Slashdot Mirror

← Back to Stories (view on slashdot.org)

A Bug in Steam, Which Was Recently Patched, Could Have Given Users Access To Activation Key of Any Game (zdnet.com)

Posted by msmash on from the a-man-can-dream dept.

Ukrainian vulnerability researcher has found a bug that would have allowed him to download all the activation keys (also known as CD keys) made available through the Steam gaming platform, for any game, ever. From a report: Discovered by Artem Moskowsky, the bug resided in Steamworks, a platform that Valve runs to help developers with building and publishing games via its Steam gaming client. Moskowsky found the bug in a Steam web API located at partner.steamgames.com/partnercdkeys/assignkeys/. This is the API that lets game developers or affiliates retrieve CD keys made available to Steam users so their customers can activate a game installed via the Steam client. This API is accessible using a regular Steam account and takes several parameters, but the ones most relevant are appid (representing the game), keyid (representing the identifier of a set of CD keys), and keycount (representing the number of CD keys that Steam needs to return inside a CD key set).

19 comments

  1. A Bug In Slashdot Gives AC Access to First Post by Anonymous Coward · · Score: 1, Funny

    exploited, m'gentle ladies

  2. But without auditing? by SirMasterboy · · Score: 1

    Do we really think that usage of that API wouldn't have been audited though?

    1. Re:But without auditing? by Anonymous Coward · · Score: 1

      Only if some dumbfuck downloaded them all at once, sure.
      But if you downloaded them in random chunks at a time, it would seem like regular usage patterns on the server logs.
      Whether they have a system in place to alert if, say, money coming in wasn't equal to the keys going out, or something along those lines, is another question.

      A lot of people overlook usage patterns in their APIs, usually leaving algorithms to deal with it.
      But you can cheat a lot of algorithms in the right ways if you trial-and-error information out of it.
      It will in this case require illegal activity, of course, but it could probably have been done. Hell, it might have been done! You never know with all these key-resellers. They say they could be other peoples keys, but you never know for sure.

    2. Re:But without auditing? by MrL0G1C · · Score: 3, Insightful

      A criminal would grab thousands of keys for full price AAA titles and sell them on grey market sites for a quick profit, they wouldn't care if the keys got revoked after an audit.

      --
      Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
    3. Re:But without auditing? by Anonymous Coward · · Score: 0

      And with gray market site you mean G2A.
      They claim to be legit but have no qualms about selling stolen keys.

  3. Now you tell me... by Anonymous Coward · · Score: 0

    What good is it if they already patched it?

    1. Re: Now you tell me... by Anonymous Coward · · Score: 0

      They already patched it? So, just a pile of crickets then for this post?

  4. Thanks Artem Moskowsky by Anonymous Coward · · Score: 0

    This is why we can't have nice things

  5. No thanks to free stuff by kaoshin · · Score: 5, Insightful

    Even if all Steam games were available for free, I would still pay, because I want to continue to support what they are doing for gaming on Linux. I do take advantage of a lot of the sales they run though.

    1. Re:No thanks to free stuff by Anonymous Coward · · Score: 0

      if everything were free I'd still pay

      peak socialist economics

    2. Re:No thanks to free stuff by Anonymous Coward · · Score: 0

      what linux games, you mean all the hentai dating sim visual novels?

    3. Re:No thanks to free stuff by Tukz · · Score: 2

      Valve is basically funding DXVK, a low-level Vulcan based translation layer for Direct3D 10/11.

      Their work with Proton (Steam version of Wine) is amazing and they have made amazing progress the last few months. Thousands of games are now available through "Steam Play" via Proton and DXVK.

      Valve isn't making any of those "hentai dating sim visual novels" you speak of.

      --
      - Don't do what I do, it's probably not healthy nor safe. -
  6. Did he get any keys as a reward? by Only+Time+Will+Tell · · Score: 2

    I wonder if Steam tossed any free keys his way for the heads up about this hole. I did see he got $20K for this effort, which would buy a lot of games of Civilization!

  7. Re:Agree by wolfheart111 · · Score: 1

    Looking forward to the christmas discounts :)

    --
    [($)]
  8. Re:Agree by rtb61 · · Score: 1

    Steam have got more than just a little douche baggery, allowing developers who sold you the game, to force downgrades after buying the game, to sell DLC matched to that downgrade. Steam is now chasing the developers to screw over the users, rather than the other way around. I have stopped buying on Steam to take back control of game upgrades to block install of shitty downgrades, worse to date, Paradox and Stellaris. Watch you game be forced upgraded to now serve you publisher ads and slowed down application start to serve ads, watch you game adjusted to serve make believe new SJW customers, watch your game suddenly becoming well worse all round, when the next version comes out. Until Steam gets it shit together on game updates and patch fixes, you should probably avoid it because it is going to get worse rather than better. I would not touch Steam, until the user gets to choose which patches to run the game with, some of them are truly shite.

    --
    Chaos - everything, everywhere, everywhen
  9. Re:Agree by josiahgould · · Score: 1

    That seems more like a problem with the developer/publisher than it is a problem with Steam. Uplay and Origin are just as bad at "up"downgrades, but there not the big guy so nobody whinges.

  10. Re:Agree by Cederic · · Score: 1

    I would not touch Steam, until the user gets to choose which patches to run the game with

    You've had the ability to avoid patching your Steam games for around a decade now.

    That's not quite selective patching but effectively operates the same way, given patches generally have a dependency relationship. If you skip one you mostly aren't getting later ones whether you're on Steam or not.

  11. Re:Game developers by wolfheart111 · · Score: 1

    Im sure some are better than others.

    --
    [($)]