- 分享
- 0
- 人气
- 97
- 主题
- 1613
- 帖子
- 53164
- UID
- 448018
- 积分
- 84975
- 阅读权限
- 110
- 注册时间
- 2011-10-5
- 最后登录
- 2018-11-30
- 在线时间
- 17874 小时
区域版主
K 游戏情报员/KWolDs SEN ID
|
Valve 针对 Steam 用户圣诞节期间有数据外泄加以致歉
针对 Steam 平台于圣诞节时出现部分玩家在个人帐户中,突然看到其他用户购买纪录或是电话号码后几码等信息一事,Valve 今日道歉并说明这是当初为了因应阻断服务攻击(DoS)而导致约有 3 万 4 千名用户部分信息曝光。
美国时间 12 月 25 日,部分 Steam 用户发现他们可以在商店或设定中看到其他用户的相关信息,在 Valve 关闭 Steam 与解决此问题前,这状况约持续了 1 小时,引发不少玩家讨论。
Valve 今日表示,他们当时因为 Dos 攻击而引发一些状况,在试图阻止攻击的情况下,不小心造成快取配置错误,使得有的玩家会看到其他玩家的一些信息。
Valve 表示,Steam 商店在圣诞节成了 DoS 的目标,此举试图让玩家无法使用 Steam 商店,Valve 与合作厂商合力对抗攻击,希望不要因此影响 Steam 用户,在耶诞这波攻击中,Steam (因为攻击)流量是 Steam 特卖时的 20 倍。 由于期间造成快取配置错误,可能曝光了某些 Steam 用户的电话后四码、购买纪录、信用卡最后两码或电子邮件、账单地址等,这些快取信息不包含整体的信用卡卡号、密码,或足以让其他玩家登入、进行交易的数据。
Valve 表示,他们还在努力来确定受影响用户,并且在处理过程到一定段落时加以联系这些受影响的用户。
官方消息
Valve releases statement on Steam's Christmas issues
Update on Christmas Issues
We'd like to follow up with more information regarding Steam's troubled Christmas.
What happened
On December 25th, a configuration error resulted in some users seeing Steam Store pages generated for other users. Between 11:50 PST and 13:20 PST store page requests for about 34k users, which contained sensitive personal information, may have been returned and seen by other users.
The content of these requests varied by page, but some pages included a Steam user’s billing address, the last four digits of their Steam Guard phone number, their purchase history, the last two digits of their credit card number, and/or their email address. These cached requests did not include full credit card numbers, user passwords, or enough data to allow logging in as or completing a transaction as another user.
If you did not browse a Steam Store page with your personal information (such as your account page or a checkout page) in this time frame, that information could not have been shown to another user.
Valve is currently working with our web caching partner to identify users whose information was served to other users, and will be contacting those affected once they have been identified. As no unauthorized actions were allowed on accounts beyond the viewing of cached page information, no additional action is required by users.
How it happened
Early Christmas morning (Pacific Standard Time), the Steam Store was the target of a DoS attack which prevented the serving of store pages to users. Attacks against the Steam Store, and Steam in general, are a regular occurrence that Valve handles both directly and with the help of partner companies, and typically do not impact Steam users. During the Christmas attack, traffic to the Steam store increased 2000% over the average traffic during the Steam Sale.
In response to this specific attack, caching rules managed by a Steam web caching partner were deployed in order to both minimize the impact on Steam Store servers and continue to route legitimate user traffic. During the second wave of this attack, a second caching configuration was deployed that incorrectly cached web traffic for authenticated users. This configuration error resulted in some users seeing Steam Store responses which were generated for other users. Incorrect Store responses varied from users seeing the front page of the Store displayed in the wrong language, to seeing the account page of another user.
Once this error was identified, the Steam Store was shut down and a new caching configuration was deployed. The Steam Store remained down until we had reviewed all caching configurations, and we received confirmation that the latest configurations had been deployed to all partner servers and that all cached data on edge servers had been purged.
We will continue to work with our web caching partner to identify affected users and to improve the process used to set caching rules going forward. We apologize to everyone whose personal information was exposed by this error, and for interruption of Steam Store service. |
|