Valve, the company behind the widely popular Steam gaming platform, has recently announced that it has added a new security check for game developers using Steamworks. This additional security check would require developers to verify their identity via SMS to update games on Steam.
Starting October 24, 2023, developers will need a phone number linked to their account to verify their identity before rolling out new game builds / applications or adding new users to the account.
This move from Valve comes after multiple reports of hackers compromising Steamworks accounts of multiple game developers and updating their games with malware started floating around late August and into September 2023. The attackers uploaded malicious builds that infected players with malware.
The impacted users were individually notified of the potential breach via notices sent by the company.
To prevent this problem, Valve has implemented a two-factor authentication check, which game developers must pass before updating the default branch of a released game.
Steam will text a confirmation code to the developer, which they will need to enter in order to set the default branch. However, they would not require a code if their app is not yet released or if they are updating a beta branch.
Similarly, only admin accounts in the Steamworks partner group can invite other users. In order to invite a new user, the new user would need to confirm their email address. However, with the new security check, the admin account inviting the new user would now need to enter an SMS code before sending the invite.
“As part of a security update, any Steamworks account setting builds live on the default/public branch of a released app will need to have a phone number associated with their account so that Steam can text you a confirmation code before continuing,” wrote Valve in their announcement last week.
“The same will be true for any Steamworks account that needs to add new users. This change will go live on October 24, 2023, so be sure to add a phone number to your account now. We also plan on adding this requirement for other Steamworks actions in the future.”
Further, Valve has also updated the SetAppBuildLive API that requires a steamID for confirmation via the Steam Mobile app, especially for changes to the default branch of a released app.
In addition, game developers can no longer use ‘steamcmd’ to set the default branch for a released app, as it is no longer applicable. However, ‘steamcmd’ can continue to be used to upload builds and prepare beta test branches.
Lastly, Valve says SMS text messages will be the only way to receive the two-factor code. Hence, Steam partners must register a mobile phone number or some way to get text messages if they need to add users or set the default branch for a released app.
