Slashdot Mirror
Valve Patches Security Bug That Existed in Steam Client for the Past Ten Years (bleepingcomputer.com)
Valve developers have recently patched a severe security flaw that affected all versions of the Steam gaming client released in the past ten years. From a report: According to Tom Court, a security researcher with Context Information Security, the one who discovered the flaw, the vulnerability would have allowed an attacker to execute malicious code on any of Steam's 15 million gaming clients. In the jargon of security researchers, this is a remote code execution (RCE) flaw because exploitation was possible via network requests, without needing access to the victim's computer. Court says an attacker was only required to send malformed UDP packets to a target's Steam client, which would have triggered the bug and allowed him to run malicious code on the target's PC.
First post! Yeah!
"I say we take off, nuke the site from orbit. It's the only way to be sure."
"bugs" like these are so peculiar in that they simply do not happen by themselves. Someone intentionally did this, and the question is who. Valve, or someone else?
Unless someone has their machine connected directly to the internet (in which case you've got a whole lot of bigger problems), what's the likelyhood that this would actually be exploited?
The only thing that means is that Valve is not writing new and really bad code all the time, they actually and sanely keep what works and improve it. Yes, sometimes that takes long, but nobody with an actual clue is surprised by that.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
That "Steam Guard code" is just crap. I work a lot of hours so I don't have much free time, and it just sucks waiting on the email with the code so I can login to be allowed to play a game I own. By the time I finally get the code to login, I've usually moved on to doing something else.
Great, so now are they going to prevent it from hanging like a bitch if you start windows without a network?
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
What is the news here? Bugs exist until they are discovered, this could be years or even never. Tom wants his fifteen minutes? Oh it is bleeping computer, explains everything.
Isn't the internet great?.... Russians can post anything they want, anytime to destabilize the US... and generate hate.
5 out of 6 people enjoy Russian Roulette & 6 out of 7 Dwarfs are not Happy
There are many ways that UDP packets can traverse NAT (see UDP hole punching for example). There are lots of applications, especially in games, where UDP makes more sense than TCP. If I know the public IP address of a Steam user, with a bit of guess work and a sending a lot of packets to their router I could impersonate a legitimate UDP sender and get their router to forward the UDP packets to their machine. So yes, this exploit is bad.
I know PC gaming is (at times) waning vs console, especially in say, sales of a ported game. /generally/ would sell less.
(Example GTAV, PS3, 360, PS4, Xbox One and PC) the PC version
However.
The PC library with it's true backwards compatibility and age, the immense volume, the new Chinese customers, seriously 15 million?
I would've happily believed Steam has an install base of at least 50 to 100million PCs at any time.
Very surprising.
Steam Desktop Authenticator
Wait, so I can just send malformed UDP packets to anyone on the internet, and their computer will pick it up without having firewall rules or port forwarding configured in their routers? I was not aware that internet technology had regressed to the 1990s.