Steam Account Hacked Despite 2FA, Inventory Stolen

[Orthopaktis]

I recently had my account compromised due to a Steam-unrelated PC compromise (a trusted website was hacked, and delivered a RAT that infected my end).

All of my accounts remained secure, and safe, with the exception of Steam. Said hacker pulled the login "cookie" file that Steam uses to save login information, and used that to bypass 2FA. Somehow, they then — despite not having my password, email, or Steam Guard, posted hundreds of market sales and pawned off hundreds of dollars worth of inventory I had accumulated. I had not received a single notification or email to any of the postings until they actually sold.

Again, the hacker never had access to Steam Guard, my email, or password, and managed to wipe my inventory due to a shoddy security flaw in Steam's login system.

The hack came from an unrelated Minecraft based trusted website, not from me logging into a third party Steam one. At no point did my email (Proton) get compromised, nor did my phone/Steam Guard. And out of hundreds of accounts, ranging from lax security like Netflix to things like Microsoft — only Steam fell victim. It's a blatant security issue, and Valve as of yet refuses to even consider rectifying/restoring the losses, nor do they acknowledge the flaw exists at all.

While I acknowledge my failure in trusting the source of the PC hack, this particular issue is on Valve. Stealing account information by grabbing one unsecured file is a horrendous mismanagement of security, from someone who works in security. I'm just glad I didn't save payment info on Steam for them to do more reaching damage.

[Phoenix]

Slav Mcgopnik の投稿を引用：

Orthopaktis の投稿を引用：

Valve's servers don't need to be compromised if they have a file that gave them access to my account, which is the gist of this whole post/debacle.

Nothing is missing, you're getting everything. The problem is a file, that they grabbed off my account, gave them easy access to my account. You're free to believe whatever you want, but that's the facts, the only means of hijacking was pulling files. Steam is a glorified browser, and it's cookies clearly aren't encrypted or IP/system locked.

So there’s a special file on Steam that gives access to user accounts, and works even after password changes and adjustments?

And your evidence that this exists is…?

Well, it worked against Hotmail accounts in the past. Read a story about a woman's boss accessing her personal hotmail, woman changes password, boss can still access it, because the session cookie was given more priority than the password by Microsoft. So, who knows ...

Bee🐝 の投稿を引用：

BluePawClaw の投稿を引用：

We are only here because we are trying to find means for people to keep themselves safe. It is good that you inform people that these websites can be the cause, but asserting that it is the only possibility is not helpful to those who’s case may be different. Consider that before you respond.

Your assumptions make zero sense. We’ve been around awhile and know how the system works.

They need your account name, password, and Steam guard code.

There is no super secret way to bypass Steam security.

Oh, and in the EU where Valve operates, they have to report any security breach or suffer a pretty serious fine.

I'm guessing Valve reported the Christmas Day attack in 2015 to the EU, when bad actors attacked Steam's caching server. I was seeing Russian characters inside my account details. It was basically causing some sort of buffer overflow - about a month later someone attempted to use my debit card at a Bank of Canada ATM, but they couldn't get anything because they didn't have my PIN. I think my stored credit card Steam info got buffer overflowed into someone else's account.

https://store.steampowered.com/oldnews/19852

[Roday]

Phoenix の投稿を引用：

Well, it worked against Hotmail accounts in the past. Read a story about a woman's boss accessing her personal hotmail, woman changes password, boss can still access it, because the session cookie was given more priority than the password by Microsoft. So, who knows ...

It depends on the implementation
Nowadays lot of websites use limited token with refresh token to avoid this kind of issue

And actually cookies auth is different with token auth in many layers


And actually RAT is not that scary if u aware of it before it's too late=just remove the the services and registry of it from ur computer=they will still be there but it wont be functional because u bypass the core system of it
And u will have enough time to do the deep clean


The scary thing about RAT is not about his 'functions' but about how many people don't aware that they have been infected until it's too late


Even in term of 'scary',ransomware is far more destructive than RAT
it's just RAT working silently until it's late,so it feels more scary for most people



At first I just paid attention to his thread,but it got funnier when people acted like they are experts on this and made a lot of wrong assumption


The main point is=cookies and tokens are 2 different auths method with their own flaws
Idk why but people in this thread oftenly interchange it so much



Steam has lot of security issues,nobody can deny it
but somehow it's funny when people here talking about security yet interchange cookies auth and tokens auth so many times

it leads to misconception,not solution/suggestion
It will lead to a logical fallacy in the end



I don't mind people talking about suggestion together,but pls at least use the same core and concept,otherwise it's just another suggestion with wrong technical concepts that wont get anywhere in the end

[lailaamell]

the weakest part of any security is the user

[76561199502155650]

don't forget about steam greed which is causing people to cheat to obtain skins and crates which they hope to sell for profit, if you remove the trade features from the game, the skin scam cheating and profit for theft will also be reduced.

its really a no brainer, steams inventory items are more valueable locked on accounts when they can not be traded, it makes the account less able to be compromised maliciously and forces people who get banned to work hard to get items, not trade with other cheaters or hackers to replace skins.

another words, steam would see better profits and players would have more security if trading of game items was removed, players would then have to crate key purchase in the hopes of obtaining the skin they want. thats all steam profit, steam makes nothing on trades and often has to deal with the headaches of disgruntle steam customers who get account items stolen.

[lailaamell]

Unicorn - Rainbow Unit の投稿を引用：

don't forget about steam greed which is causing people to cheat to obtain skins and crates which they hope to sell for profit, if you remove the trade features from the game, the skin scam cheating and profit for theft will also be reduced.

its really a no brainer, steams inventory items are more valueable locked on accounts when they can not be traded, it makes the account less able to be compromised maliciously and forces people who get banned to work hard to get items, not trade with other cheaters or hackers to replace skins.

another words, steam would see better profits and players would have more security if trading of game items was removed, players would then have to crate key purchase in the hopes of obtaining the skin they want. thats all steam profit, steam makes nothing on trades and often has to deal with the headaches of disgruntle steam customers who get account items stolen.

solution might be just end the market its basicly nfts anyway at this point

[RebelStreamers]

Muppet among Puppets の投稿を引用：

RebelStreamers の投稿を引用：

Steam -> Settings -> Security -> Do not save account credentials on this Computer


steam asks when you install it for 1st time on a computer to remember the credentials (your cookies that hackers used) and this is something that they should change by giving a notify warning that there is a security risk because right now the installer and steam itself is at risk from cookie stealing.

The Easement is the number one enemy of Security!

i just enabled my computer to not save account credentials and i will search to my computer if there are any traces of this cookie inside /Temp and /Steam/htmlcache on %userprofile%\AppData\Local after i close steam.

Does that mean you need to type the password each time? And the remote access tool needs to not have a keylogger,?
Or that the remote access tool is not used when you are not looking to enable that setting
again?

An infected computer can not be safe.

copy paste every time yes but...

if you are using password manager with key file and you have blocked any communication of it with application firewall even on an infected windows machine nobody can steal your password because the copy-paste procedure with right click of mouse happens on password manager's memory protected area and the good password managers are destroying the password after some seconds.

for exaple on windows. if you are using keepass that you have blocked it from communicating (every outbound or inbound connection to this program) and you open it with a txt file that is total random and you only you know that it is a key file for keepass nobody can steal the passwords you copy paste from it with right click of mouse or open to their computer your keepass database if they steal it from your computer!

OFC, if you want the maximum security you should never use remote accounts (win 11 default accounts), only local accounts and you should open your password manager before any game launcher or game because modern games are monitoring keystrokes too! for example the cefhost.exe (better not say what game is using it) that is monitoring keystrokes as it reported from the sandboxes on virustotal : https://www.virustotal.com/gui/file/b4e1c4538810704c57c387ef6c4de50ba35fc874a3ef8146ce093da3ec97a617/behavior

press the + on Crendetial access to see what virustotal reports

p.s. ofc you can not trust an infected computer but as i said the key point of every security are the application firewalls that the good antiviruses have included

[Muppet among Puppets]

RebelStreamers の投稿を引用：

Muppet among Puppets の投稿を引用：

Does that mean you need to type the password each time? And the remote access tool needs to not have a keylogger,?
Or that the remote access tool is not used when you are not looking to enable that setting
again?

An infected computer can not be safe.

copy paste every time yes but...

if you are using password manager with key file and you have blocked any communication of it with application firewall even on an infected windows machine nobody can steal your password because the copy-paste procedure with right click of mouse happens on password manager's memory protected area and the good password managers are destroying the password after some seconds.

for exaple on windows. if you are using keepass that you have blocked it from communicating (every outbound or inbound connection to this program) nobody can steal the passwords you copy paste from it with right click of mouse.

OFC, if you want the maximum security you should never use remote accounts (win 11 default accounts), only local accounts and you should open your password manager before any game launcher or game because modern games are monitoring keystrokes too! for example the cefhost.exe (better not say what game is using it) that is monitoring keystrokes as it reported from the sandboxes on virustotal : https://www.virustotal.com/gui/file/b4e1c4538810704c57c387ef6c4de50ba35fc874a3ef8146ce093da3ec97a617/behavior

press the + on Crendetial access to see what virustotal reports

p.s. ofc you can not trust an infected computer but as i said the key point of every security are the application firewalls that the good antiviruses have included

Maybe you can block a remote access tool if you know what you do. But this should be the first thing you mentioned in this post.

Because for the average user, a password manager is kind of like a password list that someone can get from you. And the password for it as well. If the computer is infected. Keepass tells the users as well, an infected computer can not be used safely.

There are other questionable descriptions as well in your post. Like the recommendation to block keepass from the internet to be protected from leaking. That does not protect against a rat.
Also, if i am not wrong copy pasting with clipboard is not protected. Maybe auto insert is, to a degree.

[RebelStreamers]

Muppet among Puppets の投稿を引用：

RebelStreamers の投稿を引用：

copy paste every time yes but...

if you are using password manager with key file and you have blocked any communication of it with application firewall even on an infected windows machine nobody can steal your password because the copy-paste procedure with right click of mouse happens on password manager's memory protected area and the good password managers are destroying the password after some seconds.

for exaple on windows. if you are using keepass that you have blocked it from communicating (every outbound or inbound connection to this program) nobody can steal the passwords you copy paste from it with right click of mouse.

OFC, if you want the maximum security you should never use remote accounts (win 11 default accounts), only local accounts and you should open your password manager before any game launcher or game because modern games are monitoring keystrokes too! for example the cefhost.exe (better not say what game is using it) that is monitoring keystrokes as it reported from the sandboxes on virustotal : https://www.virustotal.com/gui/file/b4e1c4538810704c57c387ef6c4de50ba35fc874a3ef8146ce093da3ec97a617/behavior

press the + on Crendetial access to see what virustotal reports

p.s. ofc you can not trust an infected computer but as i said the key point of every security are the application firewalls that the good antiviruses have included

Maybe you can block a remote access tool if you know what you do. But this should be the first thing you mentioned in this post.

Because for the average user, a password manager is kind of like a password list that someone can get from you. And the password for it as well. If the computer is infected. Keepass tells the users as well, an infected computer can not be used safely.

There are other questionable descriptions as well in your post. Like the recommendation to block keepass from the internet to be protected from leaking. That does not protect against a rat.
Also, if i am not wrong copy pasting with clipboard is not protected. Maybe auto insert is, to a degree.

i have a feeling that the average user is storing his/her passwords inside plain text files and as i said the password manager destroys the password from copy after X seconds and trust me it works as it should.because if you don't paste the password in time it is empty after X seconds.!

[Muppet among Puppets]

RebelStreamers の投稿を引用：

Muppet among Puppets の投稿を引用：

Maybe you can block a remote access tool if you know what you do. But this should be the first thing you mentioned in this post.

Because for the average user, a password manager is kind of like a password list that someone can get from you. And the password for it as well. If the computer is infected. Keepass tells the users as well, an infected computer can not be used safely.

There are other questionable descriptions as well in your post. Like the recommendation to block keepass from the internet to be protected from leaking. That does not protect against a rat.
Also, if i am not wrong copy pasting with clipboard is not protected. Maybe auto insert is, to a degree.

i have a feeling that the average user is storing his/her passwords inside plain text files and as i said the password manager destroys the password from copy after X seconds and trust me it works as it should.because if you don't paste the password in time it is empty after X seconds.!

Yes, but malware takes it before it gets erased.

[RebelStreamers]

Muppet among Puppets の投稿を引用：

RebelStreamers の投稿を引用：

i have a feeling that the average user is storing his/her passwords inside plain text files and as i said the password manager destroys the password from copy after X seconds and trust me it works as it should.because if you don't paste the password in time it is empty after X seconds.!

Yes, but malware takes it before it gets erased.

this is why the password managers have auto-fill and the password manager is doing the copy paste not the user aka the infected computer

if you want to see how watch this small video
https://youtu.be/SPru0GChf8E?feature=shared


but i am sure the common users will hate password managers if they try auto-fil and fail and this is why i didn't mention it before.

[Muppet among Puppets]

RebelStreamers の投稿を引用：

Muppet among Puppets の投稿を引用：

Yes, but malware takes it before it gets erased.

this is why the password managers have auto-fill and the password manager is doing the copy paste not the user aka the infected computer

if you want to see how watch this small video
https://youtu.be/SPru0GChf8E?feature=shared


but i am sure the common users will hate password managers if they try auto-fil and fail and this is why i didn't mention it before.

A malware that is aiming for a password manager could still grab the database password and the database and also the keyfile.
Just saying, so that its not forgotten to keep the computer safe.

One question, how do you sequence login pages that ask on one page for username, and then on another for password?

[RebelStreamers]

Muppet among Puppets の投稿を引用：

RebelStreamers の投稿を引用：

this is why the password managers have auto-fill and the password manager is doing the copy paste not the user aka the infected computer

if you want to see how watch this small video
https://youtu.be/SPru0GChf8E?feature=shared


but i am sure the common users will hate password managers if they try auto-fil and fail and this is why i didn't mention it before.

A malware that is aiming for a password manager could still grab the database password and the database and also the keyfile.
Just saying, so that its not forgotten to keep the computer safe.

One question, how do you sequence login pages that ask on one page for username, and then on another for password?

nobody knows except the password manager what is the keyfile ...

malwares don't know because malwares have access to command line not to desktop. To know something like that we are not speaking for a malware anymore but for a REMOTE DESKTOP and it is over if a hacker taket the access of your DESKTOP

[Phoenix]

I have no faith that a rootkit can't do whatever it wants to, especially if it has higher privileges than the OS / AV / software running on the system.

[Muppet among Puppets]

RebelStreamers の投稿を引用：

Muppet among Puppets の投稿を引用：

A malware that is aiming for a password manager could still grab the database password and the database and also the keyfile.
Just saying, so that its not forgotten to keep the computer safe.

One question, how do you sequence login pages that ask on one page for username, and then on another for password?

nobody knows except the password manager what is the keyfile ...

malwares don't know because malwares have access to command line not to desktop. To know something like that we are not speaking for a malware anymore but for a REMOTE DESKTOP and it is over if a hacker taket the access of your DESKTOP

Do you know the answer to my question?

[RebelStreamers]

Muppet among Puppets の投稿を引用：

RebelStreamers の投稿を引用：

nobody knows except the password manager what is the keyfile ...

malwares don't know because malwares have access to command line not to desktop. To know something like that we are not speaking for a malware anymore but for a REMOTE DESKTOP and it is over if a hacker taket the access of your DESKTOP

Do you know the answer to my question?

password managers may support some type of scripting.

So, you are solving this problem by adding an ENTER command after username and a DELAY X seconds before continue to allow browser go to the next page to send the password.

https://sourceforge.net/p/keepass/discussion/329221/thread/cf24f97df7/