Slashdot Mirror
Steam Protocol Opens PCs to Remote Code Execution
Via the H comes news of a possible remote attack vector using the protocol handler installed by Valve's Steam platform: "During installation, it registers the steam:// URL protocol which is capable of connecting to game servers and launching games ... In the simplest case, an attacker can use this to interfere with the parameters that are submitted to the program. For example, the Source engine's command line allows users to select a specific log file and add items to it. The ReVuln researchers say that they successfully used this attack vector to infect a system (PDF) via a batch file that they had created in the autostart folder. ... In the even more popular Unreal engine, the researchers also found a way to inject and execute arbitrary code. Potential attackers would, of course, first have to establish which games are installed on the target computer. "
A (user side) solution from TFA:
The issue can be limited by disabling the steam:// URL handler
Sounds alright to me. I can't recall ever clicking a steam:// link anyways.
From the summary:
" Potential attackers would, of course, first have to establish which games are installed on the target computer. "
Create a list of games by popularity, you're bound to find one of them somewhere. In other words, they may not be able to target a specific computer but the odds are good that they'd find many they could target. Even a specific computer, if you know anything about the owner, quite likely might have popular games x,y and z on it based the owner's preferences.....
PANIC!!!! PANIC!!! PANIC!!!
What would Richard Feynman do, if he were here right now? He'd do some math and he'd follow through!
"Installations of Steam vulnerable to a drive by download by users of mozilla based browsers with certain games installed within steam"
I do not get how exactly this is an exploit. You need to create a batch file on the intended system start-up folder first. If you can do that. Why not just have the batch file execute a command to download a malicious file and execute it?
Not sure what the real issue is...
From TFA:
Our choice for exploiting this bug is to create a .bat file in the Startup folder of
the user account which will execute our commands injected through +echo at the
next login of the user on the system. There is also an interesting scenario against
dedicated servers by specifying the motd.txt of the game as logfile and launching
the cvarlist command that will dump all the game variables in such file that is
visible to any player who joins the server. Team Fortress 28 is one of the most
played games based on this engine and it’s free-to-play.
They system is already compromised at this point. Why do we need the steam protocol?
Also, for the love of god, please stop calling these people security researchers.
Oh look, yet another vulnerability caused by allowing web pages to start random applications on your system.
Who ever thought that was a good idea?
Try all the popular games, you're likely to get 1 hit - and that's all you need.
I want to delete my account but Slashdot doesn't allow it.
Has anyone tried to DDoS a steam://* URL? Might be funny.
Uh, call me crazy, but I just checked the manager in firefox and steam links are set to 'ask first'. I tested, got a popup asking me if I want to run the link with application 'Steam'... unless it was something I wanted, I would generally click 'no'.
Not a very good exploit, imho.
...
So glad I didn't accept that new Mandatory Binding Arbitration EULA. That means steam doesn't even work on my computer anymore.
And for the rest of you, too bad no matter what happens you can't sue Valve! Suckers... :^D
Simples as that.
Wow I never thought of that! But so true...
And why wouldn't the DRM already put code in that does bad things? Already does, really.
Maybe that game distributor will delete the driver for your DVD-RW in case you think you can copy the game.
Or root you like Sony did.
I thought the link to the PDF in the summary was a nice touch.
Am i the only one that sees the irony in detailing an exploit for steam in a pdf file; one of the most exploited formats that has ever existed thanks to adobe?
If i were still using adobe reader i think i'd rather open an unknown exe than pdf.
It's actually quite simple in this case, though: you can specify, on the command line, a log file (with full path and extension). Then, you can specify "echo" commands which will be written to the log file. These lines will appear at the top of the log, before any of the game's usual log spew. So yes, you can guarantee that the lines for "download this arbitrary executable and run it" appear at the top of the batch script.
If you want to, you can even then put an exit instruction in the script, so the user doesn't even see the script window full of game spew. Of course, by that time they'd already be owned anyhow...
There's no place I could be, since I've found Serenity...
Valve just pushed out an update for Half-Life 2: Deathmatch, Day of Defeat: Source, and Team Fortress 2 that is supposed to fix the con_logfile bug in those games.
Unfortunately, their other multiplayer games remain unpatched, most notably Counter-Strike: Source and Counter-Strike: Global Offensive.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
The study suggests and relies upon the fact that the victim:
1. Has acquired already malicious content (e.g. an autostart .bat command set).
2. Has no security knowledge and does stupid things like allowing random escalated privileges, UAC control prompt bypasses and (successful socially engineered attacks) knowingly runs remotely acquired code.
All software has the kind of vulnerabilities as the study describes about Steam. If the attacker already has access to the victim's computer by the means of (1) and (2), there is no reason why to make things complicated by utilizing Steam's weaknesses. You'd have 100% access anyway to all parts of the computer.
Steam is DRM. Like just about every other piece of DRM before it, steam has security holes.
So Steam does bad things (prevent[1] you from playing the games you stupidly bought legally instead of downloading the cracked version), and it does even more bad things (allow people to control your computer).
This makes Steam no different from other DRM. The people who have been praising Steam for not being as bad as other forms of DRM have now been proven wrong.
[1] Read the posts about being unable to "go offline" with no internet connection available. When I have no internet connection available, that's when I have nothing better to do than play games.
Potential attackers would, of course, first have to establish which games are installed on the target computer.
Steam community, wot?
While these exploits are things that should be fixed, it's not as if they are practical to exploit, seeing the level of specific knowledge you need of the targeted user etc.; it's not like your average Flash zero-day, nobodies going to write a wide-scale exploit based on this, and it's not really notable for a Slashdot front page post (I'd go so far as to say the report is more attention seeking than substance).
That said, Valve definitely should fix this up, and I'd say it won't be long before they do.
I can speak from experience though, that all games are chock-full of exploitable code, and generally it never gets fixed because the developers don't judge it as economical to do so, until stuff is actually being exploited and becomes a nuisance to players (even then, usually stuff only gets exploited like that once devs have moved on from supporting the game in question, meaning nothing gets fixed); that would be a more noteworthy story to see on Slashdot.
Disclaimer: Game developer and minor reverse-engineer enthusiast.