Slashdot Mirror
Steam Protocol Opens PCs to Remote Code Execution
Via the H comes news of a possible remote attack vector using the protocol handler installed by Valve's Steam platform: "During installation, it registers the steam:// URL protocol which is capable of connecting to game servers and launching games ... In the simplest case, an attacker can use this to interfere with the parameters that are submitted to the program. For example, the Source engine's command line allows users to select a specific log file and add items to it. The ReVuln researchers say that they successfully used this attack vector to infect a system (PDF) via a batch file that they had created in the autostart folder. ... In the even more popular Unreal engine, the researchers also found a way to inject and execute arbitrary code. Potential attackers would, of course, first have to establish which games are installed on the target computer. "
A (user side) solution from TFA:
The issue can be limited by disabling the steam:// URL handler
Sounds alright to me. I can't recall ever clicking a steam:// link anyways.
From the summary:
" Potential attackers would, of course, first have to establish which games are installed on the target computer. "
Create a list of games by popularity, you're bound to find one of them somewhere. In other words, they may not be able to target a specific computer but the odds are good that they'd find many they could target. Even a specific computer, if you know anything about the owner, quite likely might have popular games x,y and z on it based the owner's preferences.....
PANIC!!!! PANIC!!! PANIC!!!
What would Richard Feynman do, if he were here right now? He'd do some math and he'd follow through!
I do not get how exactly this is an exploit. You need to create a batch file on the intended system start-up folder first. If you can do that. Why not just have the batch file execute a command to download a malicious file and execute it?
Not sure what the real issue is...
Agree, I can't see how this exploit would work without a previously compromised system. They are also relying on users to click on bad links to get the process started. How is this at all new?
The system is not already compromised. They are using the vulnerability to create the .bat file by specifying this as the log file for Team Fortress and then echoing commands into it.
The sentence is poorly phrased: what they mean is that they create the .bat file using some command line parameters (one of which dumps console output to the file of your choice, which could be "c:/autoexec.bat"). That then gets executed automatically on login, and boom, exploited.
The solution is pretty easy: make browsers that open external programs for a link show what they are doing and exactly what the command is, and/or have steam show the same when it loads the protocol command. Steam could also refuse to pass command line parameters, but that limits the usefulness of the protocol in the first place (might be necessary, unfortunately).
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
Except that here they're using the ability to pass command line options to source engine games started via the steam URL handler to create their log file in a certain location with a certain name (like "foo.bat" in the startup folder) then using the echo command via the same URL parameter to log anything they want into that file - and I'm pretty sure a batch file containing "del /s c:\" in there won't be very much appreciated the next time the user logs on...
"I'm not anti-anything, I'm anti-everything, it fits better." - Sole
Considering that URL handlers are executed by just about any browser on Windows and it's Safari and other Webkit-based ones that silently execute URL handlers instead of asking the user for confirmation - what's with the fixation on Firefox?
"I'm not anti-anything, I'm anti-everything, it fits better." - Sole
"Installations of Steam vulnerable to a drive by download by users of mozilla based browsers with certain games installed within steam"
Yeah, sure, whatever you say.
Browsers such as Internet Explorer, Chrome and Firefox display an alert when steam:// URLs are called; only Safari passes them on without any warning.
It is what it is.
"According to the results reported in Table 1 all the browsers that execute external URL handlers directly without warnings and those based on the Mozilla engine are a perfect vector to perform silent Steam Browser Protocol calls. "
Yeah, I read it too fast, my mistake.
Oh look, yet another vulnerability caused by allowing web pages to start random applications on your system.
Who ever thought that was a good idea?
And I missed that sentence, thanks. (Although, if I ever see a Launch Application message in Firefox that I wasn't expecting, I certainly won't click OK...)
It is what it is.
Try all the popular games, you're likely to get 1 hit - and that's all you need.
I want to delete my account but Slashdot doesn't allow it.
Windows NT based systems have come with file permissions for a long time. Remove write permissions from the user and global startup folders. Yes, all write permissions, even for the user "System" (I hate anything that uses the startup folder anyway and wouldn't allow anything in there)
Or what about programs like that "Tea Timer" (Spybot Search and Destroy) or others that block things from getting in startup? (I always thought Tea Timer to be a silly nuisance, never to be activated, but here's an instance where it would help)
Attack foiled.
Personally I am not worried about this, for I use Windows only for games. The chances of me going to a bad URL while in Windows are near zero. Besides, now that the cat is out of the bag, Valve will probably find a way to mitigate this with one of the next client updates.
I recommend that people run Firefox as a different user from the user account they use to log in. On Windows you can use the runas command.
;).
You have to give your main user account full permissions to the browser user account, so that you can copy files that the browser downloads etc.
Make sure firefox is installed using either the main or admin account, NOT the browser account. This prevents the browser account from doing too many changes to the executables. However this means you'll need to update the browser using the main/admin account, but this could be considered a feature not a bug
Once you do that if you get hit by a drive by, most of the usual startup stuff[1] will only take effect if you ever log in as the browser user account. But since you only log in as your normal main user account, the stuff doesn't run. If you ever need to run as the browser account, make sure you clean stuff up before you do. If you are using windows, load the registry hive to check etc.
[1] Other stuff could be installed. If you're using Linux "crontabs" and "at" stuff might be able to be configured. However if you set stuff up correctly the damage is limited - since the browser account won't have access to your data. On Windows normal users can't use "at" by default.
I recommend that people run Firefox as a different user from the user account they use to log in.
Is there a reason that only Firefox users should do this? Based on the PDF, the only difference (in this case) is that some of the other browsers display the URL as well...
It is what it is.
Sure, go ahead. Have fun.
Uh, call me crazy, but I just checked the manager in firefox and steam links are set to 'ask first'. I tested, got a popup asking me if I want to run the link with application 'Steam'... unless it was something I wanted, I would generally click 'no'.
Not a very good exploit, imho.
...
Simples as that.
Wow I never thought of that! But so true...
Reason is I haven't managed to get the "runas" thing to work for Google Chrome and recent versions of IE.
Chrome and IE do sandboxing, I don't know whether that's enough for exploits like this. In contrast if you run firefox as restricted User A, and it somehow can run stuff as User B the OS has a serious bug. There have been such bugs, but they are a lot rarer than bugs in browsers, pdf viewers, flash etc.
For banking stuff I run a different browser using yet another user account. So they can pwn my facebook browser, but the hacker has to be really targeting me to pwn my bank browser. While they can pwn me if they really want, from what I see they are more likely to target the bank - more $$$ for the effort. Even I have found security issues with online bank sites before, so it's not like banks are that much harder to hack than me.
Chrome and IE do sandboxing, I don't know whether that's enough for exploits like this.
I don't think so, because it is not a browser exploit as such. They are just delivering the URI to Steam. I wonder if the restricted account has the protocol registered as well... Well, at least it wouldn't have Steam configured and logged in.
It is what it is.
Which is why the old adage DO NOT RUN AS ROOT is applicable.
When I install a fresh copy of Windows 7 I create the user name God or Super User and then after everything is patched and software is installed I add a second account with just standard/limited permissions.
Windows 8 goes a step further and limits your account to regular user by default. You get a UAC everytime if you want to change something. I should be fine iwth this since I only have read-only access to any settings as I only run as a standard user.
I wish more Windows XP/7 users did this. Running as a non standard user is not asking for trouble. While it wont protect you from rootkits, buffer overflows, or priveldege esculation attacks, it will surely protect you from exploits. Still the URL is entered by the hackers so you will be vulnerable if you run as admin so be warned.
http://saveie6.com/
Or how about just run Firefox and Steam as a standard user? You shouldn't be running as an administrator anyway in this day and age and you are just asking for touble otherwise.
I do this by default on all my Windows 7 installation where I create a Super User account and then last create a regular user account for that person and explain to use that one by default and never user the other admin account unless you are installing a scanner or a new software package.
This wont fully protect you as a buffer overflow or priveldge escalation can get around this but it adds another layer and another annoying step for the hackers. Most hackers know people are stupid and run as admin at home so you should be safe from this.
Another recommendation is to drop Firefox totally. I know I may piss some people off reading this but IE and Chrome have sandboxing built in. FF is behind in this area and require noscript and other disruptive add-ons to achieve the same security. I hated Sandboxie before I started using Chrome.
http://saveie6.com/
IE7+, when running in its sandbox ("Protected Mode"), will pop up a second warning message when clicking a link that invokes an external program. It doesn't really tell you anything that the first message didn't, except that the program will execute outside of the Protected Mode sandbox, but it's another chance to realize something is wrong and cancel it.
There's no place I could be, since I've found Serenity...
It's actually quite simple in this case, though: you can specify, on the command line, a log file (with full path and extension). Then, you can specify "echo" commands which will be written to the log file. These lines will appear at the top of the log, before any of the game's usual log spew. So yes, you can guarantee that the lines for "download this arbitrary executable and run it" appear at the top of the batch script.
If you want to, you can even then put an exit instruction in the script, so the user doesn't even see the script window full of game spew. Of course, by that time they'd already be owned anyhow...
There's no place I could be, since I've found Serenity...
It's going to be hard for Valve to mitigate; most of the bugs found are in games that Valve doesn't develop, often even games that don't run Valve's game engine. Don't let the shit-heap of a summary fool you; there are ton of attacks you can do if you can pass artbitrary parameters to games. The whole "script in the startup folder" thing is *one* way that you could do this attack using *one* game engine (which happens to have been developed by Valve). The researchers list a bunch of other exploits too, ranging from memory corruption bugs to games which will install update packages from arbitrary locations specified on the command line. Game developers are, by and large, *terrible* at security.
There's no place I could be, since I've found Serenity...
Valve just pushed out an update for Half-Life 2: Deathmatch, Day of Defeat: Source, and Team Fortress 2 that is supposed to fix the con_logfile bug in those games.
Unfortunately, their other multiplayer games remain unpatched, most notably Counter-Strike: Source and Counter-Strike: Global Offensive.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
Steam URLs don't contain hostnames, because they run things on your PC. The only funny thing would be how dumb a person that tries it is.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Because Little Johnny knows how to grok that shit, and wants to click something other than whatever button that means "GTFO, I just want you to do the thing I told you to do, you whiny bastard infernal machine!"
(Except, he doesn't.)
Kid-proof tablet..
Doh. If you do that when you get pwned it's trivial for the malware to set things up so that it runs whenever you login.
Whereas with my way, it is much harder for the malware to do that. It could perhaps set itself to run whenever the browser runs - plugin/extension, but it has no access to your main user account. It only has access to what you allow the browser account to access.
And who but you is even talking about running stuff as administrator? If you install stuff as admin, but run stuff as some other user, that makes it harder for the executables to be changed.