Support NeoGAF

[chrominance]

The news story's been updated, Valve have made a statement:

From Gamespot:

"Steam is back up and running without any known issues," a Valve spokesperson told GameSpot. "As a result of a configuration change earlier today, a caching issue allowed some users to randomly see pages generated for other users for a period of less than an hour. This issue has since been resolved. We believe no unauthorized actions were allowed on accounts beyond the viewing of cached page information and no additional action is required by users."

From Kotaku:

Steam is back up and running without any known issues. As a result of a configuration change earlier today, a caching issue allowed some users to randomly see pages generated for other users for a period of less than an hour. This issue has since been resolved. We believe no unauthorized actions were allowed on accounts beyond the viewing of cached page information and no additional action is required by users.

Also, about the Steam forum thread containing the same statement:

Killah just edited in the statement from the Kotaku article. Mods don't have an official line of communication with Valve employees any more than you or I.

It's just the same statement over and over. There's nothing new, nor any sign that we'll get more info on what happened and why.

On an unrelated note: it looks like the Google cache that stored some poor sap's full billing address and phone number has finally disappeared.

 

[Mr_Zombie]

The hysteria in this thread, so funny

Yeah, it's hysterical being afraid of your personal data (including e-mails, telephone numbers and billing information if you saved them) floating around the web or someone meddling with your data. Such a funny thing.

And Steam's handling of the situation is amateurish. No, a statement in Kotaku's article or info buried somewhere on a message board is not enough. There's no official statement on Steam client, nothing on their Facebook or Twitter account. As if nothing happened. If someone doesn't follow gaming press or visit gaming message boards he/she could be even unaware that something happened.

"Steam is back up and running without any known issues," a Valve spokesperson told GameSpot. "As a result of a configuration change earlier today, a caching issue allowed some users to randomly see pages generated for other users for a period of less than an hour. This issue has since been resolved. We believe no unauthorized actions were allowed on accounts beyond the viewing of cached page information and no additional action is required by users."

Weren't people in this very thread confirming that they were able to delete other people's CC and PayPal info stored on their accounts? Yeah, that "no actions were allowed beyond viewing of cached page information" statement is bullshit.

 

[JaseC]

From the Steam forum thread, as relayed by a forum moderator:

Killah just edited in the statement from the Kotaku article. Mods don't have an official line of communication with Valve employees any more than you or I.

 

[Par Score]

The news story's been updated, Valve have made a statement:

That's the same statement they gave to Kotaku like 10 hours ago dude, old news.

Still no direct communication with their users, just bullshit non-statements to a few press outlets, it's totally inadequate.

 

[chrominance]

Killah just edited in the statement from the Kotaku article. Mods don't have an official line of communication with Valve employees.

Oh, okay, I thought for some reason that statement appeared before the Kotaku post. I'll edit.

 

[efyu_lemonardo]

I am not familiar with the specific server architecture, I just happen to work in web development (but definitely not as a sysadmin!). I probably know just enough to be dangerous in most cases.

I actually couldn't tell you if it's safe to log in and change your account info, only that the single statement Valve has released about the incident suggests the problem has been fixed. This is corroborated by the lack of any new reports of the problem. Going to your account page is still a risk, given how the leak occurred last time (basically, you visiting the page could mean that a cache is storing that response, which could then be served to others later). However, if we take Valve at their word and the caching configuration error is gone, then either your pages aren't in cache at all or they're in a per-user cache that shouldn't be displayed to other users or guests.

Moreover, at this point, the sooner you access those pages, the sooner they'll leave any caching system if indeed those pages are still cached. I suspect they aren't, because there's no reason to ever cache those pages in such a way that leaves identifying information intact, but since Valve hasn't told us anything about the nature of the problem or the solution we can only assume the worst and hope for the best.

Early reports suggested the best thing you could do was log out of Steam and not view any store pages. I think that advice was given by SteamDB (note: NOT affiliated with Steam, they are a third-party site) because of the aforementioned cache, where visiting your own account pages legitimately could get your pages into the publicly accessible cache. There's no evidence that being logged in or out is a vulnerability in itself, so I don't think you need to worry about your login status for now.

tl;dr: I think it's about as safe as it's going to be to log in and change your account, short of another official statement from Valve. You probably don't need to worry about logging out, either. However, I wouldn't blame you if you chose to exercise extreme caution and just stay out of Steam for a while longer; evidence suggests your information is still there even if you remove your payment info.

Thank you for the detailed reply. It feels shitty that I have to ask for advice on a videogame forum in this kind of situation but it's comforting to know there are good people on GAF who are willing to try and help.

 

[PaulLFC]

It's just the same statement over and over. There's nothing new, nor any sign that we'll get more info on what happened and why.

Nor an apology for leaking people's personal information.

Valve showing how not to react when something like this happens. Awful response to the whole situation.

 

[Bedlam]

Valve's reaction to this is just unbelievable. Users were able to see personal account details of other users and they don't even care to mention that fact in their sorry excuse for a statement. There is not even a single word hinting at an apology.

Well, I made it a principle to never give out more details than necessary in any of my gaming accounts and specifically to not add my credit card info anywhere. Not on XBL, not on PSN and not on Steam.

Last night this was proven the correct way of going about these things yet again. If it's not some hacker attack, then it's incompetence as in this case. With a stance like Valve's, I guess it's only a matter of time before the first serious hacker attacks hits.

 

[NoblesseOblige]

You'd think the money they saved by hiring amateur engineers would have been used to pay for some actual CS/PR.

 

[inky]

Official statement: "LOL sorry, not sorry."

Goddam, Valve turned into such a shit company.

 

[jmga]

Weren't people in this very thread confirming that they were able to delete other people's CC and PayPal info stored on their accounts? Yeah, that "no actions were allowed beyond viewing of cached page information" statement is bullshit.

No one has been able to proof that.

 

[Jacksinthe]

Not sure what people expected it's the response their lawyers would have told them to write.

They're not going to admit the seriousness of the issue during their busiest period of the year.

They don't need to admit to the gravity of the situation, they just need to fucking tell people their personal information MAY HAVE BEEN viewed by other people like email, phone, residence, etc.

Its their job to inform people when shit like this happens so people can prepare and take any measures necessary to protect potential fraud.

Having to go to a fucking gaming website to find out your shits fucked up is not something a majority do. Lots of people go to gaming sites if you look at them exclusively. Not a whole lot go to gaming sites, as a whole.

They need to contact everyone with a legit response and not some hand-waving bullshit excuse done in passing.

 

[orthodoxy1095]

I'm a long term user and have deleted my payment details and all my wishlist with the intention of buying elsewhere whenever I can.

Not saying sorry when their own mistake causes concern to their customers is very poor and I won't support any company like that.

I'm glad some people are taking it seriously!

No one has been able to proof that.

We've had reports of being able to delete the CC info and then reports in this thread from users who say their CC info seemed to have been deleted by someone. So I guess we don't have proof per se, but putting two and two together seems to get us the conclusion that it was possible. Although the statement seems to be inaccurate, it was actually nice of people to delete others' CC info as that meant less negative outcomes hopefully.

 

[efyu_lemonardo]

We've had reports of being able to delete the CC info and then reports in this thread from users who say their CC info seemed to have been deleted by someone. So I guess we don't have proof per se, but putting two and two together seems to get us the conclusion that it was possible. Although the statement seems to be inaccurate, it was actually nice of people to delete others' CC info as that meant less negative outcomes hopefully.

It'd be interesting to note if the people who deleted other user's cc info where the same ones that had their cc info deleted by others. If I understood Valve's response correctly (it's likely I may have not), people viewing other user's account were still, in fact, logged into their own accounts.

 

[Nzyme32]

Weren't people in this very thread confirming that they were able to delete other people's CC and PayPal info stored on their accounts? Yeah, that "no actions were allowed beyond viewing of cached page information" statement is bullshit.

It is likely that those comments were bullshit; any attempt to do anything from those pages either resulted in an error or asking to log in, which makes sense with the issue being cached pages, ie not an active session under someone else's login credentials. You could see stuff for sure, but you couldn't do anything through Steam. Lots of potential outside Steam with the info though

 

[Dunkley]

No one has been able to proof that.

By all means there's no way of telling that it did delete their CC info as Steam could have just falsely confirmed that the action while in reality it wasn't.

I know I could access the E-mail management page from someone's account details (with it still being the same user) and attempt to change their E-mail address, so I have no reason to doubt people were able to access the CC info edit page of other people as well.

Either way however there is no way of confirming nor denying that people were capable of these actions. As long as Valve refuses to communicate and inform to their customers which information was compromised and what actions could have been done, people have all rights to assume the worst and should do so given how severe this accident was.

 

[Rainbow In The Dark]

My card information was removed from my account as well. Initially, I asummed Valve did it for all accounts, but I guess it was some random person.

 

[inky]

They don't need to admit to the gravity of the situation, they just need to fucking tell people their personal information MAY HAVE BEEN viewed by other people like email, phone, residence, etc.

Its their job to inform people when shit like this happens so people can prepare and take any measures necessary to protect potential fraud..

Seriously. Just send a fucking email out. Suggest people to keep an eye out, change email passwords, maybe even change their login/email associated with Steam.

Something.

 

[massoluk]

The response is so shitty. What is with that non-apology.

 

[efyu_lemonardo]

My card information was removed from my account as well. Initially, I asummed Valve did it for all accounts, but I guess it was some random person.

did you at any time during the incident attempt to remove someone's cc info through steam?

 

[orthodoxy1095]

It'd be interesting to note if the people who deleted other user's cc info where the same ones that had their cc info deleted by others. If I understood Valve's response correctly (it's likely I may have not), people viewing other user's account were still, in fact, logged into their own accounts.

That's an interesting point. That very could have been the case. Maybe someone who noticed deleted CC info can comment on whether they tried to delete someone else's or if it just happened hours later when they found out about the hubbub and tried to log in.

My card information was removed from my account as well. Initially, I asummed Valve did it for all accounts, but I guess it was some random person.

Hello, speak of the devil haha. Did you try to remove anyone else's info that was appearing in your account?

 

[Rainbow In The Dark]

did you at any time during the incident attempt to remove someone's cc info through steam?

nope

 

[Nzyme32]

The response is so shitty. What is with that non-apology.

I'm taking a guess they will do what they did with the password reset exploit and only email the users likely to have had their info compromised over that period based on the times those users accessed checkout / account pages. They really should address everyone though. In the past it has taken them a day to actually make a formal statement.

 

[efyu_lemonardo]

nope

then taking your word for it, either Valve removed your cc info as a precautionary measure, which is something they should absolutely notify their users about if they did, or someone other than Valve had more than just read-only access to your account.

edit: Someone with an actual undertanding of this should weigh in, my opinion in itself is meaningless as I have no professional knowledge in this area.

 

[More_Badass]

So is it safe to log in again?

 

[Fuu]

It would help if the op was updated with valve's statement.

 

[More_Badass]

The response is so shitty. What is with that non-apology.

Because that wasn't a response. It was a email reply to the sites that inquired
If I understand correctly, Valve actually hasn't released a public statement

 

[Labadal]

So is it safe to log in again?

Don't know but I have been logged in and played some.

 

[Dunkley]

then taking your word for it, either Valve removed your cc info as a precautionary measure, which is something they should absolutely notify their users about if they did, or someone other than Valve had more than just read-only access to your account.

edit: Someone with an actual undertanding of this should weigh in, my opinion on itself is meaningless as I have no proffesional knowledge in this area.

Like said, Valve needs to step in and clear up exactly what happened, who was affected, what information was affected, what actions could have been made on someone's account and what Valve might have done themselves to protect affected users.

Customers shouldn't be tasked with having to figure that out themselves.

 

[hardcastlemccormick]

The ambiguity on what exactly happened yesterday highlights the seriousness of this issue. We don't know what happened. We don't know what was compromised, what users were capable of in each other's accounts. We just have a loose idea of how far most people got.

The only one who can tell us this is Valve. Each hour they are silent is another hour users have to guess blindly at what they need to be doing to re-secure their email accounts. Each hour they are silent is another hour that users who had no idea this even happened are unaware that they may need to take action to secure their information. Valve's incompetence in the past 18 hours cannot be understated. The lack of proper, authoritative information on the breach is just as dangerous as the breach itself.

Valve's incompetent and clearly incorrect answer is not a supportive piece of evidence to the magnitude of this breach. Until proven otherwise by a detailed statement from Valve, assume the worst about all information on your account details page, and anything else you can view within Steam. The potential for people using this window of opportunity is unknown at this time - here I would not assume the worst just yet but I will be taking precautionary measures.

Anyone who feels out of their depth on internet security should give a read to Blown to Bits, and excellent overview of the basics of computer and internet security. It's available as a free PDF in the link above.

 

[Skyball Paint]

You'd think the money they saved by hiring amateur engineers would have been used to pay for some actual CS/PR.

Problem is that Valve doesn't want to hire CS/PR. It wants renaissance men/women, and gives them the freedom to work whatever project they want. They don't have formal managers or job titles.
If they hire people to do a specific job, their corporate culture would apparently be destroyed, and they value that more than the benefits of having people for the important, not fun jobs that creative people don't want to deal with.

Personally, I don't see how a free-wheeling creative side, and a more structured side handling Steam can't co-exist, but I ain't a business man.

 

[pompidu]

Wow pure insanity.
Played dota last night. Anyway to know if you were exposed? Wouldn't have logged in if I knew shit was going down.

 

[Norwegian_Imposter]

The fact this disappeared from the front page is hilarious. If this was any other service than Lord gaben's it would be pitchforks big time. Can you imagine if it was origin or uplay?

The leeway that steam gets is insane!

 

[Rainbow In The Dark]

then taking your word for it, either Valve removed your cc info as a precautionary measure, which is something they should absolutely notify their users about if they did, or someone other than Valve had more than just read-only access to your account.

edit: Someone with an actual undertanding of this should weigh in, my opinion in itself is meaningless as I have no professional knowledge in this area.

Although to be honest I haven't bought anything on Steam since June. Maybe I removed my card info around that time and I don't remember, but I doubt it since I actually trusted Steam with my info.

 

[efyu_lemonardo]

Like said, Valve needs to step in and clear up exactly what happened, who was affected, what information was affected, what actions could have been made on someone's account and what Valve might have done themselves to protect affected users.

Customers shouldn't be tasked with having to figure that out themselves.

agreed 100%

 

[Dunkley]

Wow pure insanity.
Played dota last night. Anyway to know if you were exposed? Wouldn't have logged in if I knew shit was going down.

Beyond checking if someone posted your Steam account name, nope.

That's the problem right now, and it's up to Valve to fix it.

 

[hardcastlemccormick]

Problem is that Valve doesn't want to hire CS/PR. It wants renaissance men/women, and gives them the freedom to work whatever project they want. They don't have formal managers or job titles.
If they hire people to do a specific job, their corporate culture would apparently be destroyed, and they value that more than the benefits of having people for the important, not fun jobs that creative people don't want to deal with.

Personally, I don't see how a free-wheeling creative side, and a more structured side handling Steam can't co-exist, but I ain't a business man.

Valve could outsource the tasks that they as a company are incapable of performing. A collection of firms could provide CS/PR, and Valve could dictate what they want or need. They could also accept contractor work for Steam's client and server software.

At least from the exterior, Valve appears to be in over their heads here. If they're doing any outsourcing, they need to do more.

The fact this disappeared from the front page is hilarious. If this was any other service than Lord gaben's it would be pitchforks big time. Can you imagine if it was origin or uplay?

The leeway that steam gets is insane!

My pitchfork is well and truly sharpened and I see plenty more in this thread. News of the issue will spread and the news will not be treated lightly.

 

[ElectricBlanketFire]

The fact this disappeared from the front page is hilarious. If this was any other service than Lord gaben's it would be pitchforks big time. Can you imagine if it was origin or uplay?

The leeway that steam gets is insane!

A 40 page thread in under a day doesn't do anything for you?

 

[chrominance]

The fact this disappeared from the front page is hilarious. If this was any other service than Lord gaben's it would be pitchforks big time. Can you imagine if it was origin or uplay?

The leeway that steam gets is insane!

This thread has two-thirds the posts and 1.5x as many views as the actual Steam winter sale thread that's been up for days. I'm pretty sure it's getting attention on GAF.

 

[efyu_lemonardo]

A 40 page thread doesn't do anything for you?

honestly, considering a large subset of GAF users probably have a Steam account, 40 pages isn't much. There are probably ~1000 people posting here..

 

[hardcastlemccormick]

honestly, considering a large subset of GAF users probably have a Steam account, 40 pages isn't much. There are probably ~1000 people posting here..

Not everybody has something to say. I know personally I lurk but don't post in threads I know nothing about.

 

[DorkyMohr]

Looking at the account page now, I see that my phone number is there but it's only the last 4 digits, is that something they changed in the fix? Was the whole number visible before?

 

[daviyoung]

Looking at the account page now, I see that my phone number is there but it's only the last 4 digits, is that something they changed in the fix? Was the whole number visible before?

No it was only ever that.

 

[ElectricBlanketFire]

honestly, considering a large subset of GAF users probably have a Steam account, 40 pages isn't much. There are probably ~1000 people posting here..

But it was Christmas yesterday. I didn't see or hear anything about this until I got home at around 10 last night.

 

[Costia]

Looking at the account page now, I see that my phone number is there but it's only the last 4 digits, is that something they changed in the fix? Was the whole number visible before?

From what I understand the whole number and address are visible in the edit/add payment options screen and possibly on the android steam app.

No it was only ever that.

Not true

http://www.neogaf.com/forum/showthread.php?p=190425008#post190425008

http://www.twitch.tv/giantwaffle/v/31761287
at 1:33:00 ish

 

[Neverforget]

I saw it live yesterday, I was into some guy account I think. My steam become Russian or something like that. I thought I was hacked.

 

[efyu_lemonardo]

But it was Christmas yesterday. I didn't see or hear anything about this until I got home at around 10 last night.

Not everybody has something to say. I know personally I lurk but don't post in threads I know nothing about.

both true

This thread has two-thirds the posts and 1.5x as many views as the actual Steam winter sale thread that's been up for days. I'm pretty sure it's getting attention on GAF.

Hah, I incorrectly figured (becasue of the changed thread title) that the latest winter sale OT was started after the incident..

 

[Celcius]

One good thing came out of this: I never saved card info on Steam, but I've gone to amazon and others places where I shop and have deleted all of my saved card info. I would encourage others to use this as a lesson and do the same.

 

[cyba89]

The ambiguity on what exactly happened yesterday highlights the seriousness of this issue. We don't know what happened. We don't know what was compromised, what users were capable of in each other's accounts. We just have a loose idea of how far most people got.

The only one who can tell us this is Valve. Each hour they are silent is another hour users have to guess blindly at what they need to be doing to re-secure their email accounts. Each hour they are silent is another hour that users who had no idea this even happened are unaware that they may need to take action to secure their information. Valve's incompetence in the past 18 hours cannot be understated. The lack of proper, authoritative information on the breach is just as dangerous as the breach itself.

Valve's incompetent and clearly incorrect answer is not a supportive piece of evidence to the magnitude of this breach. Until proven otherwise by a detailed statement from Valve, assume the worst about all information on your account details page, and anything else you can view within Steam. The potential for people using this window of opportunity is unknown at this time - here I would not assume the worst just yet but I will be taking precautionary measures.

Well said.

If they don't tell us anything about this in the next 5 hours it will be over 24 hours til the exposure happened and we will know for sure that Valve doesn't care at all about their rightfully worried costumers.
If you don't frequent GAF, reddit or twitter you probably don't even know about your personal data being potentially exposed on the internet.

No it was only ever that.

It was fully visible to people when you went through the checkout process.
https://i.imgur.com/SvwWJRG.png1

edit: beaten

 

[CadetMahoney]

so what services have been compromised?

steam, PSN. . . ?