Steam forum 3.8.7 got hacked

[Lloyd M.]

Hey! I got all it from my blog, here it is!

Valve CEO Gabe Newell has contacted all users of the Steam game distribution platform to let them know that the company has suffered a security breach. Right before going offline, users saw a new category in the forum that directed them to open a site named "Fkn0wned." Many users also complained that their email ids related to Steam accounts were "spammed with ads for the web site.
Valve recommends all users to keep closely watched the activity of their credit cards because the hackers had access to that information during the attack. Forums Steam are closed for the moment, but the program itself is running.
" We have no evidence that the numbers encrypted credit card or personal identifying information was taken by intruders, or the protection of card numbers or passwords have been cracked . We are still investigating , "Newell wrote. " At the moment we have no evidence of misuse of credit cards but we recommend that you carefully monitor the activity of their credit cards . "
The data base was attacked, " contains information including user names, passwords , shopping, e-mail, billing address and information encrypted credit card , "he added. The Steam forums are not working as Valve conducting the investigation and recovers from the attack. When forums are back will require that all users change their passwords as well as it is advised that users who used the same password for forums on other sites also change.
" We do not know of any account of Steam that has been affected, so we are not forced to change the passwords of the accounts of Steam who are separated from the passwords on the forum, but no change would be a bad idea anyway, especially if they are the same as the forum. I am very sorry that this happened, and I apologize for the inconvenience , "he concluded Newell.

[Warden]

Steam forums are back online:

http://forums.steampowered.com/forums/index.php

[Maestro_1234]

Aww man that message they put up was funny, I agree with the vB mod, seems mild and not too bad, but I gotta ask, why would one hold off from upgrading their forums, I always thought it would be rather painless but then I havent really done anything with vB in production

[Warden]

That's great. I have bought a lot of games through them and now they may be compromised? Looks like I will be viewing my bank statements and credit report more carefully.

[Maurd]

Wonderful.

Funny part is, if it weren't for having the free Portal giveaway a few weeks ago, I wouldn't even have a Steam account.

Oh well. At least I wasn't a forum member..

[Yves R.]

It seems Valve is sending an email to their users about this issue:

Dear Steam Users and Steam Forum Users,

Our Steam forums were defaced on the evening of Sunday, November 6. We began investigating and found that the intrusion goes beyond the Steam forums.

We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating.

We don't have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely.

While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login. If you have used your Steam forum password on other accounts you should change those passwords as well.

We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords (which are separate from forum passwords). However, it wouldn't be a bad idea to change that as well, especially if it is the same as your Steam forum account password.

We will reopen the forums as soon as we can.

I am truly sorry this happened, and I apologize for the inconvenience.

Gabe.

[Ekshi]

nice man

[aussiefooty]

Steam forum 3.8.7 got hacked

Wow! How scary! Here's hoping that the hacker gets caught and you get your forum back.

[punchbowl]

it'll be the steam connect api not vb

[Wayne Luke]

Maybe they installed a product (or made one) without enough security...

They have custom code to tie the forums into their Steam account system as far as I am aware. We'll never know for sure though unless they contact us directly or post an announcement.

[Yves R.]

Maybe they installed a product (or made one) without enough security...

[Wayne Luke]

We don't know what the issue was. They haven't contacted us about it. They haven't opened a ticket with us in almost 5 years now.

[AlexanderT]

All very mild... No pron, no dancing babies... Someone simply wanted to make a point.

Nothing mild if at the same time members receive spam sent to their registered e-mail addresses.

From Techspot:

At this point it’s unclear whether any private data like passwords or billing information has been compromised. ... If we had to take a guess, we’d point the blame at Valve’s use of forum software vBulletin which has seen its share of security breaches in the past.

[Wayne Luke]

All very mild... No pron, no dancing babies... Someone simply wanted to make a point.

[Warden]

Here is another picture of what the people did to their forums:

http://img560.imageshack.us/img560/2333/forumspoweredbyvbulleti.png

They made a forum linked back to their site and announcement. However, I think Anders got it right by someone stealing an admin password and doing this.