Users of Steam were informed on May 13th that Valve, the gaming giant, had been impacted by some sort of hack. A person going by the moniker “Machine1337” was selling a wealth of information that included old Steam two-factor authentication codes, text metadata, and phone numbers. Even though it was clear that these codes were out of date, it was still unclear who had been compromised. Given their reference in the data, Twilio was first blamed; however, both Valve and Twilio denied using their services and that there had been a breach. I asked Valve a lot of questions, and they responded with the following comment. To put it succinctly, Valve affirms that the data is authentic while denying experiencing any breaches of its own.
We learned yesterday that prior text messages that had previously been delivered to Steam customers had been leaked. After analyzing the leak sample, we concluded that there was no breach of the steam systems.
We’re still investigating the origin of the breach, which is made worse by the fact that all SMS messages are sent through several providers and aren’t secured while in transit. Older text messages with one-time codes that were only good for 15 minutes and the phone numbers they were sent to were among the leak’s contents. The phone numbers were not linked to a Steam account, password, payment information, or any other personal information in the compromised data. When a code is used to update your Steam email or password by SMS, you will receive a confirmation via email and/or Steam secure communications. Additionally, old text messages cannot be used to compromise the security of your Steam account.
Customers do not need to update their phone numbers or passwords as a result of this incident, according to Steam. This serves as a helpful reminder to be skeptical of any account security warnings that you have not specifically asked for. It is advised that you periodically check the security of your Steam account at https://store.steampowered.com/account/authorizeddevices.
If they haven’t already, we advise Steam users to install the Steam Mobile Authenticator since it provides the most secure means of communicating with them on the security of their account.
Although it’s wonderful to finally understand the problem, it also poses a significant query. Where was the breach? Since SMS communications are routed through numerous providers, as the statement notes, it will likely take a lot of investigation to determine the origin of the incident. For instance, Valve might have contracted with one or more middlemen to distribute SMS codes, and in some areas, one of those intermediaries might have been compromised and contracted with Twilio to send messages on its behalf. Remember, this is all conjecture, and it’s anyone’s guess as to where the breach actually came from.
Users will still have legitimate concerns, but fortunately, there is no need to reset your password now that we have assurance that Valve itself was not compromised. Even though the dataset just includes messages and phone numbers, those figures can be coupled with other datasets to provide a more comprehensive picture of a certain person. Targeted phishing attacks involving a person’s real name and Steam account could leverage that, together with the language the text was received in. By no means is it a pointless breach, but fortunately, its reach is quite constrained.Currently, using the Steam Mobile Authenticator instead of SMS 2FA codes is the best way to secure yourself, as advised by Valve. Because codes can be collected by impersonating a user’s phone number, SMS 2FA is intrinsically insecure. For the best online account security, always use 2FA in conjunction with a password manager.
Also Read:
Rapper Yung6ix Laments, “I Need Help Quitting Smoking Because I’ve Been Smoking For 21 Years.”
