How can people buy/sell on the market from accounts they have no access to?

[kannakamui.de]

Hello,

I have now had multiple friends that had this happen to them. One was just an idiot and nuked himself by logging in into a phishing site, but a few others did not. At least 3 of them are tach fanatics and log everything that happens on their machines and network, so we could check for anything that happened. And never was there any request from their network.
Their data has never been leaked, they all use 2FA, they all have proper passwords. 2 of the 3 are 100% hikikomori and never leave their living space, so external spoofing/phishing can't happen.
On all sysetms the device list was clean and only their computer was in the list.
They had no external logins, no mail about a login, no 2fa app confirmations for any sales.

Today another friend of mine called me with a fear struck through their bones. At the time they were sleeping (All devices are turned off at night) at around 3am local time someone bought an item overpriced for their whole steam wallet money. Then sold the item instantly for 2 cents.
So they bought the item from one of their own accounts for too much money to send it to another account.

Now they read those mails only on the way home and instantly called me. I instantly gave them TVQS to check their system. I instantly checked the authorized devices, they were all clean, we killed them none the less. We changed the Password, we made steam create a new list of backup codes and sent a steam ticket.

now the fun part: AFTER we did this they suddenly got 10 new mails that they would have put 10 items from their inventory into the market place and bought yet another overpriced item and sold it again for 2 cents.
This was while I was connected to the only allowed device. There was nothing running on the system, the system was clear, the devicelist still only had this one single device on it.

How is that possible? I was live connected to see this.

I always thought it'S always the fault of those people but seeing it live happen without anything running on the system, all clean.

How?

I really wanna know, because what else can you do to protect yourself from that?
I don't wanna wake up to an inventory... This is really scary

[J4MESOX4D]

There is nothing else - it's phishing. You can go through every mental gymnastic move imaginable and even claim your friend's PC's were blessed by the Pope but at the end of the day, the leak is created by them as their credentials and confirmation is the only way to get into an account so unless the scammers are psychic and can mind-control your buddies, it's the same old result from the same old scams no matter how you dress it up or beg that it's something else.

Stop wasting time on this nonsense to gatekeep your irresponsible friends.

[pckirk]

Have them contact Steam Support for any further aid with account problems. Everyone here gave you the correct advice and info. You chose not to listen, so move on instead of arguing with everyone in this thread.

[Crazy Tiger]

Nguyên văn bởi kannakamui.de:

So please, just for once: Try to think of something else and just pretend I know what I am talking about and I know what I did. Just for this one thread. Thank you.

Yet you show you don't know what you're talking about and rather engage in fantasy narratives than reality.

So, once you come down back to earth and we can talk realism, we talk further. Just for once. Thank you.

[ペンギン]

Nguyên văn bởi Thermal Lance:

Nguyên văn bởi kannakamui.de:

Then how can this happen while I have a netstat running to check any kind of connection of the device and it did not show anything neither before nor after we de-authed all devices?
If the computer was infected by anything you would have seen the connection in netstat. There is no way you can connect without being seen there.
And since all devices where de-authed, even if the data was known, an old login would have existed or a cookie for webbrowser would have been stolen it would have been made unusable when de-authing all devices.

Trust me, if the 2FA system Valve use was to fail. We would know, oh hell yes, we would know.

If you want to go on a wild goose chase over something that is very well understood. Be my guest. But, my time is too valuable for it. Have a great day.

Is that so? Not necessarily.

First of all, after a breach there is silence to identify the problem and Valve is not exactly known for open communication (not even with past compromized platform issues). Not to forget, many leaks about security gaps often become public months later.

@Kanna
You won't get any answers from users here, since noone has real insights and contact Valve directly, you won't get an answer either.

Even if users would did it, the posts would quickly disappear as they would jeopardize the platform's integrity. There are things you don't talk about on public channels.

[Kargor]

Nguyên văn bởi ペンギン:

First of all, after a breach there is silence to identify the problem and Valve is not exactly known for open communication (not even with past compromized platform issues). Not to forget, many leaks about security gaps often become public months later.

Oh yes, the gold old "if there's no news about a security issue, then there's a security issue that's kept under wraps".

Have you ever considered that if there's no news about a security issue, there might not actually be a security issue?

Either way, there's definitely not more "my account was hacked and I'm completely innocent" threads than usual. Doesn't feel like there's a secret security issue making the rounds.

[ペンギン]

Nguyên văn bởi Kargor:

Have you ever considered that if there's no news about a security issue, there might not actually be a security issue?

Would be the optimal state. Otherwise, I agree with you.

[Yandy]

If you need help with Account Security or Recovery, please contact Steam Support.