Valve Hacked: Cafe Credit Cards Compromised

Posted in Hacks, Half Life, Half Life 2, Security by Elliott Back on April 23rd, 2007.

MaddoxX, a member of hacking group no-steam recently cracked one of VALVe’s file servers and obtained strange bits of confidential information, including credit card numbers, Valve software assets, and private security keys. Steam-review claims that because a Steam server was not compromised, there is no danger. Doug Lombardi, director of marketing at Valve, issued a statement with a similar sentiment:

There has been no security breach of Steam. The alleged hacker gained access to a third-party site that Valve uses to manage the commercial partners in its Cyber Cafe program. This Cyber Cafe billing system is not connected to Steam. We are working with law enforcement agencies on this matter, and encourage anyone with more information to e-mail us at Catch_A_Thief@valvesoftware.com .

Is this an authentic break-in at Valve, or just hype spun out of proportion by the blogosphere? Our favorite gaming site, 1Up, sheds a bit more light:

We ran all of MaddoxX’s proof by a software security expert who requested anonymity. “This looks real to me. He found a way into [Valve's] Cyber Café software,” the security expert confirms, “but what I’ve seen — the files pulled down — don’t indicate whether or not he breached Valve itself.”

The data MaddoxX released includes:

- Screenshots of internal Valve web pages
- A portion of Valve’s Cafe directory
- Error logs
- Credit card information of customers
- Financial information on Valve

It’s our opinion that the hack is legit, and that Valve’s security model is flawed. If one file-server can be compromised, they all can. If they can’t, then Valve is deploying servers haphazardly, leading to the possibility that flaws will sporadically exist which can be used to exploit their customer base. If you play Counterstrike or Half-life, be scared.

This entry was posted on Monday, April 23rd, 2007 at 8:27 pm and is tagged with doug lombardi, credit card numbers, strange bits, software assets, security breach, error logs, hacking group, directory error, file servers, security keys, 1up, s cafe, law enforcement agencies, commercial partners, valve software, security expert, security model, director of marketing, cyber cafe, billing system. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback.