Slashdot Mirror
Valve Patches Security Bug That Existed in Steam Client for the Past Ten Years (bleepingcomputer.com)
Valve developers have recently patched a severe security flaw that affected all versions of the Steam gaming client released in the past ten years. From a report: According to Tom Court, a security researcher with Context Information Security, the one who discovered the flaw, the vulnerability would have allowed an attacker to execute malicious code on any of Steam's 15 million gaming clients. In the jargon of security researchers, this is a remote code execution (RCE) flaw because exploitation was possible via network requests, without needing access to the victim's computer. Court says an attacker was only required to send malformed UDP packets to a target's Steam client, which would have triggered the bug and allowed him to run malicious code on the target's PC.
First post! Yeah!
"I say we take off, nuke the site from orbit. It's the only way to be sure."
"bugs" like these are so peculiar in that they simply do not happen by themselves. Someone intentionally did this, and the question is who. Valve, or someone else?
Modern app appers app apps with OTHER apps, NOT LUDDITE software like LUDDITE Steam!
Apps!
Unless someone has their machine connected directly to the internet (in which case you've got a whole lot of bigger problems), what's the likelyhood that this would actually be exploited?
The only thing that means is that Valve is not writing new and really bad code all the time, they actually and sanely keep what works and improve it. Yes, sometimes that takes long, but nobody with an actual clue is surprised by that.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
problems? Just sucks spending money to buy a game that Valve doesn't allow you to play. I bought Cities: Skylines Monday when it was on sale, and after several back and forths with their support, I still can't play it. They claim their authentication is so unreliable to "protect users."
Lool do you have a full time nurse to help with your mental problems?
One million monkeys typing for one million years wouldn't even produce a sensible paragraph, let alone the works of Shakespere. Yet...
Yet every single code bug 'accidently' introduced by Microsoft, Apple, Steam, Google etc etc has the remarkable property of allowing state agencies to snoop and/or run code remotely on your computer. Yet Slashdot DEMANDS that anyone coming to the obvious conclusion be downvoted and labelled a 'conspiracy crackpot'.
Slashdot runs non-relevant POLITICAL PROPAGANDA articles daily, when said propaganda boosts Israel, or denigrates Israel's enemies like Syria, Iran and Russia. Yet when the monsters of Israel were witnessed shooting unarmed protestors and the medical personnel that attempted to help the victims, Slashdot, like Digg and other similar outlets, became news 'blind'.
The REAL story behind the Novichok false flag became all too obvious yesterday when an identical anti-russian false flag (in Ukraine) fell to pieces when an 'assasination' had to be cancelled after MI6 became aware the Russians had inside information abvout the truth. The PROOF of one false flag will never be allowed to suggest the true nature of other operations on Slashdot, however. This is the same site that (on NSA instructions) ran fake news articles about how erasing data on your HDD with strings of random bytes was "pointless" cos of magic NSA tech that could still recover that data.
So the scumbag owner of Valve/Steam offered his services to the intelligence agencies of the West. We should have expected nothing less.
Great, so now are they going to prevent it from hanging like a bitch if you start windows without a network?
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
You're going to be watching a whole lot of nothing. You know the US doesn't enforce laws when it's a rich guy.
What is the news here? Bugs exist until they are discovered, this could be years or even never. Tom wants his fifteen minutes? Oh it is bleeping computer, explains everything.
Isn't the internet great?.... Russians can post anything they want, anytime to destabilize the US... and generate hate.
5 out of 6 people enjoy Russian Roulette & 6 out of 7 Dwarfs are not Happy
The Steam client also stores your login information in plain text, allowing anyone who looks at debugger/crash dump to steal your credentials. If you happen to use the same credentials with the email account linked to your Steam account it can hijacked and sold before you can do anything about it.
There are many ways that UDP packets can traverse NAT (see UDP hole punching for example). There are lots of applications, especially in games, where UDP makes more sense than TCP. If I know the public IP address of a Steam user, with a bit of guess work and a sending a lot of packets to their router I could impersonate a legitimate UDP sender and get their router to forward the UDP packets to their machine. So yes, this exploit is bad.
Worst part is when you buy a game in the store and get it home and it requires to be linked to a Steam account to play.
I know PC gaming is (at times) waning vs console, especially in say, sales of a ported game. /generally/ would sell less.
(Example GTAV, PS3, 360, PS4, Xbox One and PC) the PC version
However.
The PC library with it's true backwards compatibility and age, the immense volume, the new Chinese customers, seriously 15 million?
I would've happily believed Steam has an install base of at least 50 to 100million PCs at any time.
Very surprising.
Wait, so I can just send malformed UDP packets to anyone on the internet, and their computer will pick it up without having firewall rules or port forwarding configured in their routers? I was not aware that internet technology had regressed to the 1990s.