Slashdot Mirror

SourceX from myg0t cheating clan found spyware in an earlier build of Steam and has proof.

http://rf-mods.com/ http://www.myg0t.com/

NB: TASTE AND DECENCY WARNING - DON"T CLICK...

..see I even warned you guys first.

chat log of myg0t member talking about hacking valve and stealing the code

http://gtwy.hl2arena.com/big_log.txt

and an email myg0t "recieved" that was sent internally at valve
remember, valve was hacked using an outlook virus and gabe talked about them knowing people where in his email

http://www.myg0t.com/ChrisNewcombe-PR.txt

I agree that Valve should not be blamed for allowing the code to reside on a machine connected to the Net. Having the code reside on a local machine (or local network of machines) that does not have Internet access is an impractical idea.

However, I think Valve shares some of the responsibility on other aspects. The unpatched Outlook (perhaps even the use of Outlook) is definitely a problem area for such a high profile organization. If they neglected to patch Outlook, what other basic security issues were neglected by Valve? Perhaps it was something as simple as Gabe using his home computer which he left unpatched, but that's something that network admins should be aware of IMO.

I also think Valve's staff is vulnerable to social engineering. Take a quick peek at myg0t.com (skip the intro and turn off the music) and read about the various chats that were had with Valve personnel. Really simple stuff that worked.

My point: Valve should be aware that they are high profile and they should have at least taken measures to make themselves secure against basic hacking methods.

Go here to skip the annoying flash intro, but that won't be much help since the whole site is flash based.

http://www.myg0t.com

There seem to be ups and downs in Steam. Sure, it takes a little longer to initially load, but that is only when you access stuff for the first time. You can also choose to "enable background caching", where it downloads everything while your computer is sitting idle, resulting in no waiting for downloads.

Ultimately, Valve's goal with Steam seems to use it as a strong measure to curb cheating. Throughout online communities today, cheating has been running rampant, and honest gamers are being turned away. You could use the traditional approach, and release regular patches every so often to address cheating exploits, but those take time, and still leave some areas vulnerable.

Steam can easily implement something that verifies the integrity of it's *.dll files (which are often hacked to exploit cheats), and if the checksum doesn't match, it could download the original on demand. Better yet, if the files aren't that big, it wouldn't be too hard to download the file every time the application is loaded.

Granted, Steam takes up some bandwidth, and could pave the way towards true "pay per play" services, but the bottom line is that many gamers are pissed off at the cheating, and would happily pay a small fee or put up with a little longer loading if it meant there were considerably less cheaters.

Cheating groups like Myg0t are already worried. They realize that Steam will be a real burden to exploit, and their days will soon come to an end.