18 ms·

Steam Windows Client Local Privilege Escalation 0day

407 points by codedokode 7y ago

imtringued 7y ago
Nitpick: Changing registry keys is a file operation.
- GordonS 7y ago
  Technically, changing a registry key changes bytes within a large file, yes. But in practice, the only way to change registry keys/values is by going through the registry APIs provided by Windows; I certainly wouldn't consider registry operations as file system operations.
Benjamin_Dobell 7y ago
I also had a look at Valve's HackerOne policies recently and was unimpressed for a variety of reasons: - The "Exclusions" are very poorly defined: Valve will have the right to determine CVSS classification, report validity, duplications, exclusions and out-of-scope bugs in its sole discretion. - What's "In Scope" is extremely vague. Yes, it's a list of domains, however Steam uses way more domains than that. Even then, not everything is tied to a "domain" as such, for instance Steam provides P2P networking. Executables are indeed mentioned, but again, it's vague. - Payouts seem low. The HackerOne profile is something I would expect of (and would be acceptable for) a 10 person company, not a massive corporation with millions of users.
- monster99 7y ago
  Steam was essentially a small company in 2004, in fact they grew too fast for their own good. Let us remember until the steam patch nobody wanted in 2004, valve had only released half-life and a few other odds and ends, until half-life 2 in 2004. Where steam began the long process of stealing game files from PC gamers and calling it drm. The whole process which began back in the late 90's with Ultima online in a bid to get people to pay monthly for the same computer role playing games by rebadging PC RPG's mmo's. So everyone with a clue about gaming history should know valve only seems "big" because the internet enabled gave them first mover advantage when they wrapped the steam store around half-life 2 in the mid 2000's, over the next 5-6 years that would make valve a tonne of money as AAA games released on steam until uplay and origin showed up later. Let us remember the reason we have storefronts for every company is because the internet enabled companies to steal PC games out from gamers via server locking games to their companies PC's. Now we're even seeing basic game functions held back and sold for microtransaction money.
  - h2odragon 7y ago
    I have to say I think all those problems would have been worse without Valve and Steam, and will become so as Steam becomes "just another" DRM agent. The dream of perpetual rental will never die.
    - otakucode 7y ago
      It greatly depends. Look at what happened with Apple and iTunes. Apple created iTunes, and set up rules for music publishers that wanted to participate. They were required to sell individual tracks. They were forbidden from charging more than 99 cents per track. They were required to permit the user to burn songs to audio CDs. Etc. This ended up putting music publishers in a difficult position. Their retail distribution agreements with record stores explicitly forbade them from doing any of these things. So they either had to re-negotiate those contracts, cancel them, or abandon iTunes. They attempted to re-negotiate their agreements with record stores, but record stores adamantly refused to budge. They wanted to maintain their prior agreements that forbid the publishers from selling their music through other venues for lower prices, before the retailers could stock their shelves, etc. The record companies never budged, and went out of business thanks to their stubbornness. Contrast that with how Valve handled Steam. Valve set no restriction on game publishers. Publishers were never forced into taking advantage of digital distribution at all. They were able to preserve all of their retail distribution contracts by screwing the customer. Digital distribution is profoundly cheaper, enables release of games a week sooner, could rely on Steams DRM without needing third party extra DRM, etc. These are all things Valve could have required publishers to take advantage of to benefit customers. But they didn't. They gave publishers carte blanche and let them do absolutely anything they wanted. If another company had been the one to become the dominant platform, it could have been more like the iTunes situation. This is also the thing which guarantees Steams eventual downfall. Music publishers considered, and a couple even tried, building their own digital distribution service. But, the publishers were incapable (because of institutional restrictions) of building a competent competitor that would be appealing to consumers. The publishers board wouldn't permit things like individual track sales, 99 cent price caps even for popular singles, etc. Steam is a different story. Since there are literally no restrictions on publishers at all, there is also no reason for publishers to refrain from building their own separate platforms and cutting out Valve's cut of the sale. Gamers have established that they are more than willing to install and use however many launchers as necessary, so there is almost no reason for big publishers to use Steam rather than just building their own.
- Strom 7y ago
  > I would expect of (and would be acceptable for) a 10 person company, not a massive corporation with millions of users. As it happens, there are only about 10 people [1] working on Steam. [2][3] This is the result of both Valve having only some hundreds of employees total and them being to be able to choose what they want to work on. Not many choose Steam. -- [1] This is not counting customer support staff that is outsourced. [2] Steam employees self-report the team size as 10 in this interview https://www.youtube.com/watch?v=atwE-K8y-ws&t=8m35s https://www.youtube.com/watch?v=atwE-K8y-ws&t=8m35s [3] Someone who recently visited Valve observed this to still be true. "There are approximately ten people inside" + "This is the Steam cabal," https://www.joindota.com/en/news/84521-my-visit-at-valves-hq-what-i-learned-about-the-state-of-dota-2 https://www.joindota.com/en/news/84521-my-visit-at-valves-hq...
  - Cpoll 7y ago
    Interesting. However, in this case, '10 person company' is more meant to imply the resources (bug bounty budget) available to the company. It's appropriate to categorize it as a 'a massive corporation with millions of users' for this purpose.
    - FooHentai 7y ago
      There's the rub though, right. It's 'a tiny company with millions of users'. QED.
jeroenhd 7y ago
Quite a sad ending for a security vulnerability that can probably be fixed by correcting a few permissions. Sayinf privilege escalation doesn't count because you need to place a file on the file system is a nonsense excuse. It's saying "yeah well it's not our problem that we give a process full system rights because the user already opened something else in low privilege mode".
- _kbh_ 7y ago
  Saying you need to drop a file is a sad excuse. Especially when you don't need to. I see no reason why you couldn't use the suggested exploit. Changing the HKLM\SYSTEM\ControlSet001\Services\msiserver ImagePath to the path of cmd.exe should pop you up a system shell. With no files dropped.
Crinus 7y ago
I wouldn't be surprised if this is for backwards compatibility with older games (the linked twitter "exploit" is certainly due to many games writing files in their own folders) and avoiding the need to show the UAC prompt when installing dependencies (VC++ runtimes, etc) in many newer games - especially if you take into consideration Steam's Big Picture mode and that it needs to be usable with a controller (though perhaps the Steam Controller can also function as a regular desktop mouse, assuming it doesn't rely on Steam itself to move the cursor around - which may not work when the UAC prompt is shown - and on the other hand some older games do need to run as Administrator and/or a compatibility mode that shows a UAC prompt, so perhaps SC can work with that). BTW... > Are you sure that a free game made of garbage by an unknown developer will behave honestly? Do you believe that for a 90% discount you will not get a hidden miner? ...beyond this being FUD, games do not need to run with Adminstrator privileges to put hidden miners and even if they did, all they'll need to do is simply... show the UAC prompt. So many things show it that people will accept it anyway, especially when they're trying to start a game. But more importantly, such a game will be removed instantly from Steam and thus wont spread much while the developer could be sued (before publishing anything on Steam you have to give them your full details) making the entire endeavor not worth the effort. Though of course this issue can be taken advantage of outside of Steam.
- imtringued 7y ago
  The problem is that the privileged service modifies permissions of arbitrary registry keys that don't belong to the steam client. Simply checking that the path is below the steam path before calling RegSetKeySecurity would fix the problem.
  - beders 7y ago
    Yup. It is probably a single line of code. Make it two, if they are using C# :)
- utouq 7y ago
  >I wouldn't be surprised if this is for backwards compatibility with older games (the linked twitter "exploit" is certainly due to many games writing files in their own folders) Maybe they should use "c:\users\all users\appdata" for this purpose instead of using "c:\program files"?
als0 7y ago
I agree the situation with Steam is not good on Windows. It’s already in a very privileged position because it can take full control of the screen with overlays, access controllers, and silently install games, all without the user ever seeing a single UAC prompt. I doubt those functional aspects will change in future. I’m glad the issues are getting more attention and hope Valve finds effective ways to harden their client. This is needed despite the walled garden they have.
ChrisSD 7y ago
I've been running Steam on a non-admin account for awhile now. I can't recall a game that actually needed admin permissions to install and run. Some games will continue to try on every run but after the no admin error it runs fine anyway. I'm on Windows 10. It's possible I've already installed the required Visual C++ runtimes.
- gsich 7y ago
  There is a steamservice.exe (or similar). It gets admin during install.
  - ChrisSD 7y ago
    Right but as far as I'm aware this isn't needed for games to install and run. If you disable it, Steam complains but runs anyway. Of course it probably breaks some Steam services but apparently not ones I use.
    - gsich 7y ago
      Only if you install the games outside "Program Files".
      - shawnz 7y ago
        Not true. You can install games even with the service disabled, since the Steam program folder permissions allow any user to write files there (and that's where games are installed by default).
        ChrisSD 7y ago
        Indeed. As I said, I've been doing this for awhile now so this isn't merely a theoretical for me.
        gsich 7y ago
        Yes. But the service was enabled and set the permissions.
o-__-o 7y ago
Steam allows you to stream games from other network PCs. I found it interesting that you could stream games and sometimes glitch out of the game but still keep full control of the desktop. Odd, because steam makes a wonderful RDP-like client. Concerning, because i never entered my password for that computer. I turned off remote streaming after that happened. Author of this paper is right for disclosing
- pjc50 7y ago
  You do have to log into Steam with the same account on both PCs, don't you? Personally I find it annoying that it doesn't have a fallback whole-desktop mode, since some game launchers (eg Minecraft) interact very badly with Steam streaming, and Microsoft insist on turning RDP off on consumer editions. You can fake it by installing Notepad as a "third party game", but it's not entirely reliable. I ended up using Nvidia+Moonlight to stream Minecraft.
  - ThatPlayer 7y ago
    The behavior seems to vary between the PC Steam program and the Steam Link app on other devices. The Steam Link app will fallback to whole-desktop, allowing you to exit Steam Big Picture and what not.
    - glastra 7y ago
      You can even start streaming the desktop directly. AFAIK there is a setting for that.
- abvdasker 7y ago
  If you are interested in software that has the same functionality but is much more reliable, I would highly recommend Parsec. It's free.
marcinzm 7y ago
>Moreover, they didn't want me to disclose the vulnerability. At the same time, there was not even a single word from Valve. No, guys, that's not how it works. You didn’t respect my work, and that's the reason why I won’t respect yours — I see no reason why I shouldn't publish this report. Most likely I’ll be banned at H1 because of it, but it won't make me upset. This seems pretty scammy of HackerOne and does nothing but hurt security. Either something is an issue and should be paid for, or it's not an issue and disclosure is fine. They're trying to have it both ways and trying to strong arm researchers into keeping quiet.
- Sahhaese 7y ago
  I've mentioned before how disappointed I've been to watch hackerone move from a platform helping responsible disclosure to a platform helping companies hide vulnerabilities. It used to be that even accepted bugs and paid bounties would be publically disclosed. It helped me learn a ton just from reading the (partially redacted) bug reports. Over time they became more and more redacted until they were left entirely pointless. To mark a bug as N/A, declare it 'not fix' but then say also it can't be disclosed is precisely why responsible disclosure is a thing. Companies can't have their cake and eat it.
  - lawnchair_larry 7y ago
    This is why “responsible disclosure” has been rejected as a term among security professionals for many years now. Vendors invented it for self-serving reasons. https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coordinated-vulnerability-disclosure-bringing-balance-to-the-force/ https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor...
- SpicyLemonZest 7y ago
  I think there's a fair question to ask here: is HackerOne a bug bounty program that offers security consulting services, or a security consulting service that's implemented as crowdsourced bug bounties? If I hire a normal security consultant, and she finds an issue in my product that I don't agree is a real vulnerability, it's absolutely not fine for her to go write a public article about it.
FDSGSG 7y ago
Pretty shitty of HackerOne to forbid the disclosure of a non-vulnerability. Hopefully there's more to this story.
- knd775 7y ago
  a "non-vulnerability"
omgtehlion 7y ago
There is more blatant violation: 1. Log on as non-admin on a box with steam 2. Do not start steam or any game 3. cat %system32%\calc.exe > %programfiles%\steam\bin\steamservice.exe 4. Reboot 5. Log on, start steam 6. BAM! Now you have calc.exe (attempted to) run as System with highest local priveleges
- AnIdiotOnTheNet 7y ago
  > 3. cat %system32%\calc.exe > %programfiles%\steam\bin\steamservice.exe This requires elevation.
  - dtech 7y ago
    On my machine, the Steam folder is writable by the Users group. I didn't modify anything so I assume Steam set it that way.
    - yrro 7y ago
      Of course, how else is a user running Steam supposed to update it? Headdesk
      - batat 7y ago
        Through Steam service running as NT AUTHORITY\SYSTEM? Like "Mozilla Maintenance Service" for Firefox.
        yrro 7y ago
        That would require Valve's developers have a clue about basic security...
        shawnz 7y ago
        It's ironic, because Gabe Newell himself started at Microsoft. Now he's created a company in which apparently none of his employees understand the security model of Microsoft products.
ryanlol 7y ago
How come both of the comments discussing the way HackerOne handled this are [dead]? Neither account seems to be banned, both comments seem perfectly fine.
- sctb 7y ago
  Sorry about that, those posts were killed by some overzealous anti-spam software which we've just pacified.
shawnz 7y ago
I am glad someone is finally paying some attention to the multiuser security of Steam. The fact that it makes its whole program directory world-writable is ridiculous. I really hope these bugs get corrected because as it is, Steam cannot be safely used in multiuser environments.
- canada_dry 7y ago
  > Steam cannot be safely used Why I have a separate gaming only computer... no banking, no work, no social media, nothing but game platforms. In fact, it's the only computer I run Windows on.
- jandrese 7y ago
  Valve in general seems to be vague on the entire concept of multi-user. They have a family plan where you can share your library with your family, but with the limitation that only one member of the family can be playing a game at once. Even if you are trying to play two different games Steam will try to kick one of the players off. It seems like they think a "family" is a family of computers that one single person might want to access. I get that they might be concerned that someone sets up a Steam account for their entire floor of the dormitory or something, but wouldn't a sensible limit be more like 5 instead of 1, with the additional limitation of only one copy of a particular game at once? Plus the ability to buy multiple copies of a game for a single library if you want? Netflix, Amazon Prime Video, Hulu, etc... all figured this out, why can't Valve?
  - thw0rted 7y ago
    I agree that Family Sharing could be less restrictive but it's not quite as bad as you describe. You're already limited to the number of "Family" accounts on a single system, and I believe also to the number of systems where a given account can be "Family enabled". I also hasten to point out that it's arguably the least restrictive sharing system of any digital storefront on PC or any console. Also, you can buy licenses for a game on more than one account. If sharing is enabled for accounts A, B, and C on a set of computers, C can use a license from A or B, if both own the game. The trick is that it tries to use the license of the person who enabled sharing most recently. So if A enables sharing, then B, but B is currently playing a game, it won't let C play a game that both A and B own. You can log in as B and disable sharing, then it will work. Alternately, there are tools to fix this automatically by editing config files -- and in retrospect, they probably work because of the security flaws mentioned in an earlier thread...
m-p-3 7y ago
Thanks for the disclosure, and if Steam users gets attacked because of their irresponsibility then it's on Valve. The author did was l what they reasonably could to get this fixed the easy way before the hard way. Hopefully they'll learn from it and act more professionally and increase their payout if they want security researchers to take them seriously in the future.
zonidjan 7y ago
> Here I realized that Valve has no interest in EoP vulnerabilities. ... surprise? Of course not. Neither do 99% of their users.
- comfyinnernet 7y ago
  Users of peanut butter shouldn't have to think about whether it contains glass and razors.
dx87 7y ago
I'm not suprised at the response they got when they reported the vulnerability. Somebody reported an XSS vulnerability in the Dota 2 UI, and they wouldn't fix it. So (probably the reporter) created a worm in the client that spread through your friends list in game and defaced the client. People also found out you could crash the client by using the XSS to download very large images. There was no way to protect yourself either, because messages from friends are automatically displayed with no user interaction.
- Shaddox 7y ago
  I remember at some point while playing, the main page of the dota 2 client was full of porn. I thought my DNS cache was poisoned at the time, and now, some years later I find out it was an exploit.
- jerf 7y ago
  I like to say "The capabilities of attackers are not bounded by your imagination." It is possible to get a "security bug" that is technically a security bug, but still isn't really all that important. But you generally want to be very careful in making that assessment, because just because one particular person, even someone fairly skilled in security, doesn't think it can be used to do anything truly harmful doesn't mean that the attackers won't figure something out. XSS has been a particular rich source of this; it's very easy for someone not too up on security to say "Oh, whoopdedo, it lets you pop up an alert box or change the client side display", when in fact XSS can steal login cookies if you haven't properly secured them (which seems likely to correlate highly with people who don't think XSS is a big problem) and be used to proxy web connections to other resources in the context of the user, conforming to the same-origin policy [1]. So, for instance, with the recent story about a guy finding an XSS in Tesla's service management page, they were correct to respond to that as a serious issue; it wasn't just a way of moderately inconveniencing a service tech, it was a back door into their entire service system, potentially. XSS has a huge mismatch between the general developer's impression of its severity and its actual severity. [1]: https://github.com/beefproject/beef/wiki/Tunneling https://github.com/beefproject/beef/wiki/Tunneling
  - 7y ago
trulyrandom 7y ago
I've also had some similarly bad experiences reporting vulnerabilities to managed HackerOne campaigns. I'm guessing the HackerOne staff is primarily trained to judge web vulnerability reports. Anything beyond that often triggers odd followup questions or even a rejection like in this case.
argd678 7y ago
Steam also stores your credentials world readable on the file system, I reported it I think in 2016 and they just said it was a limitation. I know Epic Games takes security more seriously than Valve at least.
- dgellow 7y ago
  Do you have more details on this?
- Bjartr 7y ago
  As I understand it, there's no way to have the feature of "remember me" on the login box allow skipping 2FA without this. Anywhere they could put it while still allowing a no interaction login would be just as vulnerable. The primary way of attack was to trick a steam user into either uploading the token file directly, or trick the user into running an executable that uploaded it silently. If you're already tricking the user into running an executable you design, there's not much left that can be done to stop this since such an executable could reach inside the running steam process and read whatever data it likes.
  - argd678 7y ago
    The attack here is simply another login on the same machine can get the token. I think that’s how I discovered it, I logged into another account on my machine and Steam logged in using my other account on start up with out asking me to login again. I should also mention the trend towards these Vault services to store secrets is even worse, as that they effectively make all secrets on a machine world readable since an off box service can’t determine what user is making the request. And the trust on first use idea is lacking in most implementations and vendors like HashCorp in fact don’t want to add it anymore since apparently their users had problems using it and would lock their apps out by accident. So... yeah.
  - gravypod 7y ago
    Signed and public-key-encrypred tokens
unstatusthequo 7y ago
I usually report directly to the company anyway which escalate it with HackerOne if they aren’t dysfunctional.
foxtrottbravo 7y ago
Normally I do not care too much about comments marked as [dead]. But why is it that all comments in this submission that critique HackerOne are being killed? I'm now somewhat curious is this comment will be hit with wathever hit the other (at the time of writing) four comments.
- ryanlol 7y ago
  HN gets constant spam from scammers advertising “hacking services”, the antispam system likely confused HackerOne comments with those. (perhaps this comment will get autokilled too)
microcolonel 7y ago
Just assume Windows does not have privilege separation, don't rely on it. The way things are on Windows is convenient, especially with all the legacy software, but don't rely on it to protect users from eachother.
- ChrisSD 7y ago
  But Windows does have strong separation between processes running in separate sessions. Steam actively goes out of its way to undermine this by giving all users permission to directly control a service with system level privileges.
withinrafael 7y ago
Rehash: - Steam has a privileged service, users can start/stop it. - Steam's service resets a bunch of registry subkey ACLs under [HKLM\...\Valve\Steam] at startup - Steam's service gives unprivileged users read/write access to its own keys - Steam lets unprivileged users write to this area of the registry - Steam's service follows registry symlinks This is terrible. Any multi-tenant machine with Steam installed is affected and should be considered compromised.
- shawnz 7y ago
  It's actually even worse than that, OP's exploit only scratches the surface of what's wrong with Steam's security model on Windows. The whole program directory is world writable including the Steam service binary which runs with local system permissions, and it's been this way for YEARS. See: https://news.ycombinator.com/item?id=20633929 https://news.ycombinator.com/item?id=20633929
  - withinrafael 7y ago
    Yeah, I just saw that today. I don't know what to say.
MayeulC 7y ago
This is concerning, especially as the steam client is a platform for downloading remote code execution-enabled programs. I can't imagine the number of security vulnerabilities in Steam games. Most games require invasive anti-cheat services that are connected to a command-and-control sever with full RCE capabilities (and RAM dumping/analysis, etc). If you want a specific example, take Unreal Tournament (1999) on steam: this is an old game, yet its security practices remain unchanged. Most public servers I tried to connect to pushed dlls on my computer, that were then loaded by the game executable, to provide a variety of mods, anti-heat services, and more. That means anyone hosting a UT99 has RCE and privilege escalation capabilities on any client that connect trough Steam, without even trying hard. More concerning is the fact that games are a very specific medium: robustness/security is often not the primary concern, most are networked, and few are patched [a few ears] after release, yet remain launched on a regular basis for decades to come. Moreover, newer games tend to push resource usage too much for elaborate sandboxes. That's the reason why I run Steam trough flatpak's sandbox: at least, it, or games, don't have access to my filesystem. I still have concerns over the login token, though. Wayland does provide some extra protection against potential keyloggers/others, but I wish Steam itself was constructed like a browser, sandbox-wise. (yes, the remote dll loading happened on Linux, trough wine/proton, a testament to the engineering of these compatibility layers).

407 points by codedokode 7y ago

imtringued 7y ago

Nitpick: Changing registry keys is a file operation.

GordonS 7y ago
Technically, changing a registry key changes bytes within a large file, yes. But in practice, the only way to change registry keys/values is by going through the registry APIs provided by Windows; I certainly wouldn't consider registry operations as file system operations.

Benjamin_Dobell 7y ago

I also had a look at Valve's HackerOne policies recently and was unimpressed for a variety of reasons: - The "Exclusions" are very poorly defined: Valve will have the right to determine CVSS classification, report validity, duplications, exclusions and out-of-scope bugs in its sole discretion. - What's "In Scope" is extremely vague. Yes, it's a list of domains, however Steam uses way more domains than that. Even then, not everything is tied to a "domain" as such, for instance Steam provides P2P networking. Executables are indeed mentioned, but again, it's vague. - Payouts seem low. The HackerOne profile is something I would expect of (and would be acceptable for) a 10 person company, not a massive corporation with millions of users.

monster99 7y ago
Steam was essentially a small company in 2004, in fact they grew too fast for their own good. Let us remember until the steam patch nobody wanted in 2004, valve had only released half-life and a few other odds and ends, until half-life 2 in 2004. Where steam began the long process of stealing game files from PC gamers and calling it drm. The whole process which began back in the late 90's with Ultima online in a bid to get people to pay monthly for the same computer role playing games by rebadging PC RPG's mmo's. So everyone with a clue about gaming history should know valve only seems "big" because the internet enabled gave them first mover advantage when they wrapped the steam store around half-life 2 in the mid 2000's, over the next 5-6 years that would make valve a tonne of money as AAA games released on steam until uplay and origin showed up later. Let us remember the reason we have storefronts for every company is because the internet enabled companies to steal PC games out from gamers via server locking games to their companies PC's. Now we're even seeing basic game functions held back and sold for microtransaction money.
- h2odragon 7y ago
  I have to say I think all those problems would have been worse without Valve and Steam, and will become so as Steam becomes "just another" DRM agent. The dream of perpetual rental will never die.
  - otakucode 7y ago
    It greatly depends. Look at what happened with Apple and iTunes. Apple created iTunes, and set up rules for music publishers that wanted to participate. They were required to sell individual tracks. They were forbidden from charging more than 99 cents per track. They were required to permit the user to burn songs to audio CDs. Etc. This ended up putting music publishers in a difficult position. Their retail distribution agreements with record stores explicitly forbade them from doing any of these things. So they either had to re-negotiate those contracts, cancel them, or abandon iTunes. They attempted to re-negotiate their agreements with record stores, but record stores adamantly refused to budge. They wanted to maintain their prior agreements that forbid the publishers from selling their music through other venues for lower prices, before the retailers could stock their shelves, etc. The record companies never budged, and went out of business thanks to their stubbornness. Contrast that with how Valve handled Steam. Valve set no restriction on game publishers. Publishers were never forced into taking advantage of digital distribution at all. They were able to preserve all of their retail distribution contracts by screwing the customer. Digital distribution is profoundly cheaper, enables release of games a week sooner, could rely on Steams DRM without needing third party extra DRM, etc. These are all things Valve could have required publishers to take advantage of to benefit customers. But they didn't. They gave publishers carte blanche and let them do absolutely anything they wanted. If another company had been the one to become the dominant platform, it could have been more like the iTunes situation. This is also the thing which guarantees Steams eventual downfall. Music publishers considered, and a couple even tried, building their own digital distribution service. But, the publishers were incapable (because of institutional restrictions) of building a competent competitor that would be appealing to consumers. The publishers board wouldn't permit things like individual track sales, 99 cent price caps even for popular singles, etc. Steam is a different story. Since there are literally no restrictions on publishers at all, there is also no reason for publishers to refrain from building their own separate platforms and cutting out Valve's cut of the sale. Gamers have established that they are more than willing to install and use however many launchers as necessary, so there is almost no reason for big publishers to use Steam rather than just building their own.
Strom 7y ago
> I would expect of (and would be acceptable for) a 10 person company, not a massive corporation with millions of users. As it happens, there are only about 10 people [1] working on Steam. [2][3] This is the result of both Valve having only some hundreds of employees total and them being to be able to choose what they want to work on. Not many choose Steam. -- [1] This is not counting customer support staff that is outsourced. [2] Steam employees self-report the team size as 10 in this interview https://www.youtube.com/watch?v=atwE-K8y-ws&t=8m35s https://www.youtube.com/watch?v=atwE-K8y-ws&t=8m35s [3] Someone who recently visited Valve observed this to still be true. "There are approximately ten people inside" + "This is the Steam cabal," https://www.joindota.com/en/news/84521-my-visit-at-valves-hq-what-i-learned-about-the-state-of-dota-2 https://www.joindota.com/en/news/84521-my-visit-at-valves-hq...
- Cpoll 7y ago
  Interesting. However, in this case, '10 person company' is more meant to imply the resources (bug bounty budget) available to the company. It's appropriate to categorize it as a 'a massive corporation with millions of users' for this purpose.
  - FooHentai 7y ago
    There's the rub though, right. It's 'a tiny company with millions of users'. QED.

jeroenhd 7y ago

Quite a sad ending for a security vulnerability that can probably be fixed by correcting a few permissions. Sayinf privilege escalation doesn't count because you need to place a file on the file system is a nonsense excuse. It's saying "yeah well it's not our problem that we give a process full system rights because the user already opened something else in low privilege mode".

_kbh_ 7y ago
Saying you need to drop a file is a sad excuse. Especially when you don't need to. I see no reason why you couldn't use the suggested exploit. Changing the HKLM\SYSTEM\ControlSet001\Services\msiserver ImagePath to the path of cmd.exe should pop you up a system shell. With no files dropped.

Crinus 7y ago

I wouldn't be surprised if this is for backwards compatibility with older games (the linked twitter "exploit" is certainly due to many games writing files in their own folders) and avoiding the need to show the UAC prompt when installing dependencies (VC++ runtimes, etc) in many newer games - especially if you take into consideration Steam's Big Picture mode and that it needs to be usable with a controller (though perhaps the Steam Controller can also function as a regular desktop mouse, assuming it doesn't rely on Steam itself to move the cursor around - which may not work when the UAC prompt is shown - and on the other hand some older games do need to run as Administrator and/or a compatibility mode that shows a UAC prompt, so perhaps SC can work with that). BTW... > Are you sure that a free game made of garbage by an unknown developer will behave honestly? Do you believe that for a 90% discount you will not get a hidden miner? ...beyond this being FUD, games do not need to run with Adminstrator privileges to put hidden miners and even if they did, all they'll need to do is simply... show the UAC prompt. So many things show it that people will accept it anyway, especially when they're trying to start a game. But more importantly, such a game will be removed instantly from Steam and thus wont spread much while the developer could be sued (before publishing anything on Steam you have to give them your full details) making the entire endeavor not worth the effort. Though of course this issue can be taken advantage of outside of Steam.

imtringued 7y ago
The problem is that the privileged service modifies permissions of arbitrary registry keys that don't belong to the steam client. Simply checking that the path is below the steam path before calling RegSetKeySecurity would fix the problem.
- beders 7y ago
  Yup. It is probably a single line of code. Make it two, if they are using C# :)
utouq 7y ago
>I wouldn't be surprised if this is for backwards compatibility with older games (the linked twitter "exploit" is certainly due to many games writing files in their own folders) Maybe they should use "c:\users\all users\appdata" for this purpose instead of using "c:\program files"?

als0 7y ago

I agree the situation with Steam is not good on Windows. It’s already in a very privileged position because it can take full control of the screen with overlays, access controllers, and silently install games, all without the user ever seeing a single UAC prompt. I doubt those functional aspects will change in future. I’m glad the issues are getting more attention and hope Valve finds effective ways to harden their client. This is needed despite the walled garden they have.

ChrisSD 7y ago

I've been running Steam on a non-admin account for awhile now. I can't recall a game that actually needed admin permissions to install and run. Some games will continue to try on every run but after the no admin error it runs fine anyway. I'm on Windows 10. It's possible I've already installed the required Visual C++ runtimes.

gsich 7y ago
There is a steamservice.exe (or similar). It gets admin during install.
- ChrisSD 7y ago
  Right but as far as I'm aware this isn't needed for games to install and run. If you disable it, Steam complains but runs anyway. Of course it probably breaks some Steam services but apparently not ones I use.
  - gsich 7y ago
    Only if you install the games outside "Program Files".
    - shawnz 7y ago
      Not true. You can install games even with the service disabled, since the Steam program folder permissions allow any user to write files there (and that's where games are installed by default).
      - ChrisSD 7y ago
        Indeed. As I said, I've been doing this for awhile now so this isn't merely a theoretical for me.
      - gsich 7y ago
        Yes. But the service was enabled and set the permissions.

o-__-o 7y ago

Steam allows you to stream games from other network PCs. I found it interesting that you could stream games and sometimes glitch out of the game but still keep full control of the desktop. Odd, because steam makes a wonderful RDP-like client. Concerning, because i never entered my password for that computer. I turned off remote streaming after that happened. Author of this paper is right for disclosing

pjc50 7y ago
You do have to log into Steam with the same account on both PCs, don't you? Personally I find it annoying that it doesn't have a fallback whole-desktop mode, since some game launchers (eg Minecraft) interact very badly with Steam streaming, and Microsoft insist on turning RDP off on consumer editions. You can fake it by installing Notepad as a "third party game", but it's not entirely reliable. I ended up using Nvidia+Moonlight to stream Minecraft.
- ThatPlayer 7y ago
  The behavior seems to vary between the PC Steam program and the Steam Link app on other devices. The Steam Link app will fallback to whole-desktop, allowing you to exit Steam Big Picture and what not.
  - glastra 7y ago
    You can even start streaming the desktop directly. AFAIK there is a setting for that.
abvdasker 7y ago
If you are interested in software that has the same functionality but is much more reliable, I would highly recommend Parsec. It's free.

marcinzm 7y ago

>Moreover, they didn't want me to disclose the vulnerability. At the same time, there was not even a single word from Valve. No, guys, that's not how it works. You didn’t respect my work, and that's the reason why I won’t respect yours — I see no reason why I shouldn't publish this report. Most likely I’ll be banned at H1 because of it, but it won't make me upset. This seems pretty scammy of HackerOne and does nothing but hurt security. Either something is an issue and should be paid for, or it's not an issue and disclosure is fine. They're trying to have it both ways and trying to strong arm researchers into keeping quiet.

Sahhaese 7y ago
I've mentioned before how disappointed I've been to watch hackerone move from a platform helping responsible disclosure to a platform helping companies hide vulnerabilities. It used to be that even accepted bugs and paid bounties would be publically disclosed. It helped me learn a ton just from reading the (partially redacted) bug reports. Over time they became more and more redacted until they were left entirely pointless. To mark a bug as N/A, declare it 'not fix' but then say also it can't be disclosed is precisely why responsible disclosure is a thing. Companies can't have their cake and eat it.
- lawnchair_larry 7y ago
  This is why “responsible disclosure” has been rejected as a term among security professionals for many years now. Vendors invented it for self-serving reasons. https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coordinated-vulnerability-disclosure-bringing-balance-to-the-force/ https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor...
SpicyLemonZest 7y ago
I think there's a fair question to ask here: is HackerOne a bug bounty program that offers security consulting services, or a security consulting service that's implemented as crowdsourced bug bounties? If I hire a normal security consultant, and she finds an issue in my product that I don't agree is a real vulnerability, it's absolutely not fine for her to go write a public article about it.

FDSGSG 7y ago

Pretty shitty of HackerOne to forbid the disclosure of a non-vulnerability. Hopefully there's more to this story.

knd775 7y ago
a "non-vulnerability"

omgtehlion 7y ago

There is more blatant violation: 1. Log on as non-admin on a box with steam 2. Do not start steam or any game 3. cat %system32%\calc.exe > %programfiles%\steam\bin\steamservice.exe 4. Reboot 5. Log on, start steam 6. BAM! Now you have calc.exe (attempted to) run as System with highest local priveleges

AnIdiotOnTheNet 7y ago
> 3. cat %system32%\calc.exe > %programfiles%\steam\bin\steamservice.exe This requires elevation.
- dtech 7y ago
  On my machine, the Steam folder is writable by the Users group. I didn't modify anything so I assume Steam set it that way.
  - yrro 7y ago
    Of course, how else is a user running Steam supposed to update it? Headdesk
    - batat 7y ago
      Through Steam service running as NT AUTHORITY\SYSTEM? Like "Mozilla Maintenance Service" for Firefox.
      - yrro 7y ago
        That would require Valve's developers have a clue about basic security...
        shawnz 7y ago
        It's ironic, because Gabe Newell himself started at Microsoft. Now he's created a company in which apparently none of his employees understand the security model of Microsoft products.

ryanlol 7y ago

How come both of the comments discussing the way HackerOne handled this are [dead]? Neither account seems to be banned, both comments seem perfectly fine.

sctb 7y ago
Sorry about that, those posts were killed by some overzealous anti-spam software which we've just pacified.

shawnz 7y ago

I am glad someone is finally paying some attention to the multiuser security of Steam. The fact that it makes its whole program directory world-writable is ridiculous. I really hope these bugs get corrected because as it is, Steam cannot be safely used in multiuser environments.

canada_dry 7y ago
> Steam cannot be safely used Why I have a separate gaming only computer... no banking, no work, no social media, nothing but game platforms. In fact, it's the only computer I run Windows on.
jandrese 7y ago
Valve in general seems to be vague on the entire concept of multi-user. They have a family plan where you can share your library with your family, but with the limitation that only one member of the family can be playing a game at once. Even if you are trying to play two different games Steam will try to kick one of the players off. It seems like they think a "family" is a family of computers that one single person might want to access. I get that they might be concerned that someone sets up a Steam account for their entire floor of the dormitory or something, but wouldn't a sensible limit be more like 5 instead of 1, with the additional limitation of only one copy of a particular game at once? Plus the ability to buy multiple copies of a game for a single library if you want? Netflix, Amazon Prime Video, Hulu, etc... all figured this out, why can't Valve?
- thw0rted 7y ago
  I agree that Family Sharing could be less restrictive but it's not quite as bad as you describe. You're already limited to the number of "Family" accounts on a single system, and I believe also to the number of systems where a given account can be "Family enabled". I also hasten to point out that it's arguably the least restrictive sharing system of any digital storefront on PC or any console. Also, you can buy licenses for a game on more than one account. If sharing is enabled for accounts A, B, and C on a set of computers, C can use a license from A or B, if both own the game. The trick is that it tries to use the license of the person who enabled sharing most recently. So if A enables sharing, then B, but B is currently playing a game, it won't let C play a game that both A and B own. You can log in as B and disable sharing, then it will work. Alternately, there are tools to fix this automatically by editing config files -- and in retrospect, they probably work because of the security flaws mentioned in an earlier thread...

m-p-3 7y ago

Thanks for the disclosure, and if Steam users gets attacked because of their irresponsibility then it's on Valve. The author did was l what they reasonably could to get this fixed the easy way before the hard way. Hopefully they'll learn from it and act more professionally and increase their payout if they want security researchers to take them seriously in the future.

zonidjan 7y ago

> Here I realized that Valve has no interest in EoP vulnerabilities. ... surprise? Of course not. Neither do 99% of their users.

comfyinnernet 7y ago
Users of peanut butter shouldn't have to think about whether it contains glass and razors.

dx87 7y ago

I'm not suprised at the response they got when they reported the vulnerability. Somebody reported an XSS vulnerability in the Dota 2 UI, and they wouldn't fix it. So (probably the reporter) created a worm in the client that spread through your friends list in game and defaced the client. People also found out you could crash the client by using the XSS to download very large images. There was no way to protect yourself either, because messages from friends are automatically displayed with no user interaction.

Shaddox 7y ago
I remember at some point while playing, the main page of the dota 2 client was full of porn. I thought my DNS cache was poisoned at the time, and now, some years later I find out it was an exploit.
jerf 7y ago
I like to say "The capabilities of attackers are not bounded by your imagination." It is possible to get a "security bug" that is technically a security bug, but still isn't really all that important. But you generally want to be very careful in making that assessment, because just because one particular person, even someone fairly skilled in security, doesn't think it can be used to do anything truly harmful doesn't mean that the attackers won't figure something out. XSS has been a particular rich source of this; it's very easy for someone not too up on security to say "Oh, whoopdedo, it lets you pop up an alert box or change the client side display", when in fact XSS can steal login cookies if you haven't properly secured them (which seems likely to correlate highly with people who don't think XSS is a big problem) and be used to proxy web connections to other resources in the context of the user, conforming to the same-origin policy [1]. So, for instance, with the recent story about a guy finding an XSS in Tesla's service management page, they were correct to respond to that as a serious issue; it wasn't just a way of moderately inconveniencing a service tech, it was a back door into their entire service system, potentially. XSS has a huge mismatch between the general developer's impression of its severity and its actual severity. [1]: https://github.com/beefproject/beef/wiki/Tunneling https://github.com/beefproject/beef/wiki/Tunneling
- 7y ago

trulyrandom 7y ago

I've also had some similarly bad experiences reporting vulnerabilities to managed HackerOne campaigns. I'm guessing the HackerOne staff is primarily trained to judge web vulnerability reports. Anything beyond that often triggers odd followup questions or even a rejection like in this case.

argd678 7y ago

Steam also stores your credentials world readable on the file system, I reported it I think in 2016 and they just said it was a limitation. I know Epic Games takes security more seriously than Valve at least.

dgellow 7y ago
Do you have more details on this?
Bjartr 7y ago
As I understand it, there's no way to have the feature of "remember me" on the login box allow skipping 2FA without this. Anywhere they could put it while still allowing a no interaction login would be just as vulnerable. The primary way of attack was to trick a steam user into either uploading the token file directly, or trick the user into running an executable that uploaded it silently. If you're already tricking the user into running an executable you design, there's not much left that can be done to stop this since such an executable could reach inside the running steam process and read whatever data it likes.
- argd678 7y ago
  The attack here is simply another login on the same machine can get the token. I think that’s how I discovered it, I logged into another account on my machine and Steam logged in using my other account on start up with out asking me to login again. I should also mention the trend towards these Vault services to store secrets is even worse, as that they effectively make all secrets on a machine world readable since an off box service can’t determine what user is making the request. And the trust on first use idea is lacking in most implementations and vendors like HashCorp in fact don’t want to add it anymore since apparently their users had problems using it and would lock their apps out by accident. So... yeah.
- gravypod 7y ago
  Signed and public-key-encrypred tokens

unstatusthequo 7y ago

I usually report directly to the company anyway which escalate it with HackerOne if they aren’t dysfunctional.

foxtrottbravo 7y ago

Normally I do not care too much about comments marked as [dead]. But why is it that all comments in this submission that critique HackerOne are being killed? I'm now somewhat curious is this comment will be hit with wathever hit the other (at the time of writing) four comments.

ryanlol 7y ago
HN gets constant spam from scammers advertising “hacking services”, the antispam system likely confused HackerOne comments with those. (perhaps this comment will get autokilled too)

microcolonel 7y ago

Just assume Windows does not have privilege separation, don't rely on it. The way things are on Windows is convenient, especially with all the legacy software, but don't rely on it to protect users from eachother.

ChrisSD 7y ago
But Windows does have strong separation between processes running in separate sessions. Steam actively goes out of its way to undermine this by giving all users permission to directly control a service with system level privileges.

withinrafael 7y ago

Rehash: - Steam has a privileged service, users can start/stop it. - Steam's service resets a bunch of registry subkey ACLs under [HKLM\...\Valve\Steam] at startup - Steam's service gives unprivileged users read/write access to its own keys - Steam lets unprivileged users write to this area of the registry - Steam's service follows registry symlinks This is terrible. Any multi-tenant machine with Steam installed is affected and should be considered compromised.

shawnz 7y ago
It's actually even worse than that, OP's exploit only scratches the surface of what's wrong with Steam's security model on Windows. The whole program directory is world writable including the Steam service binary which runs with local system permissions, and it's been this way for YEARS. See: https://news.ycombinator.com/item?id=20633929 https://news.ycombinator.com/item?id=20633929
- withinrafael 7y ago
  Yeah, I just saw that today. I don't know what to say.

MayeulC 7y ago

This is concerning, especially as the steam client is a platform for downloading remote code execution-enabled programs. I can't imagine the number of security vulnerabilities in Steam games. Most games require invasive anti-cheat services that are connected to a command-and-control sever with full RCE capabilities (and RAM dumping/analysis, etc). If you want a specific example, take Unreal Tournament (1999) on steam: this is an old game, yet its security practices remain unchanged. Most public servers I tried to connect to pushed dlls on my computer, that were then loaded by the game executable, to provide a variety of mods, anti-heat services, and more. That means anyone hosting a UT99 has RCE and privilege escalation capabilities on any client that connect trough Steam, without even trying hard. More concerning is the fact that games are a very specific medium: robustness/security is often not the primary concern, most are networked, and few are patched [a few ears] after release, yet remain launched on a regular basis for decades to come. Moreover, newer games tend to push resource usage too much for elaborate sandboxes. That's the reason why I run Steam trough flatpak's sandbox: at least, it, or games, don't have access to my filesystem. I still have concerns over the login token, though. Wayland does provide some extra protection against potential keyloggers/others, but I wish Steam itself was constructed like a browser, sandbox-wise. (yes, the remote dll loading happened on Linux, trough wine/proton, a testament to the engineering of these compatibility layers).