26

Another Steam user gave me a Steam wallet code. Can my PC/Steam account get hacked by redeeming that code?

This user also sent me this Pastebin link: pastebin.com/Kv4LAxhg which is now marked "This page is no longer available. It has either expired, been removed by its creator, or removed by one of the Pastebin staff." Is this link safe? The user said that the link contains the code, and after I didn't reply for him for a couple of minutes after he sent that link, he messaged me the code itself instead.

13
  • 2
    this doesnt seem in scope, but im not sure – Topcode May 17 at 17:05
  • 2
    Whether it is on-topic or not, the premise of the question seems more suited for Steam Support – Wondercricket May 17 at 17:29
  • 2
    Incidentally, that link is a 404. It has either expired, been removed by the author, or been removed by Pastebin staff. – Unionhawk May 17 at 17:31
  • 3
    1. Please don't edit questions to ask a new question, ask a new question instead. – Jack Aidley May 18 at 13:19
  • 1
    @JackAidley Well I'm planning to do that but I think adding the new information is necessary for this question as well. – Diecie May 18 at 13:35
59

It is possible. One of the methods of account recovery is providing to the Steam support team a game key code or wallet funds code that has previously been redeemed on the account (as per here).

If you redeem the code then the scammer can provide that code to Steam support, as well as proof of purchase, and gain access to your account.

3
  • I've moved these comments to chat. This conversation seemed to be getting a little too long and unwieldy for the commenting system. – Wipqozn May 19 at 15:35
  • Interesting idea, but the article you linked doesn't necessarily say a redeemed wallet code is the only evidence Steam support requires to prove ownership of an account, only that it's one factor they can use in making that determination. Are there any confirmed cases of Steam support performing account recovery based solely on ownership of a redeemed wallet code with no other evidence presented? – Ajedi32 May 19 at 16:55
  • @Ajedi32 That is easily tested by claiming you lost access, then see what they ask. For me, I did not use a redemption code (since I didn't keep any of my old codes), but did very quickly restore access via Credit Card... Had a fight with the wife... >.> – Nelson May 20 at 8:14
2

Possible attack scenario:

  1. Evil person creates a game with a very well-hidden malware. Steam's quality control is very lenient, but not non-existent. So it at least needs to look like a game. The malware needs to be a custom made one so it does not get detected by any known virus scanner (Valve does check every submission using virus scanners). So there is considerable development effort involved.
  2. Evil person pays the $100 listing fee to Steam, using a bank account which can not be traced back to them.
  3. Evil person uses personal information acquired by identity theft to complete the Steam paperwork, so the game gets listed.
  4. Evil person sends you a free Steam key for their "game", hoping you install and run it.

In order to pull this off, Evil Person would need to pay $100, wait several weeks for the Steam Direct process to complete and commit identity theft to avoid getting caught. And it does not scale, because when they send keys to too many users and one of them finds out it's malware and reports it, the game gets depublished and they need to start from the beginning. So it would only be worth it if you are a high-value target and they are sure they can convince you to actually run the game.

3
  • 1
    Im gonna take the wild guess that Steam at least for Trojans and Bitcoin miners. – Fredy31 May 18 at 16:35
  • 4
    @Fredy31 A while ago there was actually a case of a cryptocurrency miner making it to Steam. It was promptly removed. eurogamer.net/articles/… – Philipp May 18 at 16:37
  • And I guess now that is added to the scan when you add a game to steam. – Fredy31 May 18 at 16:38
1

If the Steam Wallet Code you received is of the correct format (which, IIRC, Steam prints in the redeem-wallet-code-dialog) and if you enter it manually into Steam then using that code is safe no matter where it comes from. Steam may or may not accept it, but there's no risk of being hacked that way.

You should, however, not copy-and-paste that code into Steam, since a manipulated code could in theory contain a character sequence that is invisible to you but that exploits a weakness in Steam to hack the application (and by extension possibly your Steam account as well). This "attack vector" is not very likely, but it is theoretically possible.

0

You can't have any damage for redeeming a Steam code. As the keys are generated by Steam itself, in order to provide an unique and non repeatable key. Imagine that "GTA V" provide to Steam the key "1234" and "Mass Effect" also provides the key "1234"; Steam would enter in a conflict to redeem one game or another, that's why Steam manages the keys.

This means that the worst scenario is that Steam will return to you a message like: "this is not a valid Steam Key" and that's it, no one get hurt.

Regarding the "Pastebin" link it's a public repository to share code. But before clicking, hover the mouse on the link to see in the status bar the real URL, as it might be different.

3
  • Also: for regular accounts, afaik, Pastes are deleted automatically after X time, so it could just be that they pasted it there a couple of days ago – Hobbamok May 18 at 8:05
  • 3
    Just because valid Steam codes are generated by Steam and are not harmful does not mean that something someone else calls a "Steam key" (and asks you to enter into Steam) could not be harmful. For one, it could have been crafted to abuse a vulnerability in Steam's key parser, cause a buffer overflow error and allow arbitrary code execution within the Steam application. This scenario is not very likely, but is not impossible. – Dreamer May 18 at 8:48
  • 1
    Note that depending on where you are, the link might show as a redirect on that website which is annoying af bc it means you can't actually see where it's going easily without dissecting the redirect URL and finding to where it would probably lead – Penguin May 18 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.