really wish they wouldn't.
- orblivion 15y ago
  Ok, so if I don't do this I should be fine. I think the guy should have qualified his statement. Thanks.
- Silhouette 15y ago
  As long as we routinely use dozens of services that rely on "memorable" data to authenticate us, this is as inevitable as people who try to use different passwords for everything writing them down. Password stores are one possible improvement, but most people don't know enough to use one, and they are probably far too fiddly for most people anyway. And of course, ultimately you're still talking about using a single set of credentials to authorise everything in that case, it's just a different target (which if ever compromised will undermine your entire identity). Multi-factor authentication is a much better solution, but the technology to make it ubiquitous in a way that is neither excessively expensive nor creepy on privacy grounds isn't there yet. There are some problems in security that we know how to solve, at least to the extent that no-one has any idea how to crack them directly today and the effort to brute force them is effectively infinite. I'm really hoping that one of these days, the combination of mobile technology and the Internet will provide us with an easily portable device that can integrate with everything and render obsolete the current mess of hundreds of on-line identities, "memorable data" to authenticate for every financial service I use, etc.
karteek 15y ago
A lot of users tend to use same password for various accounts. So, if the hacker gets one password, it means he can gain access to other accounts owned by the user.

estel 15y ago

I'd find it reassuring in times like this if company's could post details of how securely they hash and salt user passwords. It'd be good to know...

defen 15y ago

Just yesterday I received a notification from Facebook that my account had been accessed from a suspicious location and was locked as a security precaution. I had no idea how this could have happened, but I did have the same email address + password for Steam and Facebook. Hardly proof, but certainly a plausible theory.

mburns 15y ago
http://keepass.info/ http://keepass.info/ - It is easy to have unique, complex passwords for each and every service. And with Dropbox (or kin) you can sync to iPhone, Android, Mac, Linux or Windows. Plus plugins for browsers to make easier.
- timerickson 15y ago
  Is there a Mac equivalent?
  - AdamGibbins 15y ago
    KeePassX works on OSX. https://www.keepassx.org/downloads https://www.keepassx.org/downloads There's also others like 1Password that are popular on OSX.
    - shaggyfrog 15y ago
      I use 1Password in conjunction with Dropbox to keep my passwords secure and synced between OS X, Windows (XP and 7) and iOS. It's a fantastic product.
  - aiscott 15y ago
    I use splashid. Not free but it works and they have an iPhone version. I also believe an older version of keepass was ported to Mac with the name KeePassX. Edit: typo
  - Terretta 15y ago
    1Password, which also is a Windows and Android equivalent: https://agilebits.com/onepassword https://agilebits.com/onepassword

machinespit 15y ago

no email, but the forum page shows the message: http://forums.steampowered.com http://forums.steampowered.com

jcapote 15y ago

Confirmed by Gabe here: http://au.pc.ign.com/articles/121/1212201p1.html http://au.pc.ign.com/articles/121/1212201p1.html All passwords are salted and hashed (hope they are using bcrypt), and all CC's are encrypted. EDIT: updated comment to clarify what I meant with the bcrypt

verroq 15y ago
Whatever encryption for CCs, I think its going to have to be reversible or there wont be any point of storing them.
- orblivion 15y ago
  Unless they keep the keys somewhere unrelated?
  - jasonlotito 15y ago
    The keys generally aren't kept anywhere. In fact, the encryption keys for a company valve's size should be split among multiple key company officials. The idea being, you should be able to steal the box that contains the credit card data and/or the machine that does the actual encryption and not have access to the keys (which, technically, aren't stored anywhere).
- rapind 15y ago
  One technique is to store another string (a pepper) outside of the database (assuming the salt is stored with the records) which is used along with the salt to encrypt each password. This way, if only the database is compromised, and not the config file or env variable holding the pepper you're in better shape.
  - jaequery 15y ago
    if they got to the database!, what makes you think they didn't get to the app server?

dabit 15y ago

Wait, how do you change your Steam password?

nchaimov 15y ago
This took me a while to figure out. You have to open the Steam client, go to Settings (in Windows) or Preferences (in Mac OS X) and click the change password button in there under the Account tab.
- inportb 15y ago
  What if you don't have (or can't use) the Steam client?
  - Natsu 15y ago
    I don't think you can access your account at all without the client? At least, none I know of. Forum accounts are separate, after all.
dholowiski 15y ago
Has the site been secured yet? Would it be wise to change your password before there is confirmation that steam's site is safe? Instead I would change the password on any other accounts that use the same password as your steam account.

Karunamon 15y ago

:( Very sad.. but I suppose it was just a matter of time. At least the CC and passwords were protected correctly.

callmevlad 15y ago

The title seems to be very misleading. There is a big difference between losing a user database (all user info gone, no backups, can't log in, etc) and database information being compromised (information leaked, fraudulent activity, etc).

skeletonjelly 15y ago
Agreed. Assumed this was going to be a story of data loss, and how they have good backups and managed to restore with no problems. This is unfortunately much graver.

elliottcarlson 15y ago

"While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login." I am assuming here that this means certain passwords were cracked at that point - does this mean that the nonce/salt in their password storage was discovered? And how long until they have a cracked user/password file?

danilocampos 15y ago

I admire the absolute hell out of Valve and have for a long time. Gabe Newell is, for my money, the biggest mensch in tech. Let's take a moment and look at how this was handled: The message communicates exactly what happened in clear terms that don't try to cover anyone's ass. They explain which data was compromised and the potential implications. No double-talk. This could be an email you got from a friend or colleague. The message conveys Valve's hope that the credit cards are secure but makes clear that users should be nonetheless vigilant about watching for suspicious activity. Just in case. The message is signed by the head honcho of the company. Not some communications or PR weasel. It's in your inbox, not on some obscure blog. Finally, it closes with: "I am truly sorry this happened, and I apologize for the inconvenience." Accepting responsibility, acknowledging that it's a fuckup, and showing some empathy for the fact that this completely sucks for their customers. Sony, Adobe and their ilk could learn a lot from this company.

ltamake 15y ago
I absolutely agree. I would rather be told the bad news with all the facts than a sugar-coated "oh-we-were-hacked-but-its-not-our-fault-and-you-customers-are-screwed" response.
sdkmvx 15y ago
You are absolutely right, and I really appreciate this from Valve. There is only one thing that would have made it better: even more info. He says passwords were "hashed and salted." This could be anything from the naïve MD5(pass+salt) to the more secure bcrypt or PBKDF2. Now, I have every reason to believe that Valve is smart enough to not use methods like the first, but information is always welcome in a scenario like this. There should be no reason to hide your cryptography method provided that it is secure. > Sony, Adobe and their ilk could learn a lot from this company. And unfortunately they won’t listen…
- Duff 15y ago
  The issue may be more complex. Steam has been around for awhile now -- there may be an Amazon.com like issue where new passwords are secure, but older passwords are using crypt or something!

onosendai 15y ago

For the last 7 years or so of making payments online I've had an iron clad rule which I have yet to break: only use one time credit card numbers with a low spending limit which are provided on demand by my bank. It's a service tailored specifically for working around the problem of having your CC details stored indefinitely on poorly secured databases of every two-bit company out there. And with each major (and minor) data breach I'm more happy I use it.

dholowiski 15y ago
Have you ever investigated in depth how much security one-time credit card numbers give you? I ask because my Paypal account was compromised last month. I cancelled my credit card, but Paypal was still able to refund money to my card even though the number was no longer valid. Also, I had pre-ordered but not paid for an iPod touch. When the touch shipped, my credit card was billed even though the old number had been cancelled, and the new one had not been activated yet.
- DougWebb 15y ago
  One-time account numbers and cancelled/changed account numbers protect you from money going out, not money coming in. You can always get refunds.
- X-Istence 15y ago
  I have used the one time numbers that my Bank of America card creates and have had to retire a few due to breaches and after they were retired I got a call asking me if I had authorised another charge to that now defunct account number, and I said no, so they didn't let the charge through. I know for example that credit cards with expiration dates can still be charged for a couple of months after the expiration so that users who have not had the chance to update recurring services have more time to do so. Also, it is entirely possible that Apple had placed a hold on your account for the money and when it finally shipped it went from a hold to actual transaction and that is why it was still allowed through.
  - 15y ago

shocks 15y ago

I am a Steam user, I did not receive an email. If you are a Steam user I would recommend using the two-step verification process they have. It uses a password sent to your email to verify you when logging in using a new computer. Hopefully you're Steam and associated email passwords are not the same. This is, of course, no replacement to changing your password - you should definitely do that - but allows us to relax a bit in case something similar happens again.

Margh 15y ago

Am I the only one who thinks that "Steam loses user database" isn't quite the same as "Steam database of salted data compromised"? For a moment there I thought all my Steam purchases were, you know, lost.

deleted 15y ago
[deleted]

cheald 15y ago

> "While there is no evidence that passwords and credit card information have been compromised, with the state of encryption cracking, it should only be a matter of time (and horsepower)." Um. What? Assuming that a PCI-compliant level of encryption was used, "matter of time" is "heat death of the universe" if you don't have the encryption keys.

awm 15y ago
I'm assuming they refer to somebody breaking the encryption algorithm, not brute-forcing their way through them.
- cheald 15y ago
  You don't just "break the encryption algorithm". If the people holding the database can get through AES-256 or 128-bit triple DES, the internet as a whole has far bigger problems than Steam's database being compromised. This isn't CSI. You don't just throw encrypted text at an implausibly attractive IT guy and wait for him to furrow his brow, declare that it's military-grade encryption that will take him a little while, and then have him decrypt it by the end of the next commercial break. PCI-compliant encryption is the sort of thing that, barring incredible leaps in technology or the discovery of a significant algorithmic weakness, will never be crackable in our lifetime.
  - jasonlotito 15y ago
    Keep in mind he was referring to credit card information, not the credit card number. He mentions this here: "We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked." By credit card information, he's referring to address and name, for example, which, at last check (earlier this year) didn't necessarily require encryption. That the information had encryption is a good sign.
  - billswift 15y ago
    >will never be crackable in our lifetime. You might want to rethink this. "Will probably not be crackable in the next twenty years" is more realistic.

Hrundi 15y ago

How could they get to the [salted|hashed|whatever] payment data from hacking the forum? Why is the payment data even remotely linked to the forum software? Ok, the forum may need data from the account for validation, display name or else. You can still implement it securely. This is a big human oversight over what seems to be an insecure implementation. I just can't believe this. I would have guessed they learned the lesson from when Gabe was hacked through an Outlook vulnerability (with the HL2 code leak afterwards). It should have made a paranoid out of him. I think having chosen Paypal as a payment method was perhaps helpful for me. PS: I do own a lot of games and I very much like the platform. I definitely don't have anything against them. They presented a good notice, their high level of responsibility over this incident is irrefutable. Also, props for them for having an encryption for their preloaded games that wasn't broken so far. edit: formatting

zerovox 15y ago
This seems to be the first fair response. Sure, they handled it quite well, the letter is well written, but they still seem to have handled the data very poorly. Just because one is a huge fan of the brilliant service(which I certainly am), doesn't mean their poor security should be overlooked. Given the huge problem Sony has had recently, I would have thought other games companies would have been re-evaluating their data's security.
daxelrod 15y ago
Forum accounts are not linked to Steam accounts at all. The fact that the first sign of the intrusion was in the forum software doesn't necessarily mean it originated there. It's certainly possible that their entry point was the forum software, but simply compromising a forum account wouldn't be enough to compromise a Steam account.
Torn 15y ago
I don't think they are related. To me, it sounds like Steam was hacked on a number of vectors by people going after it specifically, the same way Sony was gone after.

xyzzyz 15y ago

I am gay.

ktusznio 15y ago

I am finding it pretty difficult to change my Steam password. Where the hell do you do it?

nathanhammond 15y ago
To change your Steam Account password do it from inside the preferences menu in the standalone application. The interface for changing your Steam Forums password is not currently available.

jccodez 15y ago

You are loosely using the term lose. I lose things when I can no longer find them.

dagnation 15y ago

so far beyond not good. Is nothing safe?

dvdhsu 15y ago

I've spent the last half hour trying to find my billing information on the Steam site. I just can't find it. It's great that Steam is letting me know that their database has been hacked. It's not so great when I can't even see if my billing information or credit card number (I obviously only want the last four digits) that Steam currently has on file for me. If I knew which credit card I had used with Steam, I could probably watch out for fraudulent charges. As it stands, there is no way for me to figure out what information I've given to Steam in the past. Arg.

weaksauce 15y ago
If it bothers you too much you can always buy a super cheap $1 game and see which card the charge hits. The pending charge should hit within a day and you don't need to worry too much after that.
Lurkin 15y ago
Go to steampowered.com and log in. Click the drop-down (Usernames' account) in the upper right corner and then Account details. The last four digits of your CC should be listed under "Your Steam Account" on the right.

giulivo 15y ago

It wouldn't have been a big issue, but they should have never ever save the credit card informations on a db. I don't know what makes people so confident they can save others credit card on a db. I would rather prefer to repost the needed details for every purchase.

tjoff 15y ago

I get the impression that credit card information is stored in the same database as login information etc. Why? My first thought is that it should be stored on, and never leave, a completely separate system where you have a very limited number of interactions available (reducing the attack vector and making it much easier to spot suspicious activity). I.e. Charge customer x with y for game z. Refund customer for purchase i (only valid within the refund-period). Add(overwrite)/delete customer data. Where all interactions must be signed. And nothing more. Anything less than that and I'm skeptical as to whether you could be considered careful of you customers data. Storing credit card information in the same database as all other user data for a service like steam should be a crime and if it's closely coupled with the forum it's even worse (not that I know if that's the case). Disclaimer: I don't know any details about this incident more than that Valve seems to be open about it taking place (great!).

jmelloy 15y ago
Our architecture has a front-end database and a billing database. The credit card number is stored in the billing database, and the details such as the billing address, expiration, etc are stored in the front-end database, since they need to be readable/updatable by the website. I imagine they're similar.

brunnsbe 15y ago

It wluld be interesting to find out how they noticed that someone had stole the data. I guess there must be lot of aggacks that don't get caught.

jamesgeck0 15y ago

One nice thing about the Steam client software (and store website) is that it uses two factor authentication. The first time you log in on an unfamiliar machine, you have to input a code which is emailed to you. Even if your Steam client and forum passwords were the same, your client account still secure as long as your email password is different.

tuacker 15y ago

It's worth noting that as far as I know Steam Guard is active for any user who didn't disable it. Meaning, if someone tries to log in to your Steam account on a device that isn't yours (both via the client and on the website) he'll get a prompt to enter a 4 char long code which is sent to your authorized email address. So your Steam account is save. Your email address probably isn't a secret anyway. The password is changed in a second. Which leaves your payment (encrypted) and billing info. Personally I use Click&Buy which requires a separate authorization from me and I'm actually not sure if I have any billing address associated with Steam. So for me this whole thing is just a minor annoyance in changing my password. Obviously I might treat the obtained user data different from other people.