Serious Leak Was Hijacking Steam Accounts Child

A serious vulnerability in the popular gaming service Steam ensured that users' accounts this weekend could be hijacked by childishly simple way. The only thing that an attacker would need to gain access to an account was user of the user name.

The vulnerability was in the password reset function. When changing a password, please send Valve, the developer of Steam, a code to the email address of the user. This code must be entered before the password can be changed. However, a bug meant that this code was not necessary. An attacker who did not fill in the code could just click Continue, and then reset the password and gain access to the account, such as this video shows.

Bug

Valve late in a response to gaming website Kotaku know that it was a "bug" and the problem was discovered on July 25.Meanwhile, the bug would be fixed. To protect users of all of the accounts with "suspicious password changes" the password will be reset. Users in this case will receive an email with a new password. In addition, Valve states that accounts using Steam Guard, the two-factor authentication of the gaming service, attackers could also log if it was changed password.

Steam has 125 million users worldwide. Through the platform, users can buy all sorts of games and digital objects. Some research argue that sold 75% of all PC games through Steam. Steam Accounts with many games or digital goods are also a favorite target. How many users it has been hijacked account is unknown, but on Reddit let readers know that several known players, the victim became.

Free Hosting Company Hosts 90% Of Steam Phishing Sites

The Lithuanian hosting company Host Inger, which offers free hosting, is responsible for 90% of phishing sites that have provided on Steam users. That says Netcraft. Last month the Internet company saw more than 1,400 links to Steam phishing links that pointed to 331 different websites.

Ninety percent of these websites were hosted by Host Inger. Steam has 125 million users worldwide. Through the platform, users can buy all sorts of games and digital objects. Some research argue that sold 75% of all PC games through Steam.Steam Accounts with many games or digital goods are also a favorite target of cyber criminals, who approach often users via chat or other parts of the platform.

Where cyber criminals often previously registered domain names resembling those of Steam, are now mostly free subdomains via free hosting companies registered as Host Inger. According to Paul Mutton of Netcraft free hosting companies is a logical choice for Internet scammers who want to perform phishing attacks without leaving a financial trail.

Hosting

When it comes to Host Inger would be a very attractive partner for free hosting companies, Mutton notes, since the hosting company does not display ads on the websites of clients and offers PHP support. Almost all phishing kits that are used in phishing attacks written in the programming language PHP. Still, the popularity with Steam phishers is striking, since Host Inger was used for only 0.6% of all other blocked phishing attacks in March. According Mutton may be that the criminals behind the Steam phishing attacks each copy methods. It also appears that Steam phishing sites with Host Inger often remain long online.