Pages: 1 [2] 3 4 :: one page |
|
Author |
Thread Statistics | Show CCP posts - 0 post(s) |
![Schnoo Schnoo](https://images.evetech.net/characters/486723529/portrait?size=64)
Schnoo
The Schnoo
8
|
Posted - 2011.11.11 20:05:00 -
[31] - Quote
Enik3 wrote:Gabe Newall has indicated that AES256 encryption was used on sensitive information, so there's very little to worry about if that's true.
I have far more faith in the security layers at a premier e-commerce company like Steam than I do in, say, ANY government agency. I'm pretty sure the average person's personal data is much more exposed in other places. Well that's awesome! And I'm sure the hackers are right away trying to crack the AES256 encryption, instead of, you know, just downloading the AES256 keys from the compromised machine.
Sarcasm aside, one has to wonder how and where were they keeping the keys. |
![Bienator II Bienator II](https://images.evetech.net/characters/1775466414/portrait?size=64)
Bienator II
24th Imperial Crusade Amarr Empire
258
|
Posted - 2011.11.11 20:39:00 -
[32] - Quote
Enik3 wrote:Gabe Newall has indicated that AES256 encryption was used on sensitive information, so there's very little to worry about if that's true. well. if you have a short pw your are screwed. doesn't matter what encryption they used. They can just brute force it. 6 char pwds get brute forced over night on the GPU if you have access to the encrypted string of the pw. You fail you fail you fail you fail you fail you fail you fail to jump because you are cloaked |
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1053
|
Posted - 2011.11.11 20:52:00 -
[33] - Quote
Schnoo wrote:Enik3 wrote:Gabe Newall has indicated that AES256 encryption was used on sensitive information, so there's very little to worry about if that's true.
I have far more faith in the security layers at a premier e-commerce company like Steam than I do in, say, ANY government agency. I'm pretty sure the average person's personal data is much more exposed in other places. Well that's awesome! And I'm sure the hackers are right away trying to crack the AES256 encryption, instead of, you know, just downloading the AES256 keys from the compromised machine. Sarcasm aside, one has to wonder how and where were they keeping the keys.
From what was said in the notice, probably somewhere else, but if they could get access to the subscriber database, it's not much of a stretch to figure their encryption methods were also compromised. I would also venture a guess the breach happened well before they noticed it, and once the intruders were finished, decided to "deface" their forums. |
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1053
|
Posted - 2011.11.11 20:58:00 -
[34] - Quote
http://www.bbc.co.uk/news/technology-15690187 |
![Jita Alt666 Jita Alt666](https://images.evetech.net/characters/1241325039/portrait?size=64)
Jita Alt666
504
|
Posted - 2011.11.11 21:10:00 -
[35] - Quote
The price of convenience in a global market can be high. |
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1055
|
Posted - 2011.11.11 21:44:00 -
[36] - Quote
Edit edit edit: (I guess this has happened before, below is reference to an older article)
Is this guy bluffing?
Quote:Posting on the No-Steam forum, an individual calling himself MaddoxX has claimed credit for hacking into Steam, and has posted presumably-confidential material including financial information, customers' credit card information, and screenshots of internal Valve web pages.
The alleged hacker appears to be attempting some form of online extortion against Valve, posting the following to the forum: "If you want me to remove these files you can e-mail me at (address removed) and I prefer you come with something good unless you want me to expose ALL of the customers their information." The specifics of his demands remain unclear.
Steam, introduced in 2004 in conjunction with Valve's massive hit Half-Life 2, has grown into a massively popular and successful online distribution system on the internet. Along with Valve, Steam is now also used by companies such as Eidos, Akella, Activision and 2K Games. As well as new releases, Steam is also serving as a distribution method for older releases such as Thief: Deadly Shadows, Arx Fatalis, and Deus Ex: Invisible War, offering gamers a chance to play titles that are otherwise difficult to obtain.
If this claim of data theft is genuine, it could quickly become a public relations nightmare for Valve, which would be forced to reveal to credit card holders that its security has been breached. This would also be the second high-profile lapse in security involving Valve in recent years; in 2003, the Half-Life 2 source code was stolen by someone who managed to break into Valve's internal systems undetected.
http://www.escapistmagazine.com/news/view/70817-Steam-Faces-Possible-Security-Breach |
![KaarBaak KaarBaak](https://images.evetech.net/characters/1624960886/portrait?size=64)
KaarBaak
146
|
Posted - 2011.11.11 21:47:00 -
[37] - Quote
If he's not bluffing, he's setting himself up for some serious criminal charges.
EDIT:
Quote:To put it simply: heGÇÖs screwed. |
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1055
|
Posted - 2011.11.11 21:49:00 -
[38] - Quote
Nm, it's an old article...2008... |
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1055
|
Posted - 2011.11.11 23:03:00 -
[39] - Quote
We might get free copies of Portal 2 and DOTA 2 out of it though lol http://www.thereticule.com/update-on-steam-security-breach/ |
![Grimpak Grimpak](https://images.evetech.net/characters/730676275/portrait?size=64)
Grimpak
Midnight Elites Echelon Rising
133
|
Posted - 2011.11.12 01:48:00 -
[40] - Quote
if we get free copies of portal 2 and DOTA 2 that would actually be awesome![Lol](https://forums-archive.eveonline.com/Images/Emoticons/ccp_lol.png) [img]http://eve-files.com/sig/grimpak[/img]
[quote]The more I know about humans, the more I love animals.[/quote] ain't that right |
|
![Renturu Renturu](https://images.evetech.net/characters/1775897786/portrait?size=64)
Renturu
Tribal Spirit Tribal Unity Alliance
2
|
Posted - 2011.11.12 02:04:00 -
[41] - Quote
1) Free Portal 2 and DoTA - #WIN
2) Contemplating getting one of those loadable credit cards and keeping just the bare minimum to keep it open. Then, only using it for online purchasing as even PayPal, if hacked, links directly to a bank/credit account and your screwed.
|
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1055
|
Posted - 2011.11.12 02:49:00 -
[42] - Quote
Yeah never played DOTA but I've been holding out for Portal 2 to go on super sale to buy it, so I could deal with that :P |
![Endeavour Starfleet Endeavour Starfleet](https://images.evetech.net/characters/91002127/portrait?size=64)
Endeavour Starfleet
Center for Advanced Studies Gallente Federation
34
|
Posted - 2011.11.12 05:19:00 -
[43] - Quote
I would recomend changing passwords and watching your credit statements as indicated. However I see NO reason for them to lie about the AES256 encryption part.
Do you realize that it would take a powerful quantum computer to be able to crack that kind of encryption? If I remember right Wikileaks distributed its database encrypted weaker than that and word is even the gov will take time to crack that.
Be on the safe side folks. But don't act like a bunch of idiots and try to compare Valve. A company hellbent on security after the HL2 attack with Sony which had virtually no security in place.
The idiots who did this attack tho are in for a world of criminal charges when they are located tho. The last attack didn't net encrypted financial files. |
![VKhaun Vex VKhaun Vex](https://images.evetech.net/characters/90699938/portrait?size=64)
VKhaun Vex
Viziam Amarr Empire
12
|
Posted - 2011.11.12 06:03:00 -
[44] - Quote
Getting a new debit card and changing a PW is trivial and I don't even have to do them myself. I just type in the new password and click a link on my bank's website. The amount of time I spend with no internet but having a desktop and electricity is so low it's also trivial.
Having a game literally the instant it launches was easily worth both of those things. Not having to manage physical copies to install and transport 100+ games is a nice bonus, but hey... STEAM is the devil and a piece of crap right? Who am I to argue... |
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1055
|
Posted - 2011.11.12 06:20:00 -
[45] - Quote
Endeavour Starfleet wrote:I would recomend changing passwords and watching your credit statements as indicated. However I see NO reason for them to lie about the AES256 encryption part.
Do you realize that it would take a powerful quantum computer to be able to crack that kind of encryption? If I remember right Wikileaks distributed its database encrypted weaker than that and word is even the gov will take time to crack that.
Be on the safe side folks. But don't act like a bunch of idiots and try to compare Valve. A company hellbent on security after the HL2 attack with Sony which had virtually no security in place.
The idiots who did this attack tho are in for a world of criminal charges when they are located tho. The last attack didn't net encrypted financial files.
Do you realize it doesn't matter if they compromised the keys? |
![Endeavour Starfleet Endeavour Starfleet](https://images.evetech.net/characters/91002127/portrait?size=64)
Endeavour Starfleet
Center for Advanced Studies Gallente Federation
35
|
Posted - 2011.11.12 07:34:00 -
[46] - Quote
How are they going to compromise them? Magic? There is a reason people use heavy encryption. |
![Alain Kinsella Alain Kinsella](https://images.evetech.net/characters/1606165507/portrait?size=64)
Alain Kinsella
8
|
Posted - 2011.11.12 08:14:00 -
[47] - Quote
Already have Portal 2 (they did have a pretty nice sale a few months back). Had to look up what DOTA 2 was - no thx, cannot stand Warcraft 3. And the last shooter I had any real interest in was C&C: Renegade. ![Straight](https://forums-archive.eveonline.com/Images/Emoticons/ccp_straight.png)
Hell, my last Steam purchase? SpaceChem & Bejeweled 3. And I have something like 80 or so hours on Bejeweled Twist.
As for the discussion on DRM in general, I find Steam to be a lot less intrusive (in general) than, say, Starforce or SecuROM - both of which have destroyed my and/or my roommate's PCs in the past. The only reason I have Bioshock is that they pulled SecuROM from the Steam version.
Don't even remember if I have a forum account or not. I suppose its time to go check...
I may have come here from Myst Online, but that does not make me any less bloodthirsty than the average Eve player.
Just more subtle.
|
![Naso Gomez Naso Gomez](https://images.evetech.net/characters/1952850473/portrait?size=64)
Naso Gomez
Astral Edge
12
|
Posted - 2011.11.12 12:19:00 -
[48] - Quote
KaarBaak wrote: Not requiring Steam to play a single-player game would be safer.
Most single-player games on steam you can play with out even having it running. If its in the common folder under steamapps then you can run it without steam, unless its a valve game, and whens the last time they released a 100% single player game. |
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1056
|
Posted - 2011.11.12 17:34:00 -
[49] - Quote
Endeavour Starfleet wrote:How are they going to compromise them? Magic? There is a reason people use heavy encryption.
There is something that has to decrypt them to send the charges to the bank, you can't send the bank an encrypted account number and expect them to know what to do with it. They also have to have something to encrypt them to store them, they don't magically encrypt themselves. |
![Banksae Banksae](https://images.evetech.net/characters/90623755/portrait?size=64)
Banksae
Bedlam Escapees
0
|
Posted - 2011.11.12 17:39:00 -
[50] - Quote
I was very much surprised myself when i saw it. And i am especially shocked that Steam isnt making any effort to letting it know to people not playing daily. Not news item on homepage, just a little message on the forum and a one time pop up on what are normaly sale items. Not really fair from Steam.
|
|
![Kengutsi Akira Kengutsi Akira](https://images.evetech.net/characters/90083090/portrait?size=64)
Kengutsi Akira
Ministry of War Amarr Empire
157
|
Posted - 2011.11.12 19:47:00 -
[51] - Quote
so if they dont let someone know and due to their negligence tat person's bank account gets stolen, is Steam liable? https://forums.eveonline.com/default.aspx?g=posts&m=255722#post255722
My stance on WiS |
![Zions Child Zions Child](https://images.evetech.net/characters/924307343/portrait?size=64)
Zions Child
Odyssey Inc SpaceMonkey's Alliance
69
|
Posted - 2011.11.12 19:58:00 -
[52] - Quote
[quote=Barakkus Use your brain for a minute. I've been doing this **** for 10 years. I write software that handles approximately 2 billion dollars annually and interacts with many financial institutions. I understand very well how all this **** works.[/quote]
To be fair, 2 Billion dollars is chump change in comparison to the hypervelocity trading programs that are used by investment firms. But I'm just being a **** with this sentence.
Anyways, if they stored the keys on a different database that wasn't compromised (which would be intelligent and not require a whole lot of thought as a basic security measure) then we have nothing to worry about. |
![Endeavour Starfleet Endeavour Starfleet](https://images.evetech.net/characters/91002127/portrait?size=64)
Endeavour Starfleet
Center for Advanced Studies Gallente Federation
36
|
Posted - 2011.11.12 20:30:00 -
[53] - Quote
Barakkus wrote:Endeavour Starfleet wrote:How are they going to compromise them? Magic? There is a reason people use heavy encryption. There is something that has to decrypt them to send the charges to the bank, you can't send the bank an encrypted account number and expect them to know what to do with it. They also have to have something to encrypt them to store them, they don't magically encrypt themselves. If they compromised the database, it is entirely possible they compromised whatever systems handle the data and put it in the database. It's not terribly difficult to reverse engineer that once you get a hold of the software doing the work. If it wasn't possible for them to get the numbers then why would they tell you to watch your credit card and bank statements as well? Use your brain for a minute. I've been doing this **** for 10 years. I write software that handles approximately 2 billion dollars annually and interacts with many financial institutions. I understand very well how all this **** works.
Ya... Right...
Do you honestly think Valve would be acting so calm if there was even a remote risk of the key being accessed? Again this is military/gov/financial grade encryption here.
Valve is asking people to watch their credit statements as a legal percaution. If there was ANY evidence of a breech of the encrypted data they would be at once warning people.
Be safe but don't be stupid folks. |
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1056
|
Posted - 2011.11.12 20:40:00 -
[54] - Quote
Endeavour Starfleet wrote:Barakkus wrote:Endeavour Starfleet wrote:How are they going to compromise them? Magic? There is a reason people use heavy encryption. There is something that has to decrypt them to send the charges to the bank, you can't send the bank an encrypted account number and expect them to know what to do with it. They also have to have something to encrypt them to store them, they don't magically encrypt themselves. If they compromised the database, it is entirely possible they compromised whatever systems handle the data and put it in the database. It's not terribly difficult to reverse engineer that once you get a hold of the software doing the work. If it wasn't possible for them to get the numbers then why would they tell you to watch your credit card and bank statements as well? Use your brain for a minute. I've been doing this **** for 10 years. I write software that handles approximately 2 billion dollars annually and interacts with many financial institutions. I understand very well how all this **** works. Ya... Right... Do you honestly think Valve would be acting so calm if there was even a remote risk of the key being accessed? Again this is military/gov/financial grade encryption here. Valve is asking people to watch their credit statements as a legal percaution. If there was ANY evidence of a breech of the encrypted data they would be at once warning people. Be safe but don't be stupid folks.
Yes they would, they're trying to avoid a PR disaster like what Sony had going on, especially since Christmas season is right around the corner and they need those sales. Any one with any brains would try to avoid alarming the public any more than they have to. Only someone who is really stupid would tell the whole truth in something like this to the general public.
This story has been pretty low key so far....and honestly I don't think they know the full extent of the breach, and a good possibility they won't be able to determine the entirety of the breach...
Pretty much you can only hope it only went so far, and do what is necessary to protect your accounts. |
![Endeavour Starfleet Endeavour Starfleet](https://images.evetech.net/characters/91002127/portrait?size=64)
Endeavour Starfleet
Center for Advanced Studies Gallente Federation
36
|
Posted - 2011.11.12 20:47:00 -
[55] - Quote
Yes change your passwords and watch your cards but seriously don't compare them to sony.
Sony had NO encryption. |
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1056
|
Posted - 2011.11.12 20:47:00 -
[56] - Quote
Zions Child wrote:Barakkus wrote: Use your brain for a minute. I've been doing this **** for 10 years. I write software that handles approximately 2 billion dollars annually and interacts with many financial institutions. I understand very well how all this **** works.
To be fair, 2 Billion dollars is chump change in comparison to the hypervelocity trading programs that are used by investment firms. But I'm just being a **** with this sentence. Anyways, if they stored the keys on a different database that wasn't compromised (which would be intelligent and not require a whole lot of thought as a basic security measure) then we have nothing to worry about.
Doesn't matter where they're stored, if they compromised the machines doing the actual work, they can easily get the keys without worry about where they're stored, if they're stored and not just hard coded into the software.
Even if they encrypt the portions of memory holding the keys used during processing, it still gets put there by something and is vulnerable at some point in time. Regardless if they are physically stored or in the application, they can be obtained.
If they were after the financial data, it wouldn't be much of a stretch to be monitoring and dumping the memory or obtaining the software that is doing the encrypting before finally defacing the site and letting them know that they got in. It's not like Steam knew immediately at the time the breach occurred, they didn't find out until their site was defaced. The attackers could have been trolling their systems for months without them knowing. Granted they did their investigations, but it's not terribly difficult for an attacker to hide what they were doing once they discovered they had access to the subscriber database.
It is also conceivable that they could have captured transmissions to the banks when purchases are made and the data is sitting in an unencrypted state.
Nothing is out of the realm of possibility really. |
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1056
|
Posted - 2011.11.12 20:48:00 -
[57] - Quote
Endeavour Starfleet wrote:Yes change your passwords and watch your cards but seriously don't compare them to sony.
Sony had NO encryption.
Sony did encrypt credit card data, they did not encrypt passwords in case you missed it. |
![Sidus Isaacs Sidus Isaacs](https://images.evetech.net/characters/1127084924/portrait?size=64)
Sidus Isaacs
Center for Advanced Studies Gallente Federation
8
|
Posted - 2011.11.12 21:24:00 -
[58] - Quote
Barakkus wrote:Yup, not liking this, changed my password already, going to call the bank tomorrow.
It will be months before they start using credit card numbers, or sell them, so you have a little time, but it will be pretty bad I think since there are so many people that have bought stuff off steam, CoD crowd and BF3 crowd in particular. Even if the stuff is encrypted, doesn't mean they can't crack it.
Crack AES256?
I won't be bothering to call my bank :) |
![Barakkus Barakkus](https://images.evetech.net/characters/482849053/portrait?size=64)
Barakkus
1056
|
Posted - 2011.11.12 22:00:00 -
[59] - Quote
Sidus Isaacs wrote:Barakkus wrote:Yup, not liking this, changed my password already, going to call the bank tomorrow.
It will be months before they start using credit card numbers, or sell them, so you have a little time, but it will be pretty bad I think since there are so many people that have bought stuff off steam, CoD crowd and BF3 crowd in particular. Even if the stuff is encrypted, doesn't mean they can't crack it. Crack AES256? I won't be bothering to call my bank :)
They don't have to crack it. If you even bothered to read anything else in this thread or use your brain to realize they don't have to do one damn thing if they compromised more than what Steam knows about, or has let the general public know about. |
![Grimpak Grimpak](https://images.evetech.net/characters/730676275/portrait?size=64)
Grimpak
Midnight Elites Echelon Rising
134
|
Posted - 2011.11.13 02:37:00 -
[60] - Quote
Barakkus wrote:Sidus Isaacs wrote:Barakkus wrote:Yup, not liking this, changed my password already, going to call the bank tomorrow.
It will be months before they start using credit card numbers, or sell them, so you have a little time, but it will be pretty bad I think since there are so many people that have bought stuff off steam, CoD crowd and BF3 crowd in particular. Even if the stuff is encrypted, doesn't mean they can't crack it. Crack AES256? I won't be bothering to call my bank :) They don't have to crack it. If you even bothered to read anything else in this thread or use your brain to realize they don't have to do one damn thing if they compromised more than what Steam knows about, or has let the general public know about.
atm there are no reports of compromised CC's. also, maybe because of Sony, Valve decided to keep their decryption key safe somewhere in a place that is not inside the steam network proper.
anyways this happened around.. the 10th? and atm all of this is no more than speculation. Time will tell if there was CCs compromised or not. [img]http://eve-files.com/sig/grimpak[/img]
[quote]The more I know about humans, the more I love animals.[/quote] ain't that right |
|
|
|
|
Pages: 1 [2] 3 4 :: one page |
First page | Previous page | Next page | Last page |