Security improvement

[tenshi_a]

Hello,

I had my account hacked this week. It was via a website which was I think must have been using a fake OAuth login for Steam.

I will tell you what happened:

* The site asked me to log in using Steam
* I clicked on the button to allow me to do so, then entered my username and password.
* It prompted me for my two factor authentication code, which I got from my phone.
* It immediately said the code was expired and asked me to re-enter the two factor authentication code. So I did. [in retrospect, the hack must just need two separate 2FA codes]
* Immediately, before a second had passed, I was locked out of my account.
* I then received some emails from Steam:
a) my phone had been removed from my account
b) mobile authentication had been removed from my account
c) my email address was changed.

So then I had to go down the sad and scary path of recovering my account.

I would like to make the following suggestions as to how to improve security so that fewer people get their accounts hacked:

1) Stop hackers from being able to remove phones from accounts. I am not sure how they did this, but please - if a person wants to remove the phone from an account, make them confirm it via a code received in email. Make this step harder for hackers to do.

2) If a person wants to remove steam mobile authenticator, ask them to type in their secret Steam Guard code. The one they get when setting it up. Or - make them confirm it via a code received in email.

3) If the phone number has changed on an account and mobile authentication has been switched off in the last X hours, do not allow the user to change their email address.

I am thinking these measures should help stop people from hacking our steam accounts, and while there are extra steps, they are understandable barriers for a bit of additional security on steps that are critical when an account is being stolen.

[Satoru]

1) there is no functional way to prevent “hackers” from removing anything unless you fundamentally prevent actual users from doing so

2) you cannot remove the Authenticator without a steam guard code. Which you conveniently gave to the attacker

3) the system already asks for authentication to change your email. Again you GAVE THAT to the attacker. Note that the email you get also has a self locking tool as well

Do you know what stops “hackers”

Stop logging into scam websites

Steam can’t prevent you giving away your home keys to a thief. So you know stop doing that

[The End.]

Originally posted by tenshi_a:

Security improvement ... I had my account hacked this week.

Security is good as it is, phishing is not hacking, it's you giving away your credentials to a scamsite.

Originally posted by tenshi_a:

* The site asked me to log in using Steam
* I clicked on the button to allow me to do so, then entered my username and password.
* It prompted me for my two factor authentication code, which I got from my phone.

See, that is not a problem with the security, that is a problem with you and lack of common sense.

Solution, do not use your steam credentials anywhere else than Steam.

[tenshi_a]

There's no need to attack me so viciously.

I am telling you - people put trust into Steam's OAuth as a means of identification, and they put trust into Steam's Two Factor Authentication as a means to prevent hacking - but it turns out this trust means nothing when a website mimics the interface perfectly. This is a problem. OAuth and 2FA on their own are not strong enough - they aren't magical.

There are holes that hackers are using - have used just this week - and they need strengthening. When I reported my account stolen, there was 30000+ other accounts in the queue for Steam account recovery. I mean - I've lived in towns that had fewer people in them than the queue for 1 single day of reported steam account hacks. This is not good enough! This indicates there may be huge data breaches.

Companies get in huge trouble for allowing data breaches, as I'm sure you know, and this is on a massive scale.

These holes in security need looking at. The current system is inadequate.

[The End.]

Originally posted by tenshi_a:

These holes in security need looking at. The current system is inadequate.

Again, there is no holes in the security, the "holes" is on your end, not something Valve can fix.

[wuddih]

user fail cannot be prevented.

the alleged addressbar of the alledged convenient popup window was fake. legitimate sites do not use popup windows for open id. they completely navigate to the openid provider and that refers back on success because that is how the system is supposed to work.

simply login in official steam website first. any legitimate site that uses openid from Steam will then no longer display username/password, it will display your profile name and a button, you dont have to enter anything.

again, user fails are no holes in the system. no system was breached, you gave your credentials away because mis/non-education.

Originally posted by tenshi_a:

When I reported my account stolen, there was 30000+ other accounts in the queue for Steam account recovery.

Steam has close to a billion user accounts, the majority of those tickets are probably not because of what you did but because people simply forget stuff.

[Satoru]

If you don’t want to be “attacked” then stop pretending that OAuth is the issue

You got phished

That’s not a problem with OAuth

It’s not a problem with security

It’s a USER PROBLEM

All of your “solutions”

1) do not adddress any actual security issues
2) do not prevent hijacks
3) do not address post hijack scenarios either

[tenshi_a]

I've just detailed how hackers have a system that can take over an account in a split second, they have an automated system set up and I've described how that can whole racket be defeated with just a few steps.

Why are you guys so pro-criminal?

[Satoru]

Originally posted by tenshi_a:

I've just detailed how hackers have a system that can take over an account in a split second, they have an automated system set up and I've described how that can whole racket be defeated with just a few steps.

Why are you guys so pro-criminal?

Again if you get phished that is functionally a user issue

This is like going to Absa Abbloy and complaining their locks are garbage after you gave your keys to a drunk hobo behind the dumpster at BestBuy and are SHOCKED someone broke into your home via the unlocked front door

NONE of your “solutions” fix anything

Pointing out your ideas are terrible and do not actually solve the real problem is not “pro criminal”

You just refuse to acknowledge you are the weakest part of the security chain

[tenshi_a]

And I didn't say there's a problem with OAuth and 2FA, I am not saying - we need to get rid of those. I am saying you can't just plonk them in and act like the job's done.

Allowing a hacker to steal entire accounts instantly through a single login interface is a problem.

There need to be more barriers there to protect a few critical security events -

* removing a phone (since it houses mobile authentication)
* removing mobile authenticator (since using mobile authenticator to allow removal of mobile authenticator is circular)
* changing email address within seconds of removing mobile authenticator should be an obvious red flag.

Imagine if someone had their account stolen and you were looking at the data logs. If you saw these three events occurring within seconds, you would know just from that, that they had their account stolen.

Sometimes it's not good enough to just trust in the status quo. Sometimes you need to be active and fix security problems.

[tenshi_a]

And I will admit that what I did was foolish. When I'd done it, I felt like such an idiot.

But that doesn't mean that I feel like all similar idiots need to be punished.

When you do something stupid, you get up, take a look, and see how you could have done things better, right?

So - this attack can be beaten.

You must never get so complacent when it comes to security.

Never roll over and ignore when you've found a hacker's attack vector.

You've got to do all you can and fix what you can.

Protect the stupid customer, because they put their trust in you.

Because trust is profitable.

[The End.]

Originally posted by tenshi_a:

And I didn't say there's a problem with OAuth and 2FA, I am not saying - we need to get rid of those. I am saying you can't just plonk them in and act like the job's done..

Exactly, Valve did what they could do, the rest is up to you, common sense and don't give away account credential on thirdpartysites.

Originally posted by tenshi_a:

Sometimes you need to be active and fix security problems.

The only problem here to fix is the user, that is not something Valve can do anything about.

[Satoru]

It’s called phishing

You gave away your credentials to the attacker

Once you give away your credentials you are fundamentally authorizing the attacker

The attacker looks legit because YOU GAVE THEM authority

[tenshi_a]

If you ever think you can fix an IT security problem by fixing the user, you'd die in 30 seconds working in IT, hahaha.

[Theblaze]

You basically want Valve to hold your hands.

Steam isn't a care center, if you can't take care of yourself you put yourself at risk.

[7]

Originally posted by tenshi_a:

If you ever think you can fix an IT security problem by fixing the user, you'd die in 30 seconds working in IT, hahaha.

This isn't an IT problem though, this is you not knowing how to protect your account by logging into sketchy sites.