SRL Archive - NOTA

Dear Steam Users and Steam Forum Users:

Our Steam forums were defaced on the evening of Sunday, November 6. We began investigating and found that the intrusion goes beyond the Steam forums.

We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating.

We don’t have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely.

While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login. If you have used your Steam forum password on other accounts you should change those passwords as well.

We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords (which are separate from forum passwords). However, it wouldn’t be a bad idea to change that as well, especially if it is the same as your Steam forum account password.

We will reopen the forums as soon as we can.

I am truly sorry this happened, and I apologize for the inconvenience.

Gabe.

I don't want any of you QT's getting your info stolen so possibly change your stuff and watch your cc!

Very ouch indeed, and also…AMATEURS! Lucky I have never filled in my CC :)

Does it mean Episode 3 is going to be delayed ? <trollface>

From: WT-Fakawi
Very ouch indeed, and also…AMATEURS! Lucky I have never filled in my CC :)

Best post I saw on other forums:

Fucking hell. This is what I get for associating my credit card with things. First XBL and now this. Why in the fuck would they host the forums from a machine with any access to the main steam database?

Why are you so concerned about your credit card number?

1) It's encrypted with AES in their database.
2) It isn't saved unless you chose to have it saved.
3) What's the worse they can do? You can easily chargeback any payments you didn't authorize and get a new credit card number.

Of course there aren't "fun" steps to follow, but they aren't difficult in the rare chance someone grabs your numbers and CVV.

Valve only mentioned all this stuff because it "COULD" have been stolen.

Basically just watch your CC, in order to steal the steam account they would need both your Steam AND email password. So most people should be just fine, and they say CC info was encrypted too.

From: YoHoJo
Basically just watch your CC, in order to steal the steam account they would need both your Steam AND email password. So most people should be just fine, and they say CC info was encrypted too.

yea if they crack it then I'm sure we'll see a lot of news about steam cc's being used etc

I have to verify all purchases on my cc anyway, so I don't really care, when I see a million dollar "laser" purchased by dr evil to control the moon I'll reject it

Wow indeed scary stuff.

From: grats
yea if they crack it then I'm sure we'll see a lot of news about steam cc's being used etc

I have to verify all purchases on my cc anyway, so I don't really care, when I see a million dollar "laser" purchased by dr evil to control the moon I'll reject it

Yeah you do that!

From: kingarabian
Wow indeed scary stuff.



Yeah you do that!

Unless Dr evil lets me be his right hand man…

From: grats
yea if they crack it then I'm sure we'll see a lot of news about steam cc's being used etc

I have to verify all purchases on my cc anyway, so I don't really care, when I see a million dollar "laser" purchased by dr evil to control the moon I'll reject it

If they manage to crack it they'd probably make more money sharing the exploit considering the government and various bodies that over see the AES encryption would pay a large amount of LEGAL money to get it.

Though I'm not really concerned considering it's encrypted with a AES 256 bit key, salted and hashed. I'll be long gone before they get any information about me.

hasn't that been cracked a while ago?

From: grats
hasn't that been cracked a while ago?

No. See Public Key Cryptography.
http://en.wikipedia.org/wiki/Public-key_cryptography

It is poossible but woud take months if years just to create a half good rainbow table capable of cracking I myself tried to crack my own 256 AES wpa2 wireless network with an amazing
172gig rainbow table which still failed to crack

Knowing all these thing, and I'm talking in general, I'm still too lazy to use different passwords on all the sites. Have 10 of them at most, on 100 sites.

From: CRU1Z1N
It is poossible but woud take months if years just to create a half good rainbow table capable of cracking I myself tried to crack my own 256 AES wpa2 wireless network with an amazing
172gig rainbow table which still failed to crack

lol! I haven't even tried to crack my 256bit aes wpa2

I can get my neighbors wpa w/e it is with backtrack, don't think wpa2 is worth cracking.. by the time (if even possible on my machine) it would be cracked I could drive a block down and find a wep