Steam Guard Security Broken

[z]

I am here to inform you that unfortunately Steam Guard has a very serious vulnerability. I briefly explain what happens:

There are several people of Russian nationality who steal Cookies from the browsers of people who have a lot of money in CS:GO to access their accounts. Then, what they do is use cheats detected by the anti-cheat to get the ban.
I know a person from the most important Russian forum and that few people know, who has created a tool that simulates the Steam Guard of the person who stole the Cookies to gain access.
This account theft method happened to the CEO of the CS:GO team called 9z. Here you can see your profile: CLICK HERE.
I demand that they invest in a much better anti cheat for CS:GO that really works, and that they increase the security of the same platform.

Thank you for viewing this entire discussion.

No one is safe.

[Tito Shivan]

Originally posted by hell:

You are stupid? The one who has stolen the account from the CEO of 9z, has made a video using hacks on Frankkaster's account. find out.

If you had read the thread you'd know we've gone around that already. No Steam vulnearbility involved. I suggest you to find out about spear phishing.

[z]

Originally posted by Tito Shivan:

Originally posted by hell:

You are stupid? The one who has stolen the account from the CEO of 9z, has made a video using hacks on Frankkaster's account. find out.

If you had read the thread you'd know we've gone around that already. No Steam vulnearbility involved. I suggest you to find out about spear phishing.

It was not Phishing, since the attacker stole his cookies and then with a program created by him, he made a bypass simulating the Steam Guard Mobile. How do you think what happened? Find out.

[❤ Sly Succubus ❤]

Originally posted by hell:

Originally posted by Tito Shivan:

If you had read the thread you'd know we've gone around that already. No Steam vulnearbility involved. I suggest you to find out about spear phishing.

It was not Phishing, since the attacker stole his cookies and then with a program created by him, he made a bypass simulating the Steam Guard Mobile. How do you think what happened? Find out.

He was Phished, I'll be crystal clear so you can understand how dumb this is becoming. What happened? Thats simple, actually is freaking known as "pass the cookie"

Lets be clear, for this to work you still have to be Phished becaue the attacker first requires a means to access ones cookies to bloody start with, this is literally cyber MFA attack 101

https://securityintelligence.com/articles/guide-to-cookie-hijacking/

Modern MFA attacks work exactly the same way: these malware programs wait for you to log on to a website, steal your session cookie and send it to the attacker. You literally must log into a website known for this stuff. - https://threatpost.com/cloud-attacks-bypass-mfa-feds/163056/

He was, in all terms and conditions, Phished, the attack your talking about? Is literally classified as a Phish as its literally cyber security 101 for MFA security that you MUST BE PHISHED FOR THEM TO STILL GET THE COOKIE

So if I had to guess, Frankkaster was attacked by logging into Twitter which the attacker had already access to, using it to then secure his program on his PC, from there he bypassed everything.

The fact your blaming Steam for something Steam literally is neither at fault for, nor involved with is the dumbest part of this situation because you dont simulate an MFA, hell there's no such thing as a program for that, the "program" you think exists has another name called Malware

[z]

Originally posted by Shizune:

Originally posted by hell:

It was not Phishing, since the attacker stole his cookies and then with a program created by him, he made a bypass simulating the Steam Guard Mobile. How do you think what happened? Find out.

He was Phished, I'll be crystal clear so you can understand how dumb this is becoming. What happened? Thats simple, actually is freaking known as "pass the cookie"

Lets be clear, for this to work you still have to be Phished becaue the attacker first requires a means to access ones cookies to bloody start with, this is literally cyber MFA attack 101

https://securityintelligence.com/articles/guide-to-cookie-hijacking/

Modern MFA attacks work exactly the same way: these malware programs wait for you to log on to a website, steal your session cookie and send it to the attacker. You literally must log into a website known for this stuff. - https://threatpost.com/cloud-attacks-bypass-mfa-feds/163056/

He was, in all terms and conditions, Phished, the attack your talking about? Is literally classified as a Phish as its literally cyber security 101 for MFA security that you MUST BE PHISHED FOR THEM TO STILL GET THE COOKIE

So if I had to guess, Frankkaster was attacked by logging into Twitter which the attacker had already access to, using it to then secure his program on his PC, from there he bypassed everything.

The fact your blaming Steam for something Steam literally is neither at fault for, nor involved with is the dumbest part of this situation because you dont simulate an MFA, hell there's no such thing as a program for that, the "program" you think exists has another name called Malware

I know the person who has done this and he has told me and shown how he did it, do you think I'm lying?

[❤ Sly Succubus ❤]

Originally posted by hell:

Originally posted by Shizune:

He was Phished, I'll be crystal clear so you can understand how dumb this is becoming. What happened? Thats simple, actually is freaking known as "pass the cookie"

Lets be clear, for this to work you still have to be Phished becaue the attacker first requires a means to access ones cookies to bloody start with, this is literally cyber MFA attack 101

https://securityintelligence.com/articles/guide-to-cookie-hijacking/

Modern MFA attacks work exactly the same way: these malware programs wait for you to log on to a website, steal your session cookie and send it to the attacker. You literally must log into a website known for this stuff. - https://threatpost.com/cloud-attacks-bypass-mfa-feds/163056/

He was, in all terms and conditions, Phished, the attack your talking about? Is literally classified as a Phish as its literally cyber security 101 for MFA security that you MUST BE PHISHED FOR THEM TO STILL GET THE COOKIE

So if I had to guess, Frankkaster was attacked by logging into Twitter which the attacker had already access to, using it to then secure his program on his PC, from there he bypassed everything.

The fact your blaming Steam for something Steam literally is neither at fault for, nor involved with is the dumbest part of this situation because you dont simulate an MFA, hell there's no such thing as a program for that, the "program" you think exists has another name called Malware

I know the person who has done this and he has told me and shown how he did it, do you think I'm lying?

Without providing proof you may as well be yes, thats kinda how it works, without providing public proof of it being possible your claiming of a security exploit that not even the most well known cyber security experts of the CIA or FBI know of yet.

[KalGimpa]

Originally posted by hell:

Originally posted by Shizune:

He was Phished, I'll be crystal clear so you can understand how dumb this is becoming. What happened? Thats simple, actually is freaking known as "pass the cookie"

Lets be clear, for this to work you still have to be Phished becaue the attacker first requires a means to access ones cookies to bloody start with, this is literally cyber MFA attack 101

https://securityintelligence.com/articles/guide-to-cookie-hijacking/

Modern MFA attacks work exactly the same way: these malware programs wait for you to log on to a website, steal your session cookie and send it to the attacker. You literally must log into a website known for this stuff. - https://threatpost.com/cloud-attacks-bypass-mfa-feds/163056/

He was, in all terms and conditions, Phished, the attack your talking about? Is literally classified as a Phish as its literally cyber security 101 for MFA security that you MUST BE PHISHED FOR THEM TO STILL GET THE COOKIE

So if I had to guess, Frankkaster was attacked by logging into Twitter which the attacker had already access to, using it to then secure his program on his PC, from there he bypassed everything.

The fact your blaming Steam for something Steam literally is neither at fault for, nor involved with is the dumbest part of this situation because you dont simulate an MFA, hell there's no such thing as a program for that, the "program" you think exists has another name called Malware

I know the person who has done this and he has told me and shown how he did it, do you think I'm lying?

yes

you/they were phished

somewhere along the way you gave your info out, figure out where and and how and be a little more careful

[J4MESOX4D]

Originally posted by hell:

Originally posted by Shizune:

He was Phished, I'll be crystal clear so you can understand how dumb this is becoming. What happened? Thats simple, actually is freaking known as "pass the cookie"

Lets be clear, for this to work you still have to be Phished becaue the attacker first requires a means to access ones cookies to bloody start with, this is literally cyber MFA attack 101

https://securityintelligence.com/articles/guide-to-cookie-hijacking/

Modern MFA attacks work exactly the same way: these malware programs wait for you to log on to a website, steal your session cookie and send it to the attacker. You literally must log into a website known for this stuff. - https://threatpost.com/cloud-attacks-bypass-mfa-feds/163056/

He was, in all terms and conditions, Phished, the attack your talking about? Is literally classified as a Phish as its literally cyber security 101 for MFA security that you MUST BE PHISHED FOR THEM TO STILL GET THE COOKIE

So if I had to guess, Frankkaster was attacked by logging into Twitter which the attacker had already access to, using it to then secure his program on his PC, from there he bypassed everything.

The fact your blaming Steam for something Steam literally is neither at fault for, nor involved with is the dumbest part of this situation because you dont simulate an MFA, hell there's no such thing as a program for that, the "program" you think exists has another name called Malware

do you think I'm lying?

Yes, or utterly delusional.

[❤ Sly Succubus ❤]

https://www.microsoft.com/en-us/wdsi/threats
I will also provide a link right here to Microsofts live and up-to-date virus and malware database, and yes it includes basically every single known online security cyber attack, virus, malware and even phish of every kind, its name and details known to date, including ones for video games, web platforms, supply line info structure and ransomware and basically details on how to remove/prevent it if required

[Tito Shivan]

Originally posted by hell:

I know the person who has done this and he has told me and shown how he did it, do you think I'm lying?

Without further evidence, your affirmation only sounds as "My dad works at Nintendo".

Other than that. If you have somehow found an actual vulnerability or exploit, Steam has been running a bounty program for quite some time. Instead of arguing you could report it there and earn a bit of money off it.

[z]

Originally posted by Shizune:

Originally posted by hell:

I know the person who has done this and he has told me and shown how he did it, do you think I'm lying?

Without providing proof you may as well be yes, thats kinda how it works, without providing public proof of it being possible your claiming of a security exploit that not even the most well known cyber security experts of the CIA or FBI know of yet.

The one who has done this is a Russian, he is much more than any police force in the USA

[z]

Originally posted by Tito Shivan:

Originally posted by hell:

I know the person who has done this and he has told me and shown how he did it, do you think I'm lying?

Without further evidence, your affirmation only sounds as "My dad works at Nintendo".

Other than that. If you have somehow found an actual vulnerability or exploit, Steam has been running a bounty program for quite some time. Instead of arguing you could report it there and earn a bit of money off it.

The boy earns money by stealing and selling accounts, he has more fun that way.

[cSg|mc-Hotsauce]

Originally posted by hell:

Originally posted by Tito Shivan:

Without further evidence, your affirmation only sounds as "My dad works at Nintendo".

Other than that. If you have somehow found an actual vulnerability or exploit, Steam has been running a bounty program for quite some time. Instead of arguing you could report it there and earn a bit of money off it.

The boy earns money by stealing and selling accounts, he has more fun that way.

[Link Removed]

[❤ Sly Succubus ❤]

Originally posted by hell:

Originally posted by Shizune:

Without providing proof you may as well be yes, thats kinda how it works, without providing public proof of it being possible your claiming of a security exploit that not even the most well known cyber security experts of the CIA or FBI know of yet.

The one who has done this is a Russian, he is much more than any police force in the USA :SquirbHead:

The one who did it also has a website which on the second page I noted I not only located but fully confirmed he accessed Franks account via a pass-the-cookie phish attack exploit then had someone else upload the video to youtube, something which you also prior said the hacker did, thats not only false but the uploader is literally a member of Nixware (a very known cheating software for CS:GO) while he himself literally was paid 22,000$ for the attack.

So not only have you falsely claimed is the man aware of more, for some reason, of the US police forces which keep in mind have literally nothing to do with federal cyber security task forces but to further put a finger to this situation, he didnt sell the account.

He hacked it, got Franks account banned and then logged off of it, he not only didnt steal a single thing, but he also didnt sell the account, both of those statements are very much false, if Frank lost items then he's not told us of a second attack after the first one that broke into his account.

Here's another part of the entire thing, clearly he does not care: https://www.twitch.tv/videos/1750056020 The man literally did a live stream 3 days ago, of CS:GO from his team, so not only did he move on and basically forget about this situation, it looks rather clear he DID log into a 3rd party website, note at the bottom of the screen he has listed "Gamersclub"

-Site removed- < This is a third party website that requires one to log in with their actual Steam account, so he only has himself to blame, the guy is literally displaying an ad on his actual live stream of a 3rd party CS:GO website which yes, the hacker could of easily exploited to get into his steam account.

And if we have to guess, thats exactly what the hacker did, he did a pass-the-cookie phish attack thanks to this third party website, as noted by a prior page I had linked, its very possible.

[cSg|mc-Hotsauce]

Why would you post a phishing link?

[z]

Originally posted by Shizune:

Originally posted by hell:

The one who has done this is a Russian, he is much more than any police force in the USA

The one who did it also has a website which on the second page I noted I not only located but fully confirmed he accessed Franks account via a pass-the-cookie phish attack exploit then had someone else upload the video to youtube, something which you also prior said the hacker did, thats not only false but the uploader is literally a member of Nixware (a very known cheating software for CS:GO) while he himself literally was paid 22,000$ for the attack.

So not only have you falsely claimed is the man aware of more, for some reason, of the US police forces which keep in mind have literally nothing to do with federal cyber security task forces but to further put a finger to this situation, he didnt sell the account.

He hacked it, got Franks account banned and then logged off of it, he not only didnt steal a single thing, but he also didnt sell the account, both of those statements are very much false, if Frank lost items then he's not told us of a second attack after the first one that broke into his account.

Here's another part of the entire thing, clearly he does not care: https://www.twitch.tv/videos/1750056020 The man literally did a live stream 3 days ago, of CS:GO from his team, so not only did he move on and basically forget about this situation, it looks rather clear he DID log into a 3rd party website, note at the bottom of the screen he has listed "Gamersclub"

[link removed] < This is a third party website that requires one to log in with their actual Steam account, so he only has himself to blame, the guy is literally displaying an ad on his actual live stream of a 3rd party CS:GO website which yes, the hacker could of easily exploited to get into his steam account.

And if we have to guess, thats exactly what the hacker did, he did a pass-the-cookie phish attack thanks to this third party website, as noted by a prior page I had linked, its very possible.

I have contact with Frankkaster, he has opened an investigation and I have given him information about Maddy (the attacker). He has not forgotten what happened, he just waits for an answer from Valve.
Yes, I know almost all the names of CS:GO cheat software.