Slashdot Mirror
Researcher Uses Valve Security Bug To Upload Paint Drying Game On Steam (softpedia.com)
An anonymous reader writes: A security researcher found two bypasses in Valve's game review process that eventually allowed him to publish Steam Trading Cards and a full game on the Steam Store called "Watch Paint Dry" (reference to this case from last month involving the British film censors). The game was supposed to be an April Fools' Day prank, but the researcher forgot to set a release date, and [the game] was published on the Steam Store last weekend. Valve has fixed the security bypass in the meantime. These bypasses were extremely dangerous since they allowed anyone to publish games on the Store (possibly containing malware) without a Valve employee ever taking a look at them, or knowing they went through the review process.
I guess a lot of games used that bypass to be on the early access judging by the lack of quality and polish and high price
Another Windows-only game!
Am I reading this right? That the man who wrote "Watch Paint Dry" is not able to muster the patience to set a release date barely three days into the future? Those zero-day vuln'ers never cease to amaze...
Just what we needed... another IT training app.
Probably more exciting than what was on German TV over the Easter weekend.
"Extremely dangerous" because where would we be without the approval of a valve employee?
Sigh.
Validate untrusted data. Don't just rely on a "1" in a form field somewhere to say something is okay.
I mean... seriously, Valve. I was quite impressed that - as yet - still NOTHING came of your "compromise" where the encrypted credit card database of Steam services was stolen, which means you DID IT RIGHT where countless others couldn't.
But, seriously? A form field for validation? For God's sake.
(alright, maybe they are all sarcastic but still)
He should have submitted it through normal means, who knows how many people would buy it...
Nice troll guys, now get back to work.
a walk through on how it was done can be read here: http://gamasutra.com/blogs/Rub... or here: https://medium.com/@rubiimeow/...
Paint Drying? Humm that's gotta be better than Civilization Beyond Earth
Harrison's Postulate - "For every action there is an equal and opposite criticism"
Steam really needs to move away from the "foll your desk" to the "Hire some bosses" because there's no one choosing to work on stuff like testing and tech support.
I can't get to the store in their steam client, and i've been ignored for over a month and a half now in the tech support ticket.
So the lack of security is no surprise.
_ _ _ Go for the eyes Boo! GO FOR THE EYES!
I'm pretty sure if I did this there would be even money on me being charged with something. Now, personally I'm all for this sort of thing but there is no way in hell I'd attach my dev account to it with the risk of being labled a hacker and raided by some agency or other. Was this guy somehow already affiliated with Valve beyond having a dev account?
At least this one doesn't require a $500 video card.
Come on, now. We all know they don't have one.
Sounds like you've got it twisted, sir. They used Steam and, in the end, they let Valve off. Which is also a waste of energy, of course, but the difference is in the direction of entropy. I can readily illustrate this with a paint analogy: when you watch the stuff turn from wet to dry in front of your own eyes you'll say, ah I'll just turn it back later, but NO sir, this same process is NOT reversible, no matter how long you keep staring.
It looks like an interesting game, and it looks like it might have a broad base of interested customers.
That is based on what I saw when I loaded the game's page on Steam. Two of the games Steam says are "More like this" are:
Stardew Valley
and
Fallout 4.
Those are rather dissimilar games, for anybody who watches the gaming scene.
"Watching Grass Grow".
There was a Medium post by the author, they stated they gained a steamworks account via a different exploit (which has also been fixed), which they haven't published. https://medium.com/swlh/watch-...
I do game dev stuff, and my account has backend access for my publisher - and years ago I noticed something like 'publisher id' in the URL or such, and just thought "hmm, I wonder what would happen if I changed that number?" - lo and behold, when I changed that number I had access to a completely different companies game repository, and could browse around it - and I reported the issue.
They seem to have changed how this works since, thankfully - but between that, and numerous issues I saw in the Steamworks API - I don't have much faith in their security practices.
If you read about Valve and their "everyone, artist/mapmaker/etc. should code!" philosophy, it's not a surprise that they have a lot of security issues in their code - their unusual/decentralized approach to development, also suggests to me that nobody is going to focus on security, unless they feel like it.
They need a dedicated in-house team for finding security issues - and their online platform team needs to be drilled on security issues. There's no excuse for not doing that at this stage, given how big a company they are, and given their customers (game devs and players alike) are risking IP and personal information theft.
And people were giving Oculus shit for turning off "outside of Oculus" games default. This is why.
Neil is that you? Yeah yeah, it's me... Neil...