Incident: Steam Server Glitch Exposes User Data on Christmas Day

Published Date: 2015-12-26

Postmortem Analysis
Timeline 1. The software failure incident with Valve's Steam service happened on Christmas Day, as mentioned in the article [57490]. 2. The article was published on 2015-12-26. 3. Therefore, the software failure incident occurred on December 25, 2015.
System 1. Steam service by Valve [57490]
Responsible Organization 1. Valve - The software failure incident on the Steam platform was caused by a technical error on Valve's end, resulting in glitches that allowed users to see others' personal information and the store going offline [57490].
Impacted Organization 1. Users of Valve's Steam service, who were able to see others' personal information and experienced the store going offline [Article 57490].
Software Causes 1. The software causes of the failure incident on Steam were technical errors resulting in a caching issue that allowed some users to see pages generated for other users [57490].
Non-software Causes 1. Increased traffic during the annual winter sale event may have overwhelmed the servers, leading to performance issues [57490]. 2. Configuration change that resulted in a caching issue allowing users to see pages meant for other users [57490].
Impacts 1. Personal information exposure: Users were able to see others' account information, including email addresses, Steam Wallet money, and purchase history during the one-hour window of the glitch [57490]. 2. Service disruption: The Steam store went offline on Christmas due to the technical error, causing inconvenience to users who were unable to access the platform [57490]. 3. Security concerns: The incident raised concerns about the effectiveness of Steam's security tools, Steam Guard and Steam Mobile Authenticator, as they did not prevent the potential reveal of personal information [57490]. 4. User frustration: Some users expressed frustration on social media platforms like Twitter due to the delay in response from Valve regarding the software failure incident [57490]. 5. Impact on game developers: Game developers, such as Double Fine and Mike Bithell, shared how the temporary outage affected them, indicating potential financial and operational impacts [57490].
Preventions 1. Implementing more robust caching mechanisms to prevent caching issues like the one that occurred on Steam's platform [57490]. 2. Conducting thorough testing, including security testing, before making configuration changes to avoid unintended consequences that could lead to privacy breaches [57490]. 3. Enhancing the effectiveness of security tools like Steam Guard and Steam Mobile Authenticator to better protect user information in case of technical errors or glitches [57490].
Fixes 1. Implementing stricter caching policies to prevent the caching issue that allowed users to see pages meant for other users [57490]. 2. Enhancing the effectiveness of security tools like Steam Guard and Steam Mobile Authenticator to better prevent unauthorized access to user information [57490]. 3. Conducting thorough testing and quality assurance procedures to identify and address any potential technical errors before they impact users [57490].
References 1. Valve representative statement [Article 57490] 2. CNET's sister site GameSpot [Article 57490] 3. Steam's own security tools - Steam Guard and Steam Mobile Authenticator [Article 57490] 4. Valve's company website [Article 57490] 5. Twitter users [Article 57490] 6. Game developers like Double Fine and Thomas Was Alone developer Mike Bithell [Article 57490]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to Valve's Steam service experiencing glitches on Christmas Day was not the first time such an incident occurred within the same organization. The article mentions that on Saturday morning following the initial incident, various sections of both the Steam store and Valve's company website were still acting erratically, often timing out while loading content. However, these issues appeared to have been resolved by the afternoon [57490]. (b) The incident with Valve's Steam service experiencing glitches on Christmas Day is not unique to Valve alone. Similar incidents have happened before at other organizations or with their products and services. The article mentions that some users on Friday initially thought the Steam site had been hacked, indicating that such incidents are not uncommon in the digital gaming industry [57490].
Phase (Design/Operation) design (a) The software failure incident related to the design phase: The incident with Valve's Steam service on Christmas was attributed to a technical error resulting from a configuration change that led to a caching issue, allowing some users to see pages generated for other users [57490]. (b) The software failure incident related to the operation phase: The article does not provide specific information indicating that the failure was due to factors introduced by the operation or misuse of the system.
Boundary (Internal/External) within_system (a) The software failure incident with Valve's Steam service on Christmas was primarily within the system. The glitches, including users being able to see others' personal information and the store going offline, were attributed to a technical error that occurred within the system itself. Valve mentioned that a configuration change led to a caching issue, allowing some users to view pages generated for other users for a brief period. The issue was resolved internally by fixing the technical error [57490].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident was primarily due to non-human actions, specifically a technical error that resulted in a caching issue allowing some users to see pages generated for other users [57490]. (b) Human actions were also involved in the incident as users were able to access others' account information during the one-hour window of the glitch. Additionally, some users expressed frustration on Twitter about the company's response time to the incident [57490].
Dimension (Hardware/Software) software (a) The software failure incident reported in Article 57490 was primarily due to a technical error that originated in the software itself. The glitches with the Steam service, such as users being able to see others' personal information and the store going offline, were attributed to a configuration change that led to a caching issue, allowing users to view pages generated for other users for a brief period. This issue was acknowledged by Valve as a software-related problem and was subsequently fixed by resolving the caching issue [57490]. (b) The software failure incident was not explicitly attributed to hardware-related factors in the articles. The focus was on a technical error within the software that caused the glitches and privacy issues on the Steam platform. Therefore, the software failure incident in this case was primarily rooted in software-related factors rather than hardware-related factors [57490].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident reported in Article 57490 was non-malicious. The glitches with the Steam service, including users being able to see others' personal information and the store going offline, were attributed to a technical error that occurred due to a configuration change. Valve's representative mentioned that it was a caching issue that allowed some users to randomly see pages generated for other users for a period of less than an hour. The statement also emphasized that no unauthorized actions were allowed on accounts beyond the viewing of cached page information, indicating that the incident was not malicious in nature [57490].
Intent (Poor/Accidental Decisions) accidental_decisions (a) The software failure incident related to poor_decisions: - The incident was caused by a technical error resulting from a configuration change that led to a caching issue, allowing some users to see pages generated for other users [57490]. - Users were able to view others' personal information, including email addresses, Steam Wallet money, and purchase history, during the one-hour window of the glitch [57490]. - Despite the use of security tools like Steam Guard and Steam Mobile Authenticator, they did not prevent the potential reveal of sensitive information [57490].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident related to development incompetence is evident in the article as Valve's popular digital gaming store, Steam, experienced glitches on Christmas, allowing users to see others' personal information and the store going offline. This was attributed to a technical error that occurred due to a configuration change earlier that day [57490]. (b) The software failure incident related to accidental factors is highlighted in the article as the glitches with the Steam service, including the exposure of users' personal information and the store going offline, were described as a caching issue that allowed some users to randomly see pages generated for other users for a period of less than an hour. This issue was resolved, and Valve stated that no unauthorized actions were allowed on accounts beyond the viewing of cached page information [57490].
Duration temporary (a) The software failure incident in this case was temporary. The article mentions that the issues with the Steam service, including users being able to see others' personal information and the store going offline, were the result of a technical error that has since been fixed by Valve. The statement from Valve mentioned that a configuration change earlier that day caused a caching issue, allowing some users to see pages generated for other users for a period of less than an hour. The problems were resolved, and the service was back up and running without any known issues. Additionally, the article notes that the issues appeared to have been resolved by the afternoon of the incident [57490].
Behaviour crash, omission, other (a) crash: The software failure incident in the article can be categorized as a crash as the Steam service went offline on Christmas, preventing users from accessing the platform and its features [57490]. (b) omission: The incident can also be classified as an omission as some users were able to see pages generated for other users, indicating a failure of the system to properly restrict access to personal information [57490]. (c) timing: There is no specific indication in the article that the software failure incident was related to timing issues. (d) value: The incident does not directly relate to the system performing its intended functions incorrectly. (e) byzantine: The incident does not exhibit characteristics of a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. (f) other: The other behavior observed in this software failure incident is a privacy breach where users were able to view others' personal information, including email addresses, Steam Wallet money, and purchase history, due to a technical error [57490].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident related to the Steam service glitch resulted in users being able to see others' personal information, including email addresses, Steam Wallet money, and purchase history [57490]. This exposure of sensitive data due to the technical error could be considered as an impact on people's property (data) as their personal information was compromised.
Domain entertainment (a) The software failure incident reported in Article 57490 was related to the entertainment industry. The incident occurred on Valve's popular digital gaming store, Steam, which is a platform for purchasing and downloading games, as well as accessing social features related to gaming [57490]. The article mentions that the failure affected gamers during the annual winter sale where prices on thousands of games were slashed, indicating the system's primary purpose was to support the entertainment industry.

Sources

Back to List