Another Steam user gave me a Steam wallet code. Can my PC/Steam account get hacked by redeeming that code?
Asked
Active
Viewed 1.0k times
27
-
3this doesnt seem in scope, but im not sure – Topcode May 17 '21 at 17:05
-
3Whether it is on-topic or not, the premise of the question seems more suited for Steam Support – Wondercricket May 17 '21 at 17:29
-
2Incidentally, that link is a 404. It has either expired, been removed by the author, or been removed by Pastebin staff. – Unionhawk May 17 '21 at 17:31
-
@Wondercricket I can't find anything about it on the Steam Support info and I don't know if you can message Steam Support. Can you message Steam Support? If so, how? – Diecie May 17 '21 at 17:46
-
@Unionhawk Yeah, a friend of mine said he opened the link and had the 404 error too. – Diecie May 17 '21 at 17:48
-
4
- Please don't edit questions to ask a new question, ask a new question instead.
– Jack Aidley May 18 '21 at 13:19 -
- You have SteamGuard active, right?
– Jack Aidley May 18 '21 at 13:20 -
@JackAidley Yes. – Diecie May 18 '21 at 13:21
-
1@JackAidley Well I'm planning to do that but I think adding the new information is necessary for this question as well. – Diecie May 18 '21 at 13:35
-
1Please don't add additional parts to your question, or change your question to ask something different. If you have additional questions, please ask a new question. – Dragonrage May 18 '21 at 20:59
-
Quite aside from everything else, you should be aware that if the code was purchased with a stolen card your account might be at risk of suspended. "Never accept a gift from an unknown user. Any accounts tied to a redeemed gift from a fraudulent source may be suspended." https://support.steampowered.com/kb_article.php?ref=5406-WFZC-5519 – Irene Liberali May 19 '21 at 13:32
-
@IreneLiberali What does Steam mean by "unknown"? Do they mean the user is not recognized by Steam because the user's account is some sort of a custom-made account, not made from Steam, something like that, or do they mean a user that you do not know? – Diecie May 19 '21 at 21:12
-
@Diecie I think it's the latter. – ABC May 20 '21 at 10:50
4 Answers
62
It is possible. One of the methods of account recovery is providing to the Steam support team a game key code or wallet funds code that has previously been redeemed on the account (as per here).
If you redeem the code then the scammer can provide that code to Steam support, as well as proof of purchase, and gain access to your account.
JosephWR
- 656
- 4
- 5
-
I've moved these comments to chat. This conversation seemed to be getting a little too long and unwieldy for the commenting system. – Wipqozn May 19 '21 at 15:35
-
Interesting idea, but the article you linked doesn't necessarily say a redeemed wallet code is the only evidence Steam support requires to prove ownership of an account, only that it's one factor they can use in making that determination. Are there any confirmed cases of Steam support performing account recovery based solely on ownership of a redeemed wallet code with no other evidence presented? – Ajedi32 May 19 '21 at 16:55
3
Possible attack scenario:
- Evil person creates a game with a very well-hidden malware. Steam's quality control is very lenient, but not non-existent. So it at least needs to look like a game. The malware needs to be a custom made one so it does not get detected by any known virus scanner (Valve does check every submission using virus scanners). So there is considerable development effort involved.
- Evil person pays the $100 listing fee to Steam, using a bank account which can not be traced back to them.
- Evil person uses personal information acquired by identity theft to complete the Steam paperwork, so the game gets listed.
- Evil person sends you a free Steam key for their "game", hoping you install and run it.
In order to pull this off, Evil Person would need to pay $100, wait several weeks for the Steam Direct process to complete and commit identity theft to avoid getting caught. And it does not scale, because when they send keys to too many users and one of them finds out it's malware and reports it, the game gets depublished and they need to start from the beginning. So it would only be worth it if you are a high-value target and they are sure they can convince you to actually run the game.
Philipp
- 29,761
- 20
- 120
- 192
-
1Im gonna take the wild guess that Steam at least for Trojans and Bitcoin miners. – Fredy31 May 18 '21 at 16:35
-
4@Fredy31 A while ago there was actually a case of a cryptocurrency miner making it to Steam. It was promptly removed. https://www.eurogamer.net/articles/2018-07-30-steam-game-abstractism-turns-pcs-into-cryptocurrency-miners – Philipp May 18 '21 at 16:37
-
And I guess now that is added to the scan when you add a game to steam. – Fredy31 May 18 '21 at 16:38
1
If the Steam Wallet Code you received is of the correct format (which, IIRC, Steam prints in the redeem-wallet-code-dialog) and if you enter it manually into Steam then using that code is safe no matter where it comes from. Steam may or may not accept it, but there's no risk of being hacked that way.
You should, however, not copy-and-paste that code into Steam, since a manipulated code could in theory contain a character sequence that is invisible to you but that exploits a weakness in Steam to hack the application (and by extension possibly your Steam account as well). This "attack vector" is not very likely, but it is theoretically possible.
Dreamer
- 119
- 1
0
You can't have any damage for redeeming a Steam code. As the keys are generated by Steam itself, in order to provide an unique and non repeatable key. Imagine that "GTA V" provide to Steam the key "1234" and "Mass Effect" also provides the key "1234"; Steam would enter in a conflict to redeem one game or another, that's why Steam manages the keys.
This means that the worst scenario is that Steam will return to you a message like: "this is not a valid Steam Key" and that's it, no one get hurt.
Regarding the "Pastebin" link it's a public repository to share code. But before clicking, hover the mouse on the link to see in the status bar the real URL, as it might be different.
Pepe T.
- 402
- 2
- 6
-
Also: for regular accounts, afaik, Pastes are deleted automatically after X time, so it could just be that they pasted it there a couple of days ago – Hobbamok May 18 '21 at 08:05
-
3Just because valid Steam codes are generated by Steam and are not harmful does not mean that something someone else calls a "Steam key" (and asks you to enter into Steam) could not be harmful. For one, it could have been crafted to abuse a vulnerability in Steam's key parser, cause a buffer overflow error and allow arbitrary code execution within the Steam application. This scenario is not very likely, but is not impossible. – Dreamer May 18 '21 at 08:48
-
1Note that depending on where you are, the link might show as a redirect on that website which is annoying af bc it means you can't actually see where it's going easily without dissecting the redirect URL and finding to where it would probably lead – Penguin May 18 '21 at 21:51