Skip to main content

Another security failure

After my adventures with VNC my son has followed it up by getting his Steam account hijacked after unknowingly installing a key logger. Valve make it too easy by allowing the hijacker to change the email address without confirmation. You do get an email with a link but the link does not disable the change of email it merely directs you to a page where you can report the hijacking. Two days later and Valve have still not responded to the report. My son is still locked out of his Steam account and cannot play $500 worth of games he legally owns. Wake up Valve - do you want your games pirated?

This was another lesson in computer security and highlights the ineffectiveness of the Steam system to deal with hijacking. At least there was no credit card information to get but it is frustrating how long Valve is taking to do anything about it.

I do not know what the hijacker gets out of this - they cannot (I hope) transfer the games or gift the games to someone else and even if they did surely Valve would be able to reverse it and ban the other account. Perhaps it is identity theft or an attempt to launder money somehow. In the end it is annoying and upsetting and not a good advert for Valve.

Comments

Popular posts from this blog

The Extended Attributes Are Inconsistent in Windows 8

I have upgraded my laptop to Windows 8 and all was fine for about three hours and then I started to get an error when trying to run any application that required Administrator privileges. Half an hour of Googling led me to this blog post   Case of the broken uac prompt This problem was caused by downloading themes. The final theme I had decided on included a new sound theme. Clearly at least one of the sounds did not play (the one for the UAC prompt!). Changing the sound theme (right click on desktop, choose "personalisation") to Windows Default sorted out the problem. Doing a clean install would also have fixed it but that would have been a drastic solution and as soon as I installed a new theme it may have happened again.

Beware vnc and upnp

My new linux box got hacked yesterday. I was careless. My ADSL router has upnp support and it is turned on by default. I enabled "Remote Desktop" in Linux - which is a version of vnc - and decided not to set a password as it would not be accessible from outside the local network. That was my first mistake. Last night I noticed a second connection to the linux box. Someone was using the browser and had connected to Western Union and was trying to install the flash plugin. They had not got very far as Fedora 14 does not install Flash on a 64bit system as it is still in beta so the install is not straightforward. I was able to disconnect this errant person before they got any further and I then disconnected the ADSL line from the modem to prevent another attempt and proceeded to diagnose what had happened. I checked the preferences for VNC and noticed the automatically configure the network check box had been selected and that it was reporting an external address could be

"No child processes" error on Linux

A problem was reported by a customer. They were getting a failure and in the logs it reported error → waitpid failed 'Reason: No child processes' The “No child processes” error came from waitpid() after using  fork/spawn to launch a utility to load data into a data base. Upon detailed investigation it appears it is possible that some other process that the user is running has changed the default handler for SIGCHLD - possibly the shell (e.g. bash!) used to launch our server processes. If the signal handler is set to SIG_IGN then when a process is started using fork()/exec() the return code from the process is NOT returned and waitpid() cannot retrieve the response code. The most likely reason for "No child processes" error from waitpid() is that the signal handler for child processes (SIGCHLD) is not set to SIG_DFL. This should not be possible however it seems that on Linux a process run in the shell (or maybe a shell process) can set it