Do not link your Steam account to Discord (Account compromise)

[Antynah]

(English isn't my first language so sorry for any grammar mistakes!)

Between September 20th and 26th, I joined a Discord server I found on the dashboard. On that server, there was a security check bot, and all I had to do was give it access to my Discord account. Since that’s common on servers and all bots, I accepted.

I didn't log into my Discord account for a couple of days—maybe two? I’m not sure. When I finally did, I noticed I was in a server I hadn’t joined before, but it looked similar to the one I had joined earlier. It seemed strange, but I didn’t think much of it, just left the server and moved on.

Then, on September 30th, my Discord account got hacked. Dozens of people were spammed with Steam gift card links in their DMs. I found out because my girlfriend told me she received a weird link from my account. After that, I deleted all the links, informed everyone, and changed my Discord password. I suspected the bot was behind this, so I disconnected it from my account. I checked my email and Steam account right after, but there was nothing unusual.

On October 15th, I logged into my Steam account to play something and noticed some currency in my wallet. I had never bought or had credits there. That’s when I realized they had sold all my trading cards without me knowing. Steam never notified me about it. When I checked my email, I saw that they had only sent a notification about a trade on October 13th for a Dota 2 card, which I don’t even play.

After that, I changed my emails and passwords for all my accounts. I think everything is resolved now, but I'm still worried. I never allowed the bot access to my Steam account and never logged in on another site, yet they still managed to hack it easily :(

(Just letting you know that, prior to this, both accounts had two-factor authentication enabled)

(EDIT: I use my pc mainly for college and occasionally for gaming. I only use Discord for work purposes, I don't enjoy using Discord but it's the only way to stay in touch with my clients.)

(EDIT 2: I forgot to mention earlier, but both my Discord and Steam accounts were compromised on the same day and around the same time (the night of September 30th). Just a reminder that I’ve only ever logged into my Steam account through the official Steam app/program and through Discord years ago to link it. Thanks so much to everyone who provided some explanations about it!)

[Maria]

Originally posted by Satoru:

That's literally it. Hijacking a Discord account doesn't give you any access to your steam account in any way.

Yea this.

OP's steam account got compromised isn't because of the link, but whatever the suspicious bot did to their discord has allowed them to steal their browser cookies.

[Chalupacabaras]

Originally posted by Maria:

Originally posted by Satoru:

That's literally it. Hijacking a Discord account doesn't give you any access to your steam account in any way.

Yea this.

OP's steam account got compromised isn't because of the link, but whatever the suspicious bot did to their discord has allowed them to steal their browser cookies.

It's possible to hijack a Steam account by using a remote-login token exploit -- https://www.reddit.com/r/discordapp/comments/vvnk19/the_recent_discord_hack_issues_make_use_of_an/?rdt=45905

A more technical security explanation of how it works, from Sophos (2021) -- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/

And the really big brain technical explanation, with fixes, from MITRE/ATT&CK -- https://attack.mitre.org/techniques/T1134/

Never say "never" when it comes to bad actors. They specialize in making software do what it's not intended to do by making it do exactly what it's designed to do. Discord isn't the only platform being used as a deployment vector, neither is Steam.

EDIT: Also, it's 2024... who the hell still uses Discord?

[SuperFighter988]

Linking another service carries risks and does not guarantee safety if you are unsure how to manage it.

[Maria]

Originally posted by Chalupacabaras:

It's possible to hijack a Steam account by using a remote-login token exploit --

Reddit post is about the consequences of losing your Discord token or getting your Discord hacked, and your billing address may get exposed in the process.

The third link is technical stuff.

The second link is interesting. They mentioned that

Discord token loggers steal the OAuth tokens used to authenticate Discord users, frequently along with other credential data and system information—including tokens for Steam and other gaming platforms. They “log” stolen tokens back to a Discord channel through a webhook connection, allowing their operators to collect the OAuth tokens and attempt to hijack access to the accounts.

The token loggers steal tokens for steam.. but what token? It couldn't possibly be steam account's credentials because steam won't share it with Discord.

By signing into xyz through Steam:
your steam login credentials will not be shared
a unique numeric identifier will be shared with xyz, Through this, xyz will be able to identify your steam community profile and access information about your steam account according to your profile privacy settings
any information on your Steam Profile page that is set to be publicly viewable may be accessed by xyz.
By clicking "Sign In" you agree to this data being shared.

Originally posted by Kargor:

"Login through Steam", in and of itself, is perfectly safe. This basically gives the 3rd-party website an identifier for your account and confirms to them that the guy using the browser is the owner of that account. It does not give them any authority over anything, and it does not allow them to view non-public items on your account.
...

Steam also uses the same safeguard linking for other 3rd parties sites, not just Discord. For discord hackers to successfully pawn a linked steam account inside them would also imply that every other safeguard 3rd party link that steam offers is at risk.

[Chalupacabaras]

Originally posted by Maria:

The third link is technical stuff.

Yeah, sorry about that. Never been one to turn down a really good IT rabbithole.

The second link is interesting. They mentioned that

Discord token loggers steal the OAuth tokens used to authenticate Discord users, frequently along with other credential data and system information—including tokens for Steam and other gaming platforms. They “log” stolen tokens back to a Discord channel through a webhook connection, allowing their operators to collect the OAuth tokens and attempt to hijack access to the accounts.

The token loggers steal tokens for steam.. but what token? It couldn't possibly be steam account's credentials because steam won't share it with Discord.

Steam installs a tracking pixel by default, "steam.png", at C:\Program Files\WindowsApps\Microsoft.GamingApp_2312.1001.18.0_x64__%PUBLISHERID%\Assets\LinkedAccountsBranding - that's the official version, according to Steam Support. In some cases, there may also be one named "[e-mail]", the unauthorized version.

Also, Steam installs via Administrator rights even if you do it with user level privileges. This allows for an additional escalation to install system-level files and DLLs, including a text file called "VulkanEULA.txt", which the user typically wouldn't notice unless they had a reason to go looking. Can't remove them through normal access means, and in some cases they've overwritten the original OS versions so they can't be removed at all.

Then there's the reality that we're accessing Steam's services through a Windows 7 DOM, with vulnerabilities like CEF, WebClient leaks and other fun deprecated exploits that defeat the purpose of "as of January 1, 2024, Steam will only be compatible with Windows 10 or higher." Normally this would be seen as a user-side issue, and it should be, except Microsoft backported Win10 functionality to Win8/8.1 and Win7 around mid-2018.

By signing into xyz through Steam:
your steam login credentials will not be shared
a unique numeric identifier will be shared with xyz, Through this, xyz will be able to identify your steam community profile and access information about your steam account according to your profile privacy settings
any information on your Steam Profile page that is set to be publicly viewable may be accessed by xyz.
By clicking "Sign In" you agree to this data being shared.

By default, the Steam Client Services folder is a RAT named "~nsu.temp". Valve doesn't have to "share" your data, they've already allowed whatever's on Microsoft's webservers to piggyback directly into your machine at the system level.

I'm probably simplifying things a bit, but either way the whole setup is less secure than a screen door hatch on a submarine. Even less so than when Valve got busted for the SteamChina spyware incident in 2021.

Originally posted by Kargor:

"Login through Steam", in and of itself, is perfectly safe. This basically gives the 3rd-party website an identifier for your account and confirms to them that the guy using the browser is the owner of that account. It does not give them any authority over anything, and it does not allow them to view non-public items on your account.
...

Steam also uses the same safeguard linking for other 3rd parties sites, not just Discord. For discord hackers to successfully pawn a linked steam account inside them would also imply that every other safeguard 3rd party link that steam offers is at risk.

If it exists, it can be compromised. API, TLS, stuff like that is child's play.

EDIT: CSS is why I troubleshoot, I don't code.

[Maria]

Originally posted by Chalupacabaras:

/snip

Firstly, I need to apologize since coding isn't really a domain I excel at, I cannot confirm nor deny, but I believe that I get what you are trying to say.

Still, I'm having a hard time processing all this because I'm always under the impression that 3rd party link is fairly safe. I understand the idea that no system is safe, but idk that the issue is as big as you said.

Say, if someone got their steam account hijacked with this method, aren't they eligible for a refund/unban? Their discord getting hijacked is their fault, but for their steam to also get hijacked from only linking it isn't their fault, imo.

[Chalupacabaras]

Originally posted by Maria:

Originally posted by Chalupacabaras:

/snip

Firstly, I need to apologize since coding isn't really a domain I excel at, I cannot confirm nor deny, but I believe that I get what you are trying to say.

No worries, it's all good.

Still, I'm having a hard time processing all this because I'm always under the impression that 3rd party link is fairly safe. I understand the idea that no system is safe, but idk that the issue is as big as you said.

Third-party links are a really old trick, you can spoof a legitimate link using HTML or use a URL that looks similar enough to easily overlook the difference (typosquatting). The key is knowing your target audience, a perfect example being the "$50 CS:Go gift card" phishing scam that pops up regularly in Steam Group Chats.

With Discord, a lot of users are also heavy YouTube content consumers... many of whom are old enough to know that watching online pirated movies is a bad idea, but not old enough to know about streamjacking or how it works.

Third-party apps operate similarly to links, they can direct the connection to a webserver which runs the services being accessed. It's much more difficult to detect an attack because it relies on observation, and most users will chalk the problem to incompetent programmers -- instead of webserver-side issues.

Which is how the Discord app can compromise users' devices so easily. Old enough to learn, not old enough to understand the importance.

Say, if someone got their steam account hijacked with this method, aren't they eligible for a refund/unban? Their discord getting hijacked is their fault, but for their steam to also get hijacked from only linking it isn't their fault, imo.

No, they're not eligible. Valve is only responsible for providing Steam's services, the user is responsible for whatever happens with their account. Food for thought: if a user's account gets hijacked and the third-party posts illegal content (the "FBI OPEN UP!" kind of illegal content) on said account, that's also on the user who now has to prove it wasn't them.