Valves 2FA Mandate for Game Developers Shows SMS Stickiness

Despite warnings that sending one-time passwords via text messages is a flawed security measure, companies continue to roll out the approach, especially in consumer-facing applications.

Following a spate of attacks targeting independent developers on its Steam game-distribution platform, game maker Valve last week said that it will require developers to provide their phone numbers so the company can use SMS for two-factor authentication (2FA) starting Oct. 24.
As part of a security update, any Steamworks account setting that builds live on the default/public branch of a released app will need to have a phone number associated with their account, so that Steam can text you a confirmation code before continuing,
the company stated in its notification
. We also plan on adding this requirement for other Steamworks actions in the future.
But since SMS-based two-factor authentication can be circumvented by persistent attackers using a variety of methods, the move raises the question: Why are consumer-facing online services still making SMS the go-to second factor, both internally and for customers?
Getting around SMS two-factor authentication has become a priority among attackers, and indeed, it has been defeated using everything from machine-in-the-middle attacks to social engineering — including, in the infamous
Uber breach case, through 2FA fatigue attacks
.
In 2022, for example, a
banking Trojan known as Xenomorph
compromised more than 50,000 Android devices after the cybercriminal group behind the malware disguised it as a performance utility, according to Tony Anscombe, chief security evangelist for digital security firm ESET.
In reality, it was stealing the user’s login credentials for banking, payment, social media, cryptocurrency and other apps that have valuable personal information, he says. The malware abused more than 50 apps, including PayPal and Coinbase, and included the ability to intercept messages and notifications, giving the cybercriminal the ability to bypass two-factor authentication codes.
But even the low-tech approach of just walking into a cellular store (
SIM-swapping
) or finding a corrupt technician works well, says David Richardson, vice president of endpoint and threat intelligence at cloud security platform Lookout. All an attacker has to do is
know the targeted individuals phone number
to attack the channel.
The whole system is basically built on an assumption of trust — I could walk into any store and easily cancel my contract and port my phone number ... to pretty much any carrier, he says. Basically [an attacker could] take over any phone number and start to receive the phone calls and, most importantly in these cases, the SMS messages that are that are going to those to those numbers.
And cellphone numbers are some of the most commonly leaked information on the Internet. The
recent compromises
of MGM Resorts and Caesars Entertainment, for example, exposed millions of records of business professionals and individual consumers, including phone numbers, which could be used by attackers for further attacks.
SMS-based 2FA persists in the face of the insecurity for the simple reason that its a relatively painless security mechanism for end users: A company merely needs to know is the customers phone number to text a one-time passcode for authentication. For consumer-facing companies, reducing friction is the name of the game.
At the same time, making attackers jobs even just a little bit more difficult helps protect developers — and the players of their games.
Any MFA is better than no MFA — like, vastly superior, Lookouts Richardson says. Youre 10 times harder to hack if youve got an SMS-based MFA, so ... youre way better off having some form of multifactor authentication versus no form of multifactor authentication.
An SMS code could have protected Benoît Freslon, the independent developer behind the game NanoWar: Cells VS Virus, for example. Freslon fell prey to a social engineering scam, apparently when cybercriminals posing as another developer sent him a direct message with malicious content, according to a statement posted on
Steams Community forums
.
I was hacked, all my social networks accounts including Discord and Steam were compromised ... [t]he hacker uploaded a malware with [sic] my account, a developer stated on Steams forums. Be careful when a friend ask you to test his game on private message on Discord. ... It was the most stressfull days [sic] of my indie developer life.
Valve removed the game from Steam on Aug. 25, a day after the group behind the hacks published the infected version from the developers account. The game developer
stressed
that a safe version of the game has been available since Sept. 15, uploaded from a totally clean machine.
Companies focused on consumers and worried that the additional friction posed by 2FA security could use app-based factors that are already widely adopted, such as Googles or Microsofts authenticators, says ESETs Anscombe.
Many consumer-focused companies already provide the option to use either Microsoft or Google authenticator apps, this reduces the barrier to adoption as consumers may already have these apps installed, he says.
An app is not subject to SIM cloning nor malware that uses the operating systems permissions system to read SMS messages, he says. The app itself should be protected by a passkey or biometrics adding an additional layer of security.
Boosting security has
become important for game companies
, as users have more digital in-game assets stored in online accounts that cybercriminals aim to monetize, and while cheaters look to access other gamers accounts to gain advantage. Steam expects to roll out more security measures in the future to better protect, not only the developers but its customers and reputation.

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Valves 2FA Mandate for Game Developers Shows SMS Stickiness