Slashdot Mirror
Millions Of Steam Game Keys Stolen After Hacker Breaches Gaming Site (zdnet.com)
An anonymous reader writes:A little over nine million keys used to redeem and activate games on the Steam platform were stolen by a hacker who breached a gaming news site last month. The site, DLH.net, provides news, reviews, cheat codes, and forums, was breached on July 31 by an unnamed hacker, whose name isn't known but was also responsible for the Dota 2 forum breach. The site also allows users to share redeemable game keys through its forums, which along with the main site has around 3.3 million unique registered users, according to breach notification site LeakedSource.com, which obtained a copy of the database. A known vulnerability found in older vBulletin forum software, which powers the site's community, allowed the hacker to access the databases. The data stolen from the forum includes full names, usernames, scrambled passwords, email addresses, dates of birth, join dates, avatars, Steam usernames, and user activity data. Facebook access tokens were stolen for those who signed in with their social account.
if they know the keys were stolen, can't they invalidate them????
Related or no? I'm unable to access any Steam functions other than games at the moment. No discussions. No store. No community page. Can access other sites fine though.
No incentive for favorable reviews there.. no siree bob. /sarcasm
An online community the size of steam is a big target. DLH.net and Steam both should have known better.
The keys though, they are already tied to the account that paid for them right? Are they useful for anything?
I've been expecting something like this for a while. Now expect big changes in the steam API.
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
See, I just *knew* that deactivating my facebook this week would pay off almost immediately.
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
I've pretty much concluded that all the PHP-based bulletin boards are a security nightmare. Even the ones that are small enough to audit tend to be filled with old-style mysql_query calls and other horrors of the past.
The best thing about PHP 7, in my view, is that they're finally killing the old MySQL API. They should have done that years ago. Now, you'll be able to tell which software is reasonably up-to-date based on whether it supports PHP 7 or not. Incidentally, vBulletin's website says that it still doesn't. That's probably not a good sign. :-)
Check out my sci-fi/humor trilogy at PatriotsBooks.
Ok, apparently I don't have enough friends who also use Steam to know about this. I myself have a Steam account and was under the impression that a key is a one-time use code to activate a game in your account. If that's true, why in the world would you want to share a Steam game key? And even if you did share one, isn't there a finite amount of time until whoever you shared it with activates it and it's no longer useful to anyone else? Why would there be millions of unredeemed Steam game keys lying around in a FORUM database?!
Anyone at all have information that can shed some light on a few more of the technical details? Because TFA is pretty much a verbatim copy of the summary.
People sometimes get free or discounted keys and want to sell or trade them for games they actually want.
No one said there were millions of *unredeemed* keys stolen, just millions of keys. It's likely 99% of people who got keys through DLH used them immediately and the codes are meaningless now.
How can I believe you when you tell me what I don't want to hear?
Ok, that makes WAY more sense. Thanks!
I remember /. was breached twice several years ago. I haven't been here in several years so if there have been any since then I haven't heard.
Minimum threshold fixed. Thanks!
To clarify they for you, in this case it is DLH.net that was hacked via a PHP bulletin board issue, not Steam. To the best of my knowledge, DLH did not put out a browser. Steam on the other hand, appears to use a fork of Chromium/WebKit for their browser, so they didn't really develop one, either, they just took an existing one and bolted it in.
For what it's worth, Steam doesn't trust browsers very much, either. The only way you can redeem a game code is through their client. Probably to prevent a hacker from devising an automated attack against it.
Now I can deny having actually played GTA V for 368 hours. "It was the guy who hacked my account, honey!"
You are welcome on my lawn.
Facebook access tokens were stolen for those who signed in with their social account.
What exactly does that mean?
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Most of the keys were for so-so games, nothing really AAA and got to have. Nothing of Value was lost. It's a good thing I used my spam email and spam facebook acount for things like this.
Uh, this isn't true in my experience with the various Sword of the Stars bundles in my experience.
Even if they did update it, it still won't matter unless every single vBulletin forum admin out there also decides to update as well. There are hundreds of forums running obsolete versions of it.
"..One hosts to look them up, one DNS to find them, and in the darkness BIND them."
This is a wrong information.
The thing is, lack of upgrades usually indicates a design problem. For services like this, the software should be distributed using git so that local changes can be merged sanely. Instead, most of these bulletin boards involve moving aside the existing installation, extracting a tarball, and running some sort of installer script that does who-knows-what. So upgrading can be nightmarish for sites that involve any sort of customization.
Also, this sort of software should be designed in such a way that it never makes backwards-incompatible changes to data structures, at least for a reasonable period of time (say a year or two). It should be possible to clone your installation to a new directory, apply the patches to the new version, start it up, and let it add additional database fields, etc. as needed, but the new version should be tolerant of partial data created by the old version (and should upgrade it on the fly), and should create data in such a way that the old version can still read it. This ensures that you can test the migration to a new version without having to set up a full clone of your entire infrastructure, with the ability to roll back if it breaks something.
And ideally, a built-in upgrade scheme should be designed into the software. For example, it could have a script that clones itself into a directory beside the original and does a "git pull" in that subdirectory. After you fix any conflicts, it should let you access the new version by symlinking the new version into a subdirectory in the original version's tree. When you're satisfied, it should provide a one-button command that atomically deploys the new version by swapping out the symlink that currently points to the old version with a symlink that points to the new version.
Oh, and it should check for updates automatically and email the admin every time there's an update. And it should allow you to auto-upgrade (with automatic email notification if the upgrade fails because of git conflicts) if you configure it to do so. And it should also have an intermediate mode that always keeps the latest version ready to preview but doesn't enable the upgrade, for folks who want to verify the updates manually, but still want to be ready to quickly install security updates when they find out about an exploit.
With such a design, these systems would stay up-to-date much more consistently.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Given that vBulletin/phpBB have been around since the early 2000s, I'm guessing there's a lot of legacy code, wouldn't be surprised if they're still running CVS or Subversion without independent repositories like git has. They were not well designed with upgrades in mind. Newer forum software like Discourse are better that way, but again are only optimized for touch screens. Giant amounts of whitespace, infinite scroll and other features annoying and wasteful of screen estate for desktop users.
"..One hosts to look them up, one DNS to find them, and in the darkness BIND them."
I like how I get down-scored for pointing out a trolls' false logic. Keep it classy, mods.