Steam MFA/2FA can be easily bypassed, my account was stolen

[nightstalker]

Today my account was stolen in less than 60 seconds.

I had a push notification that someone from Poland or somewhere is trying to login to my account.

In under 60 seconds my Steam Guard Mobile Authenticator has been deactivated without any action of mine. My Phone Number was removed from my account without any action of mine. I didn't receive any e-mail nor SMS request wirh new number. And my e-mail + steam iD have been changed without any action of mine. It all happened in less than 60 seconds.

https://imgur.com/gallery/qZMzYRX

Once my Your Steam Guard App pushed notification to me, I wanted to change my password immediately, but I wasn'table to, since getting to a PC, booting it up, starting Steam a changing password takes a lot longer than 60 seconds. Also user should be able to change password via Steam Guard App. You can't change Your password in Browser. You can't change it in Steam App on Your phone. You can change it only via Windows, Linux or macOS Steam client.

This is really frustrating. I literally didn't stand a chance.

Steam shouldn't allow change of all these items in under 60 seconds.

E.g. when someone from different iP than Yours stable and months or years long used iP logs to Your account, there should be at least 24 hour time period to allow phone number change like Apple has it. And another 24 hours for e-mail change. Another 24 hours for Steam iD change.

Being able to bypass 2FA/MFA, remove phone number, change e-mail, change password, change steam iD and set new ones in under 60 seconds without owners agreement is simply unthinkable. Yet it happened.

Already wrote to Steam support from this account. I hope it gets resolved. Had some credit on Steam account and tons of games and mostly saves. This is horrible 😤😡🤬

[HikariLight]

Publicado originalmente por nightstalker:

Publicado originalmente por HikariLight:

Steam's mobile authenticator code changes every 30 seconds to a new random code.
You cannot predict that.
You logged in via a false login page and gave away your login info.
Steam in no such way was breached.
Also, is someone was going to hack you, they would target your bank account, not your gaming account.

You're all missing my point. 2FA/MFA is suppose to prevent this from happening. If it doesn't work, why use it at all? 2FA/MFA is front line defense of Your account, once You login, it queries You whether it's You. It did so. I didn't' even click "don't allow" and I was already logged out from my Steam Guard App on my mobile phone.

If you logged into a false login page, that means you gave your account name, password, AND your 2FA to the scammer.
When you give away the key, then you are at fault not the security company.

[HikariLight]

Publicado originalmente por nightstalker:

Publicado originalmente por Beardface31:

No breach.

Stop giving your information away.

Renamed it to "bypass", since Steam Authenticator can be easily bypassed, since the attacked/bot/botnet or whatever was attacking my account did bypass it. I never let the attacker in my account, I never had a chance to pick a choice, I was automatically logged out from my Steam Guard App on my phone. I opened the App with a request for a login from a new country/iP, after few seconds I was looged out from the App on my Android phone. Do You understand now?

There are billions of possible combos for an account name, then billions of possible combos for the password, then matching the password to the correct account name.
Then you have to guess the alphanumeric 2FA That changes to a randomly generated code every 30 seconds.
The chance of someone guessing or even trying to brute force it is impossible.
The only way someone can get into your account is because YOU gave them access.

[J4MESOX4D]

Publicado originalmente por nightstalker:

Publicado originalmente por HikariLight:

Steam's mobile authenticator code changes every 30 seconds to a new random code.
You cannot predict that.
You logged in via a false login page and gave away your login info.
Steam in no such way was breached.
Also, is someone was going to hack you, they would target your bank account, not your gaming account.

You're all missing my point. 2FA/MFA is suppose to prevent this from happening. If it doesn't work, why use it at all? 2FA/MFA is front line defense of Your account, once You login, it queries You whether it's You. It did so. I didn't' even click "don't allow" and I was already logged out from my Steam Guard App on my mobile phone.

No, 2FA is just an extra security layer. It DOES NOT prevent an account from being hijacked if your account, or device is compromised. If you believed that this is how it worked then you were sorely mistaken. If I have a burglar alarm on my house and give away my keys and the code, I can't then turn around and act shocked if my house gets entered and robbed.

Somewhere along the lines you either gave away your credentials to a phishing site or they were captured with targeting malware and the latter also includes material that can capture persistent login sessions whereby the token can be duplicated.

2FA as a concept on any site does not exist as a magical shield - it merely offers an extra independent layer of security.

[nightstalker]

Publicado originalmente por HikariLight:

Publicado originalmente por nightstalker:

You're all missing my point. 2FA/MFA is suppose to prevent this from happening. If it doesn't work, why use it at all? 2FA/MFA is front line defense of Your account, once You login, it queries You whether it's You. It did so. I didn't' even click "don't allow" and I was already logged out from my Steam Guard App on my mobile phone.

If you logged into a false login page, that means you gave your account name, password, AND your 2FA to the scammer.
When you give away the key, then you are at fault not the security company.

There was no giving of 2FA/MFA, no nothing. Absolutely. So try different argument. There was no false login page. And if it were false login page, I'd give one one time password, which expires after 30 seconds. So?

[nightstalker]

Publicado originalmente por J4MESOX4D:

Publicado originalmente por nightstalker:

You're all missing my point. 2FA/MFA is suppose to prevent this from happening. If it doesn't work, why use it at all? 2FA/MFA is front line defense of Your account, once You login, it queries You whether it's You. It did so. I didn't' even click "don't allow" and I was already logged out from my Steam Guard App on my mobile phone.

No, 2FA is just an extra security layer. It DOES NOT prevent an account from being hijacked if your account, or device is compromised. If you believed that this is how it worked then you were sorely mistaken. If I have a burglar alarm on my house and give away my keys and the code, I can't then turn around and act shocked if my house gets entered and robbed.

Somewhere along the lines you either gave away your credentials to a phishing site or they were captured with targeting malware and the latter also includes material that can capture persistent login sessions whereby the token can be duplicated.

2FA as a concept on any site does not exist as a magical shield - it merely offers an extra independent layer of security.

You're not listening to me. I'll go step by step:

- Today at 12:46 I've gotten push notification from my Steam Guard App on Android phone, that someone from Poland or somewhere [most likely VPN] is trying to login
- I opened the App, looked at it, and after few seconds, I didn't allow it, nor disable it, I was logged out of my Steam Guard App. I didn't log out from the App. I didn't literally do anything. It was in seconds
- After still at 12:46 to 12:47 I received three e-mails at once, almost instantly:

1st e-mail: Dear uplink_svk
The Steam Guard Mobile Authenticator has been removed from your Steam account.
If you did not perform this action, please follow the link below to lock your account and submit a request for assistance.
Lock my account

2nd e-mail:
"Hello uplink_svk
A phone number (ending in 65) has been removed from your account.
If you did not do this, your account may have been compromised. Please change your password immediately, or contact Steam Support."

3rd e-mail:
"Dear uplink_svk,
The email address associated with your Steam account has been successfully changed.
We are sending this notice to ensure the privacy and security of your Steam account. If you authorized this change, no further action is necessary.

If you did not authorize this change made from the computer located at 179.6.26.78 (PE), then please change your Steam password, and consider changing your email password as well to ensure your account security."

This all happened under 60 seconds. What are You talking about? The MFA/2FA was suppose to stop the guy or bot entering my account. He /it was not suppose to login without my approval of the push notification from the Steam Guard App. I never approved of the login from notification, never. This happened under 60 seconds, do You understand? Four things. Bot/guy entering my password, bypassing and ignoring my 2FA/MFA completely, logging me out of my Steam Guard App approximately at the same time as he was logging to my account, removing my GSM phone number shortly after, changing my e-mail right after, bam, end of story for me and my account.

There was no process that lasted minutes, hours, or even days.

Do You understand my issue now?

As You can see in a screenshot, it literally happened nearly instantly.

https://imgur.com/a/pFdsrfL

After I clicked the:

"If you are unable to access your account then you may use this account specific recovery link for assistance recovering or self-locking your account."

I clicked the "Specific recovery link." It said it was expired. At the time I clicked it.

After that all I could do was lock my account which I did.

[nightstalker]

After arduous there and back I managed to get through the process, now I await resolution to my account theft. Thanks for...well, at least a chat guys. I'll update this thread when/if I succeeded.

[ConStant]

Happened to me today.. stole a bunch of items in a trade.

[ConStant]

Publicado originalmente por ConStant:

Happened to me today.. stole a bunch of items in a trade.

https://i.gyazo.com/19ad3fa2f72d071fd7038be27d16a638.png

[HikariLight]

Publicado originalmente por ConStant:

Happened to me today.. stole a bunch of items in a trade.

The only way someone that isn't the account owner can get into the account is if the account owner gave away the account username, password, and 2FA.

[MancSoulja]

Publicado originalmente por nightstalker:

Publicado originalmente por HikariLight:

If you logged into a false login page, that means you gave your account name, password, AND your 2FA to the scammer.
When you give away the key, then you are at fault not the security company.

There was no giving of 2FA/MFA, no nothing. Absolutely. So try different argument. There was no false login page. And if it were false login page, I'd give one one time password, which expires after 30 seconds. So?

Log into my account then if its so easy, go on. If 2FA can be beaten without giving away your code, do it, show us.

[nightstalker]

Publicado originalmente por HikariLight:

Publicado originalmente por ConStant:

Happened to me today.. stole a bunch of items in a trade.

The only way someone that isn't the account owner can get into the account is if the account owner gave away the account username, password, and 2FA.

Finally, we're getting somewhere.

Someone could get my password, sure, I might had it leaked in the past. Username isn't that hard either, MFA/2FA? How?

So I confirmed the login? Is that what You're saying? Why would I confirm login from Poland, when I'm in Slovakia? This makes no sense.

And here we are. MFA/2FA is suppose to protect Your account, and when You don't confirm "it's You", it's not suppose to let You in. But here we are, attacker got in, and attacker changed things, that aren't suppose to be easy to change by a bot in under a minute. Yet it happened again.

Steam as a platform is running on an archaic system regarding everything. This is just another thing that bubbled over. Just look at the design of the client and forums, it looks like early 2000s designs. And MFA/2FA is obviously flawed.

Whole point of MFA/2FA is, that when I as the only owner and an only guy with activated device for Steam Guard don't give my say so, nothing happens on my account. Boy, do I have some news for You. It's not how it works. You can repeat Your blind faith creed in Steam how many times You want, it won't change the facts. Steam user protection is weak, has holes in it and vulnerabilities, otherwise, this wouldn't happen.

I've had some attacks on my MS account in the past. Attacker/bot never gotten past my 2FA/MFA, never. Also I didn't know about 90% of the attacks, because 2FA/MFA didn't bother to activate, when the login was from different country than my home country.

Steam should work the same. I live in Slovakia. I have my steam account for 23 years now. And I've never logged in from different country. And now, I had two logins in one day from two different countries.

Why did Steam system allow it in? Why didn't it want extra confirmation, whether it's me?

When my Credit Card was abused, bank called me at 3am and asked me, whether I'm in Philipines or somewhere and blocked the card immediately, when I said I wasn't.

Steam is leaky and unreliable and this is just another proof. MFA/2FA should be bulletproof. And You can even make it bulletproof, it's easy. Combine GeoiP/specific iP and 2FA/MFA and voila, no one can get in Your account.

I have like dozens of authentications from my static iP in my Steam log. And suddenly there was one or two from completely diffent country and iP. This is childs mistake on the side of Steam, to let someone from abroad do such operations. Total nonsense.

[HikariLight]

Publicado originalmente por MancSoulja:

Publicado originalmente por nightstalker:

There was no giving of 2FA/MFA, no nothing. Absolutely. So try different argument. There was no false login page. And if it were false login page, I'd give one one time password, which expires after 30 seconds. So?

Log into my account then if its so easy, go on. If 2FA can be beaten without giving away your code, do it, show us.

Scammers will steal your 2FA or send you malware via an infected link and steal you cookies or put a keylogger on your system.
There are many ways that scammers can steal your 2FA.
But that cannot brute force it.
The alphanumeric code changes every 30 seconds to another randomly generated code, you cannot predict that or hack it.
The only way someone gets into you account is because YOU gave them the keys to enter.

[HikariLight]

Publicado originalmente por nightstalker:

Publicado originalmente por HikariLight:

The only way someone that isn't the account owner can get into the account is if the account owner gave away the account username, password, and 2FA.

Finally, we're getting somewhere.

Someone could get my password, sure, I might had it leaked in the past. Username isn't that hard either, MFA/2FA? How?

So I confirmed the login? Is that what You're saying? Why would I confirm login from Poland, when I'm in Slovakia? This makes no sense.

And here we are. MFA/2FA is suppose to protect Your account, and when You don't confirm "it's You", it's not suppose to let You in. But here we are, attacker got in, and attacker changed things, that aren't suppose to be easy to change by a bot in under a minute. Yet it happened again.

Steam as a platform is running on an archaic system regarding everything. This is just another thing that bubbled over. Just look at the design of the client and forums, it looks like early 2000s designs. And MFA/2FA is obviously flawed.

Whole point of MFA/2FA is, that when I as the only owner and an only guy with activated device for Steam Guard don't give my say so, nothing happens on my account. Boy, do I have some news for You. It's not how it works. You can repeat Your blind faith creed in Steam how many times You want, it won't change the facts. Steam user protection is weak, has holes in it and vulnerabilities, otherwise, this wouldn't happen.

I've had some attacks on my MS account in the past. Attacker/bot never gotten past my 2FA/MFA, never. Also I didn't know about 90% of the attacks, because 2FA/MFA didn't bother to activate, when the login was from different country than my home country.

Steam should work the same. I live in Slovakia. I have my steam account for 23 years now. And I've never logged in from different country. And now, I had two logins in one day from two different countries.

Why did Steam system allow it in? Why didn't it want extra confirmation, whether it's me?

When my Credit Card was abused, bank called me at 3am and asked me, whether I'm in Philipines or somewhere and blocked the card immediately, when I said I wasn't.

Steam is leaky and unreliable and this is just another proof. MFA/2FA should be bulletproof. And You can even make it bulletproof, it's easy. Combine GeoiP/specific iP and 2FA/MFA and voila, no one can get in Your account.

I have like dozens of authentications from my static iP in my Steam log. And suddenly there was one or two from completely diffent country and iP. This is childs mistake on the side of Steam, to let someone from abroad do such operations. Total nonsense.

If you are using shady scam sites that disguise themselves as trade sites, they steal your login info.

[nightstalker]

Publicado originalmente por MancSoulja:

Publicado originalmente por nightstalker:

There was no giving of 2FA/MFA, no nothing. Absolutely. So try different argument. There was no false login page. And if it were false login page, I'd give one one time password, which expires after 30 seconds. So?

Log into my account then if its so easy, go on. If 2FA can be beaten without giving away your code, do it, show us.

You're a special kind of...right? ;). Jesus, I don't get it. I needed help and all I've got is 98% of people who totally don't understand what's going on and 1% that just criticize me.

So what? I made this whole thing up? I created false screenshots and made it up or why do I even bother writing all of these? Try to think at least on a level of pre-high-schooler, I'm here because my account has been stolen through all the possible protections. It means yes, someone might've obtained my user name and password, sure, but there's no way attacker should've gotten through MFA/2FA. It's the whole purpose of existence of MFA/2FA. It's suppose to be binary. You either let someone in or not. Nothing in between.

I've had exactly one device activated for Steam Guard. My phone, my Android phone, that's that. And I've gotten push notification. And I didn't do anything. And after few seconds my App was logged out, without me doing anything.

Btw. I scanned my phone with Eset Endpoint Security, it's enterprise level AVS solution. Guess what. Zero malware detected.

[nightstalker]

Publicado originalmente por HikariLight:

Publicado originalmente por nightstalker:

Finally, we're getting somewhere.

Someone could get my password, sure, I might had it leaked in the past. Username isn't that hard either, MFA/2FA? How?

So I confirmed the login? Is that what You're saying? Why would I confirm login from Poland, when I'm in Slovakia? This makes no sense.

And here we are. MFA/2FA is suppose to protect Your account, and when You don't confirm "it's You", it's not suppose to let You in. But here we are, attacker got in, and attacker changed things, that aren't suppose to be easy to change by a bot in under a minute. Yet it happened again.

Steam as a platform is running on an archaic system regarding everything. This is just another thing that bubbled over. Just look at the design of the client and forums, it looks like early 2000s designs. And MFA/2FA is obviously flawed.

Whole point of MFA/2FA is, that when I as the only owner and an only guy with activated device for Steam Guard don't give my say so, nothing happens on my account. Boy, do I have some news for You. It's not how it works. You can repeat Your blind faith creed in Steam how many times You want, it won't change the facts. Steam user protection is weak, has holes in it and vulnerabilities, otherwise, this wouldn't happen.

I've had some attacks on my MS account in the past. Attacker/bot never gotten past my 2FA/MFA, never. Also I didn't know about 90% of the attacks, because 2FA/MFA didn't bother to activate, when the login was from different country than my home country.

Steam should work the same. I live in Slovakia. I have my steam account for 23 years now. And I've never logged in from different country. And now, I had two logins in one day from two different countries.

Why did Steam system allow it in? Why didn't it want extra confirmation, whether it's me?

When my Credit Card was abused, bank called me at 3am and asked me, whether I'm in Philipines or somewhere and blocked the card immediately, when I said I wasn't.

Steam is leaky and unreliable and this is just another proof. MFA/2FA should be bulletproof. And You can even make it bulletproof, it's easy. Combine GeoiP/specific iP and 2FA/MFA and voila, no one can get in Your account.

I have like dozens of authentications from my static iP in my Steam log. And suddenly there was one or two from completely diffent country and iP. This is childs mistake on the side of Steam, to let someone from abroad do such operations. Total nonsense.

If you are using shady scam sites that disguise themselves as trade sites, they steal your login info.

You're having massive issue understanding of how MFA/2FA works. Here' a video, so You'd understand.

https://www.youtube.com/watch?v=UhANsAtvLN0

Because if 2FA/MFA can be spoofed, well, than it's useless, that's all. If it can be bypassed, it's useless. Someone had to be on my phone, remotely, or hijack data stream from server to my App and decrypt the data stream to obtain it. It's literally impossible.