News Steam forum and database hacked

Valve co-founder Gabe Newell confirms that the Steam database and its forum accounts were hacked, gives advice to cope.

http://www.bit-tech.net/news/gaming/2011/11/11/steam-forum-and-database-hacked/1

 

Merde! Just went through and changed a load passwords after the PSN scare!

 

Oh bother, well, that's slightly tiresome....

 

Stark contrast to Sony's approach ealier in the year.
Coming straight out and saying it seems much smarter than saying there's nothing wrong, there's nothing wrong, THERE IS NOTHING WRONG!
.
Still, just set new passwords on everything, can't be too careful.

 

can you even change steam accoutn password on steam website? (not steam forum)

 

To be fair to Sony, Valve didn't come out right away. The forums were defaced last Sunday, and they shut them down. They only came out with something official last night - before that there were all sorts of rumours, like it just someone attacking the forums only from a cyber cafe.

They key difference between them and Sony, however, is that they hashed the passwords.

Tbh though I do wonder what the cause of it was. I have a feeling they got hold of an employee's forum account, which they then used to alter the forums, and this employee also had access to the database. So, either the employee used the same password for the database or maybe they had access to his/her email and got in through that. Hopefully Valve will be up front and explain what exactly happened once they've fully investigated, but I wouldn't expect them to..

@denis_iii: You can only change your Steam password through the Steam program. Forum accounts are separate to Steam accounts though (you might not even have one), and it's the forum account that they're requiring everyone to reset. They do advise you change the password for your main Steam account though, and on any other account elsewhere that uses the same password.

 

Makes me wonder whether ANYTHING is SAFE online !! ?

 

Trying to change my steam password, keeps telling me I cannot do it at the time :S

 

thanks, am at work so will change my steam password tonight. steam forum account reset to random password with there password reset thang.....i've been meaning to change my pw's for years so will start today across all other sites with non universal password as i stupidly had before.

 

I thought I might be ok cause I use Steam Guard, meaning the hackers would need to get into my email (different password) to get into my Steam. I emailed Gabe about it, but he said to change my password anyway just to be safe.

 

@denis_iii I use Last Pass in conjunction with passwords like this. There's also things like Keepass which allows you to take it with you on a USB stick, but then I use Chrome portable and that way I get all my extensions too.

 

I wonder how many nerds have upped their passwords to huge phrases after that xkcd - I certainly made a start on the important stuff!

 

No.

I did. Gotta love Robert--pissing off hackers everywhere.

 

at least they encrypted the credit card data...

 

Doesn't make it any safe... So... Cancel the credit card is going to be my solution :/ damn...

 

Wow it getting freakin insane to keep any form of passwords these days

 

Nothing is safe, ever. Online is safer in some ways, but less secure in many.

@Xir: how long will it take to brute-force crack that do you think? Even if it's a month or two that will still cause a huge problem.

 

If they used any sensible encryption scheme, then we talk about years of decades (or much, much, much more).

For example AES :
http://www.theregister.co.uk/2011/08/19/aes_crypto_attack/

DES3 :
http://en.wikipedia.org/wiki/Triple_DES

Pretty much any good encryption algorithm is unbreakable these days, unless you can get the key directly from the source (Steam in this case).

 

From what I read Steam is using AES 256 encryption. If the guys who hacked steam could crack that we would have bigger problems the stolen credit card info.

Still, its getting a lil crazy lately with all the big companies getting hacked.

 

This is a good reminder to enable Steam Guard. Must do it when I get home