PC gaming platform Steam has fixed a bug that allowed anyone to steal a user account by being armed with nothing more than the account’s username.
The bug affected Steam’s password recovery process for four days, from 21–25 July, and was excruciatingly simple: an attacker could try to log-in to someone else’s Steam account, and ask for a password recovery email to be sent out.
Steam would then send the recovery email to the registered address, before asking for the code contained within the email. But if the attacker hit “enter” without typing in any code they were granted access to the account.
In a statement given to gaming website Kotaku, Valve, the company which runs Steam, confirmed that what it called a “bug” had affected the company’s security for four days. “The bug has now been fixed,” it said.
The company added: “To protect users, we are resetting passwords on accounts with suspicious password changes during that period or may have otherwise been affected. Relevant users will receive an email with a new password. Once that email is received, it is recommended that users login to their account via the Steam client and set a new password.”
“We apologise for the inconvenience”
A number of prominent gamers had their accounts stolen over the weekend, apparently due to the hack, including Dota 2 pro Artour “Arteezy” Babaev:
Steam also got hacked lolz
— Artour (@Arteezy) July 25, 2015
Users who had signed up for Steam Guard, the platform’s branded two-factor authentication service, were protected, however.
