If you can read this, either the style sheet didn't load or you have an older browser that doesn't support style sheets. Try clearing your browser cache and refreshing the page.

(G4TV) Scary So you remember how the Steam Forums were hacked and you didn't really have to panic? Well NOW you may panic   (g4tv.com) divider line 91
More: Scary, steam, Stephen Johnson, steam forums  
•       •       •

8034 clicks; posted to Geek » on 10 Nov 2011 at 11:51 PM   |  Favorite    |   share:  Share on Twitter share via Email Share on Facebook   more»   |    Get this fabulous T-Shirt and impress the methane out of your friends! shirt it!



91 Comments   (+0 »)
   

First | « | 1 | 2 | » | Last | Show all
 
2011-11-10 07:59:14 PM
I wonder how this affects me if I only use Paypal information with Steam.
 
2011-11-10 08:00:38 PM
Good thing I changed my Steam password the same day the forums story appeared on Fark.
 
2011-11-10 08:03:45 PM
RexTalionis: I wonder how this affects me if I only use Paypal information with Steam.

We'll find out at the end of their investigation it looks like, but it seems like any purchase data that was in that database would be revealed, including paypal email addresses.

SUpposedly password should be safe since they're salted and hashed, which means anyone trying to get into them would find that it's just a bunch of gibberish.

The credit card info, while apparently encrypted, is still the more concerning piece. So hopefully we'll know soon if we have another PSN type fiasco on our hands or not.
 
2011-11-10 08:04:00 PM
Still not panicking. Just another day on the internet. Probably just some 13 year old who got VAC banned for cheating on TF. Hacking vbull isn't exactly rocket science. While I am not concerned I do wonder why Valve had a Steam database on the same server as their forum.
 
wee [TotalFark]
2011-11-10 08:42:59 PM
Codenamechaz: SUpposedly password should be safe since they're salted and hashed, which means anyone trying to get into them would find that it's just a bunch of gibberish.

And there are zero cracking utilities that will help with brute forcing one-way hashes. None.

Yeah, right.

My money is on some Korean or Russian 23 year old is no desperately trying to collect as many dictionaries as he possibly can. You know 80% of those passwords are re-used (and I'm being generous). They have names, addresses, usernames, and secret questions/answers. You know they're gonna be feeding a scraping script pointed at credit card and bank sites the second they have that password in cleartext.

fark this farking shiat in the farking fark-hole.
 
2011-11-10 08:50:26 PM
Game over
 
2011-11-10 08:53:20 PM
wee: Codenamechaz: SUpposedly password should be safe since they're salted and hashed, which means anyone trying to get into them would find that it's just a bunch of gibberish.

And there are zero cracking utilities that will help with brute forcing one-way hashes. None.

Yeah, right.

My money is on some Korean or Russian 23 year old is no desperately trying to collect as many dictionaries as he possibly can. You know 80% of those passwords are re-used (and I'm being generous). They have names, addresses, usernames, and secret questions/answers. You know they're gonna be feeding a scraping script pointed at credit card and bank sites the second they have that password in cleartext.

fark this farking shiat in the farking fark-hole.


I said Should. It's going to be far more secure than simple encryption, especially since salting turns the hashes into straight up gobbled, letters, numbers and symbols of varying sizes and lengths, so meaning if they actually had something to get through the algorithm, it'd take a few decades for them to succeed.

It's more likely it's the same script kiddies who hacked the forums, which would explain how they were able to take control of an admin account on the forums. And if it was them, then they're hilariously stupid for opening themselves up like that to an even deeper criminal investigation, especially if they stole data like the PSN hackers.
 
2011-11-10 09:03:38 PM
Codenamechaz: It's more likely it's the same script kiddies who hacked the forums, which would explain how they were able to take control of an admin account on the forums. And if it was them, then they're hilariously stupid for opening themselves up like that to an even deeper criminal investigation, especially if they stole data like the PSN hackers.

How does a hacker go from "Whee I control an admin account on the forums" to getting the entire pile of all our encrypted data? Was the data somewhere on the forum servers?
 
2011-11-10 09:15:29 PM
smooshie: Codenamechaz: It's more likely it's the same script kiddies who hacked the forums, which would explain how they were able to take control of an admin account on the forums. And if it was them, then they're hilariously stupid for opening themselves up like that to an even deeper criminal investigation, especially if they stole data like the PSN hackers.

How does a hacker go from "Whee I control an admin account on the forums" to getting the entire pile of all our encrypted data? Was the data somewhere on the forum servers?


That's the conclusion I think a few of us are coming to. They somehow got a hold of an admin account, and it's likely the admin had privileges or access to that server where the data was stored on.

Won't really know for sure until Valve completes their investigation into it.
 
2011-11-10 10:01:48 PM
I'm supposed to panic because they may have gotten access to encrypted information? oh noooeeeess.

Seriously, do people think encryption is the computer equivalent of turning a paper upside down after having written on it? Fun fact: it isn't.

Oh, and if you have your steam forum information the same as your bank account information and lets say steams encryption was terrible, then bwaahhahahahaha at you for being stupid enough to have bank info the same as forum info.
 
2011-11-10 10:36:26 PM
JanusofZeal:
Oh, and if you have your steam forum information the same as your bank account information and lets say steams encryption was terrible, then bwaahhahahahaha at you for being stupid enough to have bank info the same as forum info.


Exactly.

The *MOST* someone is going to get is.

Steam Password: Ok.. Quick change to another randomly generated password via KeePass...
My CC information: Some fraudulent charges *could* get charged on it but I'd get it back and honestly I'm more worried about the shmoe at the gas station skimming my card then my CC # being used by a rogue script kiddie who attacked vbulletin
My Email Address: Oh Noes!!! I might get an email!!???@?$?@#$??

Seriously. This is a non-event to people with common sense.. Although, having done a lot of reading on the Steam Forums before I'm guessing the Herpa-Derp users highly out number those with common sense.
 
2011-11-10 10:41:35 PM
Forgot to add, that is if Valve is lying and nothing is encrypted to hell like they say it is..

/still not worried..
 
2011-11-10 10:49:14 PM
They need to drastically reduce the salaries of security experts, so the free market can give Steam users the greatest experience.

/Codenamechaz: smooshie: Codenamechaz: It's more likely it's the same script kiddies who hacked the forums, which would explain how they were able to take control of an admin account on the forums. And if it was them, then they're hilariously stupid for opening themselves up like that to an even deeper criminal investigation, especially if they stole data like the PSN hackers.

How does a hacker go from "Whee I control an admin account on the forums" to getting the entire pile of all our encrypted data? Was the data somewhere on the forum servers?

That's the conclusion I think a few of us are coming to. They somehow got a hold of an admin account, and it's likely the admin had privileges or access to that server where the data was stored on.

Won't really know for sure until Valve completes their investigation into it.


I, for one, will believe everything they tell us.
 
2011-11-11 12:02:47 AM
Dude, who hacks Valve? I mean, I get it, you're criminals, but it's farking Valve. They're the cool guys of the video game industry. This is like going up to the guy who just built a playground for local youths with funds completely out of his own pocket and kicking him in the nuts.

Hack Activision or EA. They're the ones who deserve it.

/do I want pictures of Bobby Kotick in women's stockings to be found?
//only as long as I don't have to see them
 
2011-11-11 12:16:13 AM
Codenamechaz

I said Should. It's going to be far more secure than simple encryption, especially since salting turns the hashes into straight up gobbled, letters, numbers and symbols of varying sizes and lengths, so meaning if they actually had something to get through the algorithm, it'd take a few decades for them to succeed.

Umm, what? That entire paragraph was nonsense. You know the salts were almost certainly taken as well, right?
 
2011-11-11 12:20:51 AM
Now we get to see if they've learned anything from Sony's bad example on how to handle the PR side of this mess.
 
2011-11-11 12:23:33 AM
RexTalionis: I wonder how this affects me if I only use Paypal information with Steam.

From what I've been reading about this, Paypal info should be safe as it's not stored. You *may* want to change your Steam password, but it's really only an issue if it's shared across accounts.

Personally, this is not the response to this I hoped to see. At the same time, I'm not all that worried. I use different passwords between email, SPUF, and Steam itself.
Still, this is really shiatty to see. I understand that there's a wealth of information and such you could gain from hacking Steam, but it's farking Valve. One of the most respected gaming companies on the market. Why would you hack them unless you were looking for HL2Ep3/HL3 code?

/flash backs to the HL2 leak
//not the response to the forum hacking I hoped to see
///not overly worried about this as my account goes
////really hope they can pull through this with minimal damage done
/SLASHIES!
 
2011-11-11 12:24:09 AM
Marine1: Dude, who hacks Valve? I mean, I get it, you're criminals, but it's farking Valve. They're the cool guys of the video game industry. This is like going up to the guy who just built a playground for local youths with funds completely out of his own pocket and kicking him in the nuts.

Hack Activision or EA. They're the ones who deserve it.

/do I want pictures of Bobby Kotick in women's stockings to be found?
//only as long as I don't have to see them


Bobby Kotick should start a charity. Five dollars to allow a gamer to punch him in the dick. He'd make billions.
 
2011-11-11 12:29:36 AM
envirovore: . Why would you hack them unless you were looking for HL2Ep3/HL3 code?


Aside from trying to get 30 million users Credit Card info that is.
 
2011-11-11 12:29:47 AM
And Steam is not allowing me to change my password at the moment.

That's peachy.


/I'm one of those idiots who saved their information to Steam
//Not worried, though, as it's a separate account that I transfer money to when I buy something from Steam
 
2011-11-11 12:39:12 AM
ArtosRC: And Steam is not allowing me to change my password at the moment.

That's peachy.


One of my Steam Friends was saying the same thing earlier.
I figured that it may be due to a sudden influx of users changing their passwords all at once (thus over flowing their servers), but according to their server stats page, everything is running as it should.
http://store.steampowered.com/stats/content/ (as Fark won't allow it to be linked.)
 
2011-11-11 12:44:55 AM
Yet another reason to poke fun at the wankers who play video games
 
2011-11-11 12:45:27 AM
I read an interesting article recently on brute force hacking attempts that said GPUs might actually be the best way to crack a password hash.
 
2011-11-11 12:46:30 AM
Smeggy Smurf: Yet another reason to poke fun at the wankers who play video games

Says the guy on Fark since 2003 with 90+ links approved.
 
2011-11-11 12:55:27 AM
Funny thing about this is I honestly don't remember if I had a forum account.
 
2011-11-11 01:01:25 AM
RexTalionis: I wonder how this affects me if I only use Paypal information with Steam.

It shouldn't since even if they got your Steam account password, trying to buy anything with your PayPal account would still require them to know your PayPal login to use it. Otherwise they're just buying the software for you with their own money.

/Unless you were foolish enough to use the same email for paypal as steam
//And same password
 
2011-11-11 01:02:36 AM
zarberg: I read an interesting article recently on brute force hacking attempts that said GPUs might actually be the best way to crack a password hash.

GPUs are absolutely the way to do it, it's not even a contest. Get 4 ati 6990s in a box and watch the hashes crack.
 
2011-11-11 01:03:50 AM
WayToBlue: zarberg: I read an interesting article recently on brute force hacking attempts that said GPUs might actually be the best way to crack a password hash.

GPUs are absolutely the way to do it, it's not even a contest. Get 4 ati 6990s in a box and watch the hashes crack.


Because they're pretty much built for large number crunching, right, whereas CPUs are built for commonly used instructions?
 
2011-11-11 01:07:01 AM
You noobs do realize that Steam has a setting that only allows logins from your home computer, right? Of course you didn't. Farking noobs.
 
2011-11-11 01:14:15 AM
ThisNameSux: You noobs do realize that Steam has a setting that only allows logins from your home computer, right? Of course you didn't. Farking noobs.

You mean the one that e-mails you if you want to make any changes and/or use any computer not already registered? The one I clicked the first day I signed up?

Yup. Realized it.
 
2011-11-11 01:15:56 AM
Thus far this has produced no ill effects for me.

ThisNameSux: Steam has a setting that only allows logins from your home computer

Indeed it does. Been using that since they implemented the feature.
 
2011-11-11 01:16:32 AM
Xaxor: Good thing I changed my Steam password the same day the forums story appeared on Fark.

same. better safe than lose 200 hundred games.

/still use the additional security, just to be double-plus-safe
 
2011-11-11 01:22:34 AM
envirovore: ArtosRC: And Steam is not allowing me to change my password at the moment.

That's peachy.

One of my Steam Friends was saying the same thing earlier.
I figured that it may be due to a sudden influx of users changing their passwords all at once (thus over flowing their servers), but according to their server stats page, everything is running as it should.
http://store.steampowered.com/stats/content/ (as Fark won't allow it to be linked.)


You're forgetting the Skyrim release as well. They're probably getting pounded harder than a cheap Thai whore at the moment.

/I had completely forgotten that I had a Steam forum account
 
2011-11-11 01:31:25 AM
So will this further delay the release of Half Life 2: Episode Three?
 
2011-11-11 01:32:46 AM
No aunties' I don't. This has been the same size deal since I got the email
 
2011-11-11 01:42:14 AM
JanusofZeal: I'm supposed to panic because they may have gotten access to encrypted information? oh noooeeeess.

Seriously, do people think encryption is the computer equivalent of turning a paper upside down after having written on it? Fun fact: it isn't.

Oh, and if you have your steam forum information the same as your bank account information and lets say steams encryption was terrible, then bwaahhahahahaha at you for being stupid enough to have bank info the same as forum info.


99.99% of the Internet-using world doesn't understand what encryption means. I'd put you in that group, because you're using the term encryption when you should say hashing.
 
2011-11-11 01:44:50 AM
Is there anyway to play Skyrim without Steam? Because the damn site's overloaded and it farking sucks.
 
2011-11-11 01:45:58 AM
foo monkey: JanusofZeal: I'm supposed to panic because they may have gotten access to encrypted information? oh noooeeeess.

Seriously, do people think encryption is the computer equivalent of turning a paper upside down after having written on it? Fun fact: it isn't.

Oh, and if you have your steam forum information the same as your bank account information and lets say steams encryption was terrible, then bwaahhahahahaha at you for being stupid enough to have bank info the same as forum info.

99.99% of the Internet-using world doesn't understand what encryption means. I'd put you in that group, because you're using the term encryption when you should say hashing.


Nvm. TFA says the passwords were hashed and the cards were encrypted. If they knew to salt the passwords, they should should be using a good encryption algorithm.
 
2011-11-11 01:46:30 AM
Need_MindBleach: Is there anyway to play Skyrim without Steam? Because the damn site's overloaded and it farking sucks.

Xbox or PS3 though steam is working fine for me I bought skyrim at about 1am EST and have been pulling 1.4mb download rate.
 
2011-11-11 01:58:12 AM
zarberg: WayToBlue: zarberg: I read an interesting article recently on brute force hacking attempts that said GPUs might actually be the best way to crack a password hash.

GPUs are absolutely the way to do it, it's not even a contest. Get 4 ati 6990s in a box and watch the hashes crack.

Because they're pretty much built for large number crunching, right, whereas CPUs are built for commonly used instructions?


They're built for massively parallel (ati 6990 has 3072 streams), extremely fast number crunching, which is perfect for hash cracking.

It's the difference between a system designed to do one thing incredibly well versus trying to everything.
 
2011-11-11 02:05:16 AM
Stop your fellow geeks, people. Go hack the AARP or something. Grandma won't even notice the fraudulent charges.
 
2011-11-11 02:05:51 AM
Well, I'm glad they SALT their passwords that get hashed; I really hope that the SALT is somewhere not where a potential hacker can get to it.

I wonder what 'encrypted' means on the CC data. They went so far as to say hash + SALT on the passwords, but simply said 'encrypted' on CCs. That could be purely so as not to reveal any more detail than they must, because their encryption is complete shiat (I doubt that, though), or anywhere in between.
 
2011-11-11 02:06:34 AM
Sanic123: Need_MindBleach: Is there anyway to play Skyrim without Steam? Because the damn site's overloaded and it farking sucks.

Xbox or PS3 though steam is working fine for me I bought skyrim at about 1am EST and have been pulling 1.4mb download rate.


Nope, trying to play the PC version.
 
2011-11-11 02:08:12 AM
Need_MindBleach: Sanic123: Need_MindBleach: Is there anyway to play Skyrim without Steam? Because the damn site's overloaded and it farking sucks.

Xbox or PS3 though steam is working fine for me I bought skyrim at about 1am EST and have been pulling 1.4mb download rate.

Nope, trying to play the PC version.


Then no. I believe that even the retail store copies are steam linked.
 
2011-11-11 02:22:04 AM
zarberg: WayToBlue: zarberg: I read an interesting article recently on brute force hacking attempts that said GPUs might actually be the best way to crack a password hash.

GPUs are absolutely the way to do it, it's not even a contest. Get 4 ati 6990s in a box and watch the hashes crack.

Because they're pretty much built for large number crunching, right, whereas CPUs are built for commonly used instructions?


It's more that a GPU is massively, hilariously parallel when compared to a CPU. It has to be. Just 1 of my x1200 screens is ~2.3 million pixels. So that's 2.3 million pixels that can be worked on at one time. and since you want to get 60 FPS, you only have (assuming my 880 MHz GPU is average), 15 million cycles to get those 2.3 million pixels.
 
2011-11-11 03:12:17 AM
Hate to point out the obvious but this is a perfect time to take out or serriously handicap the compitition. Nice timing Origin.
 
2011-11-11 03:20:37 AM
img23.imageshack.us (clickity-pops)

i think itll be OK
 
2011-11-11 03:45:48 AM
smooshie: Was the data somewhere on the forum servers?

That would be epic Sony fail.
 
2011-11-11 05:36:55 AM
JanusofZeal: I'm supposed to panic because they may have gotten access to encrypted information? oh noooeeeess.

Seriously, do people think encryption is the computer equivalent of turning a paper upside down after having written on it? Fun fact: it isn't.

Oh, and if you have your steam forum information the same as your bank account information and lets say steams encryption was terrible, then bwaahhahahahaha at you for being stupid enough to have bank info the same as forum info.


Do you really think computer encryption is unbreakable? Fun fact: it isn't.

And it's not a matter of having the "same information" as your bank account. The Steam service stores credit card information. You don't need bank info to use a CC number. Since that's the only thing of real value, that's probably what the attackers were after.
=Smidge=
 
2011-11-11 06:30:58 AM
Ned Stark: [img23.imageshack.us image 640x137] (clickity-pops)

i think itll be OK


Awesome.
 
Displayed 50 of 91 comments

First | « | 1 | 2 | » | Last | Show all


This thread is closed to new comments.

Continue Farking
Submit a Link »