27

Another Steam user gave me a Steam wallet code. Can my PC/Steam account get hacked by redeeming that code?

Improve this question
13
  • 3
    this doesnt seem in scope, but im not sure
    – Topcode
    May 17, 2021 at 17:05
  • 3
    Whether it is on-topic or not, the premise of the question seems more suited for Steam Support
    – Wondercricket
    May 17, 2021 at 17:29
  • 2
    Incidentally, that link is a 404. It has either expired, been removed by the author, or been removed by Pastebin staff.
    – Unionhawk ♦
    May 17, 2021 at 17:31
  • 4
    1. Please don't edit questions to ask a new question, ask a new question instead.
    – Jack Aidley
    May 18, 2021 at 13:19
  • 1
    @JackAidley Well I'm planning to do that but I think adding the new information is necessary for this question as well.
    – Diecie
    May 18, 2021 at 13:35

4 Answers 4

Reset to default
62

It is possible. One of the methods of account recovery is providing to the Steam support team a game key code or wallet funds code that has previously been redeemed on the account (as per here).

If you redeem the code then the scammer can provide that code to Steam support, as well as proof of purchase, and gain access to your account.

Improve this answer
2
  • I've moved these comments to chat. This conversation seemed to be getting a little too long and unwieldy for the commenting system.
    – Wipqozn ♦
    May 19, 2021 at 15:35
  • Interesting idea, but the article you linked doesn't necessarily say a redeemed wallet code is the only evidence Steam support requires to prove ownership of an account, only that it's one factor they can use in making that determination. Are there any confirmed cases of Steam support performing account recovery based solely on ownership of a redeemed wallet code with no other evidence presented?
    – Ajedi32
    May 19, 2021 at 16:55
3

Possible attack scenario:

  1. Evil person creates a game with a very well-hidden malware. Steam's quality control is very lenient, but not non-existent. So it at least needs to look like a game. The malware needs to be a custom made one so it does not get detected by any known virus scanner (Valve does check every submission using virus scanners). So there is considerable development effort involved.
  2. Evil person pays the $100 listing fee to Steam, using a bank account which can not be traced back to them.
  3. Evil person uses personal information acquired by identity theft to complete the Steam paperwork, so the game gets listed.
  4. Evil person sends you a free Steam key for their "game", hoping you install and run it.

In order to pull this off, Evil Person would need to pay $100, wait several weeks for the Steam Direct process to complete and commit identity theft to avoid getting caught. And it does not scale, because when they send keys to too many users and one of them finds out it's malware and reports it, the game gets depublished and they need to start from the beginning. So it would only be worth it if you are a high-value target and they are sure they can convince you to actually run the game.

Improve this answer
3
  • 1
    Im gonna take the wild guess that Steam at least for Trojans and Bitcoin miners.
    – Fredy31 ♦
    May 18, 2021 at 16:35
  • 4
    @Fredy31 A while ago there was actually a case of a cryptocurrency miner making it to Steam. It was promptly removed. eurogamer.net/articles/…
    – Philipp
    May 18, 2021 at 16:37
  • And I guess now that is added to the scan when you add a game to steam.
    – Fredy31 ♦
    May 18, 2021 at 16:38
1

If the Steam Wallet Code you received is of the correct format (which, IIRC, Steam prints in the redeem-wallet-code-dialog) and if you enter it manually into Steam then using that code is safe no matter where it comes from. Steam may or may not accept it, but there's no risk of being hacked that way.

You should, however, not copy-and-paste that code into Steam, since a manipulated code could in theory contain a character sequence that is invisible to you but that exploits a weakness in Steam to hack the application (and by extension possibly your Steam account as well). This "attack vector" is not very likely, but it is theoretically possible.

Improve this answer
0

You can't have any damage for redeeming a Steam code. As the keys are generated by Steam itself, in order to provide an unique and non repeatable key. Imagine that "GTA V" provide to Steam the key "1234" and "Mass Effect" also provides the key "1234"; Steam would enter in a conflict to redeem one game or another, that's why Steam manages the keys.

This means that the worst scenario is that Steam will return to you a message like: "this is not a valid Steam Key" and that's it, no one get hurt.

Regarding the "Pastebin" link it's a public repository to share code. But before clicking, hover the mouse on the link to see in the status bar the real URL, as it might be different.

Improve this answer
3
  • Also: for regular accounts, afaik, Pastes are deleted automatically after X time, so it could just be that they pasted it there a couple of days ago
    – Hobbamok
    May 18, 2021 at 8:05
  • 3
    Just because valid Steam codes are generated by Steam and are not harmful does not mean that something someone else calls a "Steam key" (and asks you to enter into Steam) could not be harmful. For one, it could have been crafted to abuse a vulnerability in Steam's key parser, cause a buffer overflow error and allow arbitrary code execution within the Steam application. This scenario is not very likely, but is not impossible.
    – Dreamer
    May 18, 2021 at 8:48
  • 1
    Note that depending on where you are, the link might show as a redirect on that website which is annoying af bc it means you can't actually see where it's going easily without dissecting the redirect URL and finding to where it would probably lead
    – Penguin
    May 18, 2021 at 21:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .