So, I was logged into Steam yesterday when something logged me off. Someone had apparently reset my password, and was trying to log in...from the Czech Republic. I wrested control back from them, only to have this process repeated again by someone from a Russian IP address, less than half an hour later.

Thankfully, I'd locked my account the first time something seemed odd -- that's basically the "panic button" that disables almost everything on the account (purchases, key redemptions, even social features).

But then, cue me doing a frantic search for keyloggers on my machine, since there were no suspicious logins on my e-mail account. Also me wondering, did the attacker(s) really have a network of thousands of computers at which to brute-force the 5-character password reset code?

Turns out, someone happened to discover that when you do a password reset, Steam sends a code to your account's e-mail address, which you need don't need to enter at all, just leave it blank, and voila, enter your new password twice and enjoy. Now you can log into any account! ...well, provided that they don't have Steam Guard enabled to keep you from using a new device. Thankfully that part still worked right. (I would presume someone tried to blank-entry that one too...)

demonstration: https://www.youtube.com/watch?v=QPl_BJoBaVA

FYI it's since been fixed, and Valve has sent a mass e-mail about this matter.

So I'll see y'all fellow Steam users back on Steam whenever Support finally gets around to unlocking my account.

--------------------