Slashdot Mirror
Steam Bug Shows You Other Users' Account Details (kotaku.com)
An anonymous reader writes: The Steam game distribution platform is suffering from a particularly bad bug right now. If you log in and try to look at your account details, you're shown the details of another user's account — seemingly picked at random. This includes email address, last 4 digits of a phone number, whether SteamGuard (their two-factor authentication) is enabled, and the last 2 digits of an associated credit card. If you play a game, Steam will show you as being logged in as somebody else while in that game. Many users are being shown pages in other languages, as they are mistaken for players in different regions. This bug follows an apparent DDoS attack that took the service down for several hours. The bug doesn't seem to allow people to purchase games using a different account. That's good, though that means most, perhaps all players, are unable to buy games on Christmas during Steam's huge Winter Sale.
Oh wow, Valve has simply turned Steam off for the moment.
Merry Christmas, Valve guys.
Vintage computer games and RPG books available. Email me if you're interested.
In theory. That's just creepy.
They haven't. Which is the problem. Just look at the Discussions tab under Steam Discussions. It's total chaos.
There's an update installed once you launch steam and I can access my own account and games. But the Steam Store is not accessible still as TFA states.
promising DDoS
Who knows. Whatever it is it's too late to matter. Most people who were going to buy shit bought it before today. You can still play your games with this being broken. Although it is scary to see account details change (mine haven't but it did switch to Portugeuse).
I've seen similar things before, and it's actually totally understandable. It's a bummer that it went so poorly, but what likely happened was they turned on caching, at some level, and this caused the issue. The account views were included in the caching -- which may've been directly targeted by the DDoS for that very reason. They'll probably introduce better caching, at a per user/session level for account views that will resolve it.. simple oversight made during a time of quick response (a.k.a panic mode).
from a community mod
They're going around locking topics like whackamole now.
Here's the text if you're leery:
The only time I have seen this happen is in an application badly designed to use shared memory across server processes.
Example:
+ Globally scoped variable shared across server processes and not properly released.
+ Multiple user sessions accessing the same process (within milliseconds of each other).
+ Accessed data is shared between user sessions.
Application design 101 fail.
I was wondering why Steam suddenly decided to switch the language to Russian (or some other language using cyrillic script). Trying to switch back to English using the top right corner language menu gave me some error message... which was still in Cyrillic so it didn't exactly help. Fun times.
Anyway, as far as hard-hitting bugs, this is pretty tame. At worst, someone could see my list of games or something... oh, the tragedy.
If you login to check if it's broken, you're account details could be cached for someone else to view. If you don't login, they won't be cached.
I do hope the scriptkiddies who ddossed it (and the other major gaming networks) are being found and send to prison... (if it were up to me, they should even get their heads smashed in)..
This doesn't happen.
Just another reason that Steam is awful. This is what happens when you put all your eggs in one basket. Who thought it was a good idea to have this ugly, buggy, bloated, and now apparently insecure, program installed alongside every single PC release? And the worst part is that there is no alternative. Origin only offers EA games, and GOG doesn't have many (if any) new releases.
I really can't wait for another service to come along and knock Steam off their pedestal. Maybe then it will force Valve to get their shit together.
This is from last summer: Steam Bug Allowed Password Resets Without Confirmation.
Bad announcements, crusty security. Time for a nerdcott?
... They ask every tine I start steam... Is this your email address, please confirm, so I do then then next time I start it... Is this your mail address! For security :)
Why does Valve (as well as other vendors) hold on to CC info? After completing a transaction the vendor ought to throw that info away. Yes, it is annoying to type the numbers in again each time, but that is much better compared to having CC info stolen. Where are the legislators when we need them? Storing CC info beyond transaction completion should not be permitted for a vendor. Likewise, using the SSN for anything else other than dealing with federal and state departments ought to be disallowed as well. Why do insurance companies and banks need to know my SSN? Do they plan to pay into my retirement account? If they need an ID then (ab)use the driver's license, which also should be only about indicating the ability to operate a vehicle. If there is a need to have an ID then let's have a resident registry and give out ID cards. Why do other countries get this straight and the US doesn't?