My STEAM password hacked.. learn from my mistake...

[bum4evr]

So today I got an email from steam saying that someone had logged into my account from China and said I needed to change my password if it was not me. At first I thought it was a phishing email but when I logged into Steam - sure enough, same message. I also thought that this was just a warning and that perhaps someone had "tried" to get into my account and was not successful - But when I logged into Steam and played CounterStrike I discovered my favorites were all erased and the game history showed someone had played on a server yesterday that I had never played on ( I just do Office. Dust 2 and Italy on the clan servers I am a member of) So I was SURE someone had been in my account.

So how did it happen? Did I get "hacked" no.. not in the way we think of the word. Nobody looked through lines of code or ran a brute force attack to get my password. What actually happened is.. warez boards.

You see, I am a member of about 12 warez boards and I do have a secure password for the one board I have mod powers on, but for many of the rest of them I have been using the same password, and I used to think "why worry? whats the worst a hacker can do? log in as me and post spam?"

We all assume that admins of the warez boards we join are honest and mature and would not look at our passwords - but I joined a few warez boards that are small (I mean like WAY smaller then Dirtywarez), and who have admins I don't know at all or I know to be a teenager.

And so what I believe happened is - some smart admin on one of the warez boards I am a member of noticed I posted that I use Steam and thought "hmm.... I wonder if he uses the same username and password on Steam that he uses on my board?" And so he looked it up.... and found out that I did.

I believe THIS is how most hacking takes place - just like how this board was hacked, because someone didn't use a new password and a "hacker" figured it out because he knew the old one. (I hate to call them "hackers" because it takes no skill to do this, just a willingness to be a jerk and take advantage of an admin position or a friend you know in real life)

Yep I am a dummy.. It just never occurred to me it could happen to me.

So today I visited every website and board I am a member of and changed the password to a random letter/number combination with some uppercase and lowercase - example "GOth93737GUm"

The problem is, there is no way I can remember all these passwords so I have to keep them in a notepad file - and open that file whenever I need to re-type a password. Its a pain in the butt but I think its necessary to do these days.

So don't be a dummy like me.. don't use same password for different warez boards and Especially DON'T use those same passwords you use for warez boards for other things.. like email or steam or anything..

Its VERY easy to sign up for a board or a site.. and not understand that the admins on that board or site are not as honest as you think they are.. especially boards way smaller then Dirtywarez.. so don't use a password you use ANYWHERE else when u sign up for a board or site.... just to be safe.

I was lucky... Someone was able to get into a video game site I play.. and did very little damage.. it could have been worse...

 

[NavyRet]

Good start, but that notepad file you are storing those passwords in is unsecure. All you need is to d/l some malware that looks for unencrypted txt files and poof - you're had again. It would be better to use a MS Word file and encrypt it. That way if that file is copied, they got nothing because they can't open it without the encryption key.

As for admins having access to passwords, I'm not sure that phpBB gives even admins that ability.

Just sayin .....

 

[Katzenfreund]

A useful post, though I didn’t understand how your account was used from China.

In this particular board, passwords are stored encrypted, so they’re only crackable by brute force if simple enough.

Anyway, something very similar happened to me, but not with a small board, on the contrary, one of the large ones, namely the legendary ProjectW that was bought by the infamous Megamoldy. To cut a long story short, the owner owned a mail order pharmaceutical company and as soon as he bought the board, got hold of the members’ emails and promptly started bombarding them with spam. Not only that, but he also used their emails to forward his spam to everybody in their contacts list. It seems that this is one of the main reasons he bought the board, and he subsequently mismanaged it, leading it to closure.

There are programs that store passwords, but the simple solution is that mentioned by NavyRet which I also use. Namely, keep all passwords in a word document secured by password. This way you only have to remember 1 password.

Also for convenience, get your browser to remember and enter your password at every place you visit. Again, the browser stores the passwords encrypted, so if your computer is hacked or accessed by someone else, they should be safe.

 

[bum4evr]

A useful post, though I didn’t understand how your account was used from China

I am pretty sure whoever did it was using a VPN or ToR browser or something when they actually tested my password on Steam.

As for admins having access to passwords, I'm not sure that phpBB gives even admins that ability.

I used to think the same thing, as I have messed around with adminCP on phpBB and Vbulletin over the years... but.. when THIS board was hacked, the hacker posted a list of every username and email address and then linked it to his twitter page - And I can't recall any feature in adminCP that allows an admin to generate a list of user email addresses and user names like that. Navy remember my failed Arcade idea? That board is phpBB and even though I can get every email and username one at a time, I can't just get a list all at once. That feature simply is not there.. So I figure pro coders know how to dig into their board code and do things that are not in adminCP - because the board code is on the admin's server, so I am sure those admins who are coding pros can figure out a way to get passwords and we normal users would never know its happening.

Once you install phpBB or Vbulletin... I think an admin who knows what they are doing can change the code to show them your passwords... or anything else they want to do.