15 ms·

Researcher banned on Valve's bug bounty program publishes second Steam 0-day

465 points by tareqak 7y ago

PeterisP 7y ago
I mean, you can't have your cake and eat it too - if you claim that a particular issue is not a bug and you won't fix it, then you have no ethical grounds to say that it shouldn't be disclosed. Responsible disclosure expects delaying public disclosure to protect the users while the vendor prepares a fix. If the vendor says that they won't fix it, then it's not only a right, but a moral duty to disclose that vulnerability to the users.
- WrtCdEvrydy 7y ago
  I had the same argument with Coinbase about this one... Ended up naming it 'Bad QR', putting this page together and sending them a private link (https://writecodeeveryday.github.io/projects/badqr/ https://writecodeeveryday.github.io/projects/badqr/)
  - joshstrange 7y ago
    Please fix your jquery import, it's being blocked b/c it's coming over http not https
    - WrtCdEvrydy 7y ago
      Sorry about that, probably gonna switch to VanillaJS.
      - dopamean 7y ago
        a great library.
        _coveredInBees 7y ago
        I couldn't find/install it via npm or yarn :-( ;-)
        wlesieutre 7y ago
        You should consider The JAMstack, a new web paradigm where a user requests an HTML file and the server gives it to them.
    - NullPrefix 7y ago
      TLS errors are out of scope. #WONTFIX. Don't you dare to talk about this publically. http://writecodeeveryday.github.io/projects/badqr/ http://writecodeeveryday.github.io/projects/badqr/
      - WrtCdEvrydy 7y ago
        LOL. Banned from HackerOne.
- EnFinlay 7y ago
  The researcher can still disclose it, they just aren't going to get permission to disclose it on the Hackerone program. Most things out of scope don't get publicly disclosed as far as I know. Doesn't seem too unreasonable.
  - hitekker 7y ago
    > Kravets said he was banned from the platform following the public disclosure of the first zero-day. His bug report was heavily covered in the media, and Valve did eventually ship a fix, more as a reaction to all the bad press the company was getting. > The patch was almost immediately proved to be insufficient, and another security researcher found an easy way to go around it almost right away. You might want to read the article.
    - EnFinlay 7y ago
      I was responding to a comment that (I interpreted) to be talking in more general terms than the scope of the article.
      - danShumway 7y ago
        Even in the scope of the original comment, doesn't it create a pretty perverse incentive to allow companies to mark HackerOne bugs as WONTFIX and then ban researchers who disclose them? Isn't security through obscurity largely to be avoided? I thought the working model for most security researchers was: if it's not worth fixing, it's not worth hiding. More to the point, I thought that responsible disclosure always came with an expectation of public disclosure. The advice I've always been given is that you should never disclose with conditions -- ie. "fix this and I won't tell anyone." It should always be, "I am going to tell everyone, but I'm telling you first so you can push a fix before I do." Does HackerOne operate under different rules?
  - fencepost 7y ago
    Without seeing the communications it's hard to say, but "When the security researcher -- named Vasily Kravets-- wanted to publicly disclose the vulnerability, a HackerOne staff member forbade him from doing so, even if Valve had no intention of fixing the issue" sounds like more than just not being able to disclose on the H1 program.
- Mindless2112 7y ago
  Frankly, I think HackerOne deserves a bit of blame for that. Any WONTFIX ought to be made public automatically unless there are extenuating circumstances (like the vulnerability being reported against the wrong product).
  - deleted 7y ago
    [deleted]
  - daeken 7y ago
    H1 itself has no WONTFIX status, FYI. A bug that's not considered to be a bug by the program will either be closed N/A or informative. Ultimately, disclosures are handled and controlled by the program, not by H1; this is both a good and bad thing (and I say that as both a HackerOne employee and a hacker on the platform -- it's a complicated issue from both sides).
    - kop316 7y ago
      It's complicated on both sides means there is politics involved. Being blunt, that sounds like a cop out to me. This sounds to me like an edge case that H1 should address if it really wants to be taken seriously.
      - daeken 7y ago
        There is definitely politics involved, but not H1 internal. The issue is that every program handles disclosure itself, so H1 itself doesn't really have the power. That could be changed at a policy level, but I'm not sure that'll happen (or should happen, honestly; I don't really know where I land on it).
        chris_wot 7y ago
        H1 could make it a proviso if using their service that rejected but reports are automatically disclosed.
        7y ago
- abtinf 7y ago
  I uninstalled Steam the moment I read the previous disclosure and Valve's approach to it. Any company that treats security as it used to be in the 90s ought to be shunned.
  - babuskov 7y ago
    If you don't need it, why did you have it installed in the first place?
    - p1necone 7y ago
      Not sure what you're getting at. There's very few things we need, sounds like they're sacrificing a little to avoid giving a company they deem unethical any money.
    - abtinf 7y ago
      I love games and can’t play my steam collection now. But if I have to give that up so that some silly bug elsewhere in my system doesn’t expose me to a ransomware attack (or worse), so be it. I’ll find another way.
      - jay_kyburz 7y ago
        You should be able to play games in your steam library. Just open your Steam\steamapps\common\ folder and find the exe for the game you want to play.
        cprecioso 7y ago
        Steam's DRM (CEG) customizes the executables so it won't play without the Steam client running and logged in to the correct account. There are lots of not-DRM-enabled games on Steam, but they're decidedly in the minority.
        StavrosK 7y ago
        That's why GOG.com is my first choice. They even provide a nice Steam-like installer (unfortunately, no Linux version of the installer), while letting you download your games DRM-free, archivable and standalone.
- one2zero 7y ago
  You would think that any platform/app that actually contains the ability to load currency into itself would take any security threat seriously regardless of the scope.
ChuckMcM 7y ago
This story continues to be so sad. Steam is reprising the role of Adobe who, for quite a while, refused to acknowledge that being able to use FlashPlayer as a tool to get you something on Windows was just as bad as breaking FlashPlayer. I heard one Adobe executive say, "Hey you can use a baseball bat to bludgeon someone but that isn't the bat maker's fault is it? If they are forced to make foam bats their product is useless." That position isn't "wrong" so much as it isn't useful in reducing risk.
- fortran77 7y ago
  You're beating a dead horse. Flash served a purpose once, and now it's reached end-of-life.
  - vorpalhex 7y ago
    > You're beating a dead horse With a foam bat. Just because the flash horse is dead doesn't mean it didn't deserve it's beating or can't continue to be a potent reminder of how bad Adobe was at handling security issues and why other platforms, like Steam, should learn instead of emulate.
    - dmix 7y ago
      This also has nothing to do with Flash specifically, rather as you said Adobe's policy. It could have been any software but especially for Flash. Flash was just such a unique special target, ala PDFs and Microsoft word, there were few wide open targets from which a hacker could predictably get the user to open (whether embedded or not) on a targets machine. So it was particularly sensitive to vulnerabilities by design, where a much broader security perspective was clearly needed than most software.
    - socceroos 7y ago
      I'd prefer to describe it as slashing a dead horse's rotten corpse with a katana. As the bloat and flesh of the ecosystem has disintegrated we're able to observe the framework more clearly - the bone structure of the horse, if you will. Using the katana we are making precise, incisive blows to the remnants as we extract meaning from it's corpse - or lessons learned, if you will. ...perhaps I'm taking the analogy too far?
jacobkg 7y ago
The salient part seems to be that the researcher reported the first vulnerability through HackerOne and was (reportedly) told by Steam it wouldn’t be fixed. He then published it after being instructed that was against the rules and was banned
- EnFinlay 7y ago
  "Please don't do thing" does thing gets banned shocked
  - Avamander 7y ago
    It wasn't going to be fixed, you can't ship vulnerable software, it's not okay. He was in every right to publish it and to keep shaming Valve.
    - EnFinlay 7y ago
      And Valve has ever right to ban him from their program, right?
      - Avamander 7y ago
        Yep, and we have every right to laugh at their stupidity.
      - deleted 7y ago
        [deleted]
      - vorpalhex 7y ago
        And the rest of us have the right to tell Valve, as their paying customers, we're very disappointed in their behavior and find it unacceptable. I expect them to take security flaws seriously if they want my continued patronage - and that includes EoPs.
      - JeremyBanks 7y ago
        "muh rights!!!!"
EnFinlay 7y ago
a) Program has scope that doesn't include X b) Researcher reports vulnerability that falls under X c) Since it's out of scope, it's closed as N/A d) Report is locked because company doesn't want to publicly disclose a vulnerability in their system via the Hackerone platform What's the problem here? Just go with normal vulnerability disclosure. Bug bounty programs are a two way street, and respecting the scope is part of that. Edit: I guess the important part is that the researcher was then banned for disclosing the report. Seems reasonable, honestly. I don't agree with it, but I understand it.
- PeterisP 7y ago
  Well, they did go with normal vulnerability disclosure, and were retaliated against. That's not okay.
  - EnFinlay 7y ago
    Retailiated as in he was banned from their bug bounty program. The program with a scope that they went outside of. I think it's reasonable to be banned. Obviously it would be better if Valve fixed the issue and gave a (possibly reduced due to out of scope) bounty.
    - tptacek 7y ago
      That makes sense if the application is, like, a SAAS app, and the scope is, like, "don't employ credential stuffing or test any of our 3rd party dependencies that have not given us permission to be included in this scope". But this is software people install on their desktops, and Valve has no say in how security researchers approach that stuff. Valve can and maybe even should exclude LPEs from their bounty scope (if that's not what they're focusing on right now), but they can't reasonably ban people for publishing vulnerabilities they've scoped out of the only mechanism they've provided for submitting and tracking vulnerabilities.
- zelon88 7y ago
  Acknowledgement is one thing. Disclosure is another. If Steam had no problem acknowledging that this functionality exists, they should have had no problem with it being disclosed. There lies the problem. In the bathroom with the needle in their arm; "...there's no problem here..." but if you swing the door open they'll still try to shut it. Because they know they're wrong. If HackerOne isn't going to help you they have no right to hinder you. If they want to strongarm everyone into effectively the same agreement as an NDA then there literally is no point in turning vulnerabilities into HackerOne. They seem to only exist as a cow-catcher on the locomotive of software vendors too lazy to actually fix crappy code. "Who needs to fix code and shell out bounty if you can pinpoint and silence the researcher?"
bogwog 7y ago
From what I've read, the original bug involved malware already installed on the PC using the Steam client to run other code. While I'm not a security expert in any way, that doesn't seem to me like a huge exploit. If the attack requires installing malware on the victim's computer, why not just do the evil stuff directly with that malware? If that's the case and I'm not just remembering it wrong, then I could see why Valve wouldn't want to pay up and could see why this guy would go on a social media rant to slander Valve either hoping they'll pay up or just to get petty revenge.
- rileymat2 7y ago
  > Kravets did eventually publish details about the Steam zero-day, which was an elevation of privilege (also known as a local privilege escalation) bug that allowed other apps or malware on a user's computer to abuse the Steam client to run code with admin rights. No, using this 0-day malware, with lower privilege level, could do stuff it could not do.
  - babuskov 7y ago
    > could do stuff it could not do I have trouble parsing this. Did you mean "could do stuff it couldn't have done" perhaps?
    - Grangar 7y ago
      It gets to do fancy admin stuff that regular malware without permissions can't.
- dx87 7y ago
  It was a priviledge escalation. An attacker could go from running as a compromised user to running with system priviledges.
- Rotten194 7y ago
  Using the Steam client to run other code at an escalated privilege level.
- 7y ago
codesushi42 7y ago
Yet another reason to switch to GOG.
tzakrajs 7y ago
Valve figured out how to print money by hooking teenagers with gambling on loot boxes. They stopped having to create AAA titles, they stopped having to do anything remotely creative, and now they are a giant cancer with no value left to add. Their client is an insecure, slow, instable piece of shit and has been this way for well over a decade. I regret being a customer of theirs.
- zelon88 7y ago
  I remember listening to some of their commentary tracks where the employees talk about how their desks had wheels, there's no managers, and there's no deadlines and no stress. They also at one time had higher profit per employee than Google! [1] Turns out that all along having no accountability in your company would result in complacency and a critical lack of production. I'm curious to see how Valve Software as a company is going to climb over this security wall they've found themselves in front of if seemingly nobody has to answer to anyone and everybody gets to do what they want in a leisurely fashion. I mean we give Chinese IoT vendors crap all day long, and it turns out Steam might be just as bad! [1] https://www.forbes.com/sites/stevedenning/2012/04/27/a-glimpse-at-a-workplace-of-the-future-valve/#138f96275577 https://www.forbes.com/sites/stevedenning/2012/04/27/a-glimp...
  - caconym_ 7y ago
    I heard somewhere it's very stressful, toxic politics and so on. Not sure where but it's interesting to see a report to the contrary. Personally I always thought it would be cool to work at Valve, but not anymore. I don't see them doing anything broadly relevant that doesn't involve coasting on the momentum/market share of ancient products. Their VR stuff is cool, but even there it feel like they're lagging behind e.g. Oculus in ways that matter.
    - esyir 7y ago
      Eh, every review of the index has put it head and shoulders over any rift version so far. I'm not sure if we'd consider that "lagging behind oculus"
stOneskull 7y ago
They're arrogant and lazy. Just say thank you and fix it. I hope GOG and HumbleBundle get a nice boost in sales.
- babuskov 7y ago
  > I hope GOG and HumbleBundle get a nice boost in sales. While there are some DRM-free games, majority of games on HumbleBundle are sold as Steam keys, so you still need Steam to launch them.
  - bscphil 7y ago
    I seem to recall the HB site, in the early days, saying something to the effect of "Our promise: 100% DRM free games". They even did a bunch of bundles that donated part of the proceeds to the EFF. It's sad to see them as just another front for Steam sales.
    - driverdan 7y ago
      They're owned by Ziff Davis. It's not surprising.
  - stOneskull 7y ago
    oh, i didn't know that. that kinda sucks. well, anyway, valve will probably be changing their tune from now on
c3534l 7y ago
I see this as an example where the system works. Valve has an incentive to pay for bugs. The researcher than has an incentive to disclose them privately. If Valve doesn't pay fairly, the bug is disclosed, Valve pays the price and is forced to fix it, and be running a scam of a bug bounty program, they've exposed themselves to more disclosures. Valve now has an incentive to fix their program either by working with this bug hunter or increasing payouts so other hunters beat him to the point. This is how the system should work. Decentralized self-regulation needs people like Valve to fuck up once in a while so that the forces at play sufficiently punish them until they improve their process.
- jupp0r 7y ago
  The meta-process might work, Valve's process is still broken.
  - jay_kyburz 7y ago
    Everybody makes mistakes, lets see if they can learn from theirs. I haven't heard that they keep making this same mistake (but I could be wrong.)
    - jupp0r 7y ago
      This happened end of June, they should have had ample time to reach out to @viss, make amends and change their process.
      - jay_kyburz 7y ago
        follow up https://www.gamasutra.com/view/news/349352/Valve_tweaks_bug_bounty_program_after_mistakenly_turning_away_researchers.php https://www.gamasutra.com/view/news/349352/Valve_tweaks_bug_...
ssully 7y ago
I wonder if this is a product of Valve's free-form company structure. If as a Valve employee, you have the autonomy to float between projects, how do you maintain a strong security team? Do they even have a dedicate security team?
- abtinf 7y ago
  I've worked with extremely competent security professionals before. Those people love and are fanatical about security. Based on my experience, it seems a near certainty that Valve doesn't employee even a single such person. These people raise hell if security is ignored and have a job freedom that makes typical software engineers look like panhandlers.
  - Traubenfuchs 7y ago
    That is why many people hate security cybersecurity professionals: https://thenextweb.com/security/2019/01/25/everybody-hates-cybersecurity-professionals/ https://thenextweb.com/security/2019/01/25/everybody-hates-c...
- freeflight 7y ago
  > Do they even have a dedicate security team? Let's remember that Valve is the oldest there is in a business they pretty much pioneered with Steam over 15 years ago. As somebody who's had an account there since day 1, I'm still amazed by how tight they've managed to keep their ship for all these years, even tho plenty of people have been trying to break into that very worthwhile target for over a decade. If I contrast that to my experiences with services like Uplay, and Origin, then those differences are like night&day, because with both my accounts on these services I had lot's of issues due to my accounts getting hijacked (probably trough support) several times. In 15+ years of using Steam, this hasn't happened once to me, so whatever Valve is doing at that end, it seems to have worked well for them and their customers. That's not meant to defend their stance on this particular issue, but imho it's also kinda dishonest to now frame Valve as a company where nobody cares about security. If that'd be really the case then they would have gone out of business over a decade ago.
notyourday 7y ago
I'm amused that anyone does not have a cynical view of H1. H1 is an equivalent of HR for cyber. It exists not to deal with issues or address problems, rather it exists to help companies to manage bad exposure. That's how H1's bread is buttered.
busterarm 7y ago
My opinion, not my (HackerOne customer) employer's: I know this will be unpopular with folks like tptacek, but I've always felt strongly that bug bounty programs offer too many perverse incentives to all parties. More often than not it becomes a tool for companies to sweep issues like this under the rug and then use HackerOne's system to force the reporters to play ball (because they want to keep getting paid). I hate this sytem. I'm 100% behind open, public disclosure and if it were my own product in question, I would offer bounties for _public disclosures_. That keeps everyone honest.
- wolco 7y ago
  I agree with you from the other side. Before these programs people would disclose issues to the public. The company found out like everyone else. They would fix it immediately because they had to. Now they can hide it for months(ever) allowing others to discover them and keeping the researchers quiet.
  - CraftThatBlock 7y ago
    A normal process goes like this: - Researcher finds bug - Researcher discloses to vendor - Vendor fixes (or not) - Researcher discloses bug publically once vendor has fixed, or after X time (whichever is first) This is roughly how Project Zero goes, and it's a good mix between giving the vendor the opportinity to fix it and deploy the update before it gets exploited. It's very naive to assume that bugs can be fixed before others can exploit them. Bugs take time to fix, and the process takes time, especially when dealing with large enterprises.
    - xigency 7y ago
      Why is it whichever is first and not after a fixed time? I see a benefit to waiting X time regardless, because it allows more time for the patch to circulate to everyone. What is the benefit to disclosing it immediately after it is "fixed"?
      - thefifthsetpin 7y ago
deleted 7y ago
[deleted]
mordae 7y ago
This sucks. We run steam on some public PCs with unprivileged accounts and we wouldn't be very happy to find that users were able to gain admin access and steal other people's passwords through a keylogger. Sigh.
- sushisource 7y ago
  That seems to me the most obvious problem use case here. How can Valve possibly think that isn't important?
  - chii 7y ago
    because their security model is too myopic. By defining security vulnerability to be only remote code execution from within the steam client, they save themselves a tonne of work (and cost). I can understand that perspective - steam can't spend the time to rewrite to fix the EoP/LPE issues. Their stance must be that the user has to "be careful" not to install malware or other vulnerable software, instead of fixing steam.
- ohithereyou 7y ago
  Cybercafes, LAN gaming centers, and PC bangs are about to have some interesting times.
Havoc 7y ago
Drama aside. Valve...I have your software installed. It has a hole. Fix it. This mudslinging isn't helping your PR or making me feel more secure about my steam install regardless of the details.
- A4ET8a8uTh0 7y ago
  I agree. As a user, I do not care who is at fault much, but I do expect the platform you provide to be somewhat secure.. especially after you are told it is not. I basically uninstalled Steam client after first 0day was found. At least with gog I don't have install galaxy. But thats a different rant..
throwaway156503 7y ago
Since Valve stopped producing games, I wonder what their net income per employee is based on assets they own less revenue produced by third-parties through Steam. If you look at just the assets Valve produces minus rent seeking, are they losing money?
ChrisSD 7y ago
Just a reminder: you can disable the Steam service and still play your games. Some Steam features will be disabled or broken but whether or not this affects you will obviously vary depending on which ones you like to use.
yellowapple 7y ago
This wouldn't be anywhere near as severe a problem as it is if Steam's service wasn't running as something as ridiculously privileged as NTAUTHORITY\SYSTEM. On the plus side, reading the writeup [0] it seems unlikely that this affects the Linux client (or even if it does, it's at least limited to the current user account). So I guess Steam can continue to live on my machine for another day. [0]: https://amonitoring.ru/article/onemore_steam_eop_0day/ https://amonitoring.ru/article/onemore_steam_eop_0day/
batatati 7y ago
Maybe it is also time to switch from the prehistoric model of "hey let's download a .exe on the web, execute it without any sandbox, and let that .exe install other .exe from thousands of other unknown sources around the world and run them without any sandbox either." Steam or any other app should always run sandboxed with no root access, no file access, no camera access, no access to other process, etc. For most users, steam only needs a sandboxed local storage to put its game into it and a internet access (and maybe mic access), that's it. I really hope Flatpak and something similar for Window becomes the norm, the current situation is a security and privacy disaster. There can still be exploits of course but now you have the find a weakness both in the app + in the OS sandbox which is a whole lot harder
- umvi 7y ago
  Won't sandboxes impact performance of video games? I don't know much about sandboxes except that VMs are often used as sandboxes, and I definitely don't want video games running inside of VMs
  - codedokode 7y ago
    Games typically need only access to video adapter, sound card and maybe network. They do not need access to your browser's cookies or history, or documents folder, for example. This probably doesn't require using VM.
    - umvi 7y ago
      > They do not need access to your browser's cookies or history, or documents folder, for example Well, some do... like Doki Doki Literature Club
      - extrapickles 7y ago
        I would think it would work in practice closer to mobile apps, where their access requirements are explicitly stated upfront (eg: needs access to documents folder).
mrtweetyhack 7y ago
Could have sold it to the dark side
dsourajit 7y ago
There's a follow-up article. https://www.zdnet.com/article/valve-patches-recent-steam-zero-days-calls-turning-away-researcher-a-mistake/ https://www.zdnet.com/article/valve-patches-recent-steam-zer...
Jerry1220 7y ago
SERIOUS MINDED PEOPLE SHOULD CONTACT Need a hacker?was in a bit of some really embarrassing cyber issues which led me to meeting some scammers as well but my will to solve my issue eventually paid off when i met Cryto Cyber Hacker,his work rate,professionalism and discretion is top-class. Hit him up at cryptocyberhacker@gmail.com. he's kinda picky though so make mention of the reference. Tell him i referred you. You're welcome.

465 points by tareqak 7y ago

I mean, you can't have your cake and eat it too - if you claim that a particular issue is not a bug and you won't fix it, then you have no ethical grounds to say that it shouldn't be disclosed. Responsible disclosure expects delaying public disclosure to protect the users while the vendor prepares a fix. If the vendor says that they won't fix it, then it's not only a right, but a moral duty to disclose that vulnerability to the users.

WrtCdEvrydy 7y ago
I had the same argument with Coinbase about this one... Ended up naming it 'Bad QR', putting this page together and sending them a private link (https://writecodeeveryday.github.io/projects/badqr/ https://writecodeeveryday.github.io/projects/badqr/)
- joshstrange 7y ago
  Please fix your jquery import, it's being blocked b/c it's coming over http not https
  - WrtCdEvrydy 7y ago
    Sorry about that, probably gonna switch to VanillaJS.
    - dopamean 7y ago
      a great library.
      - _coveredInBees 7y ago
        I couldn't find/install it via npm or yarn :-( ;-)
        wlesieutre 7y ago
        You should consider The JAMstack, a new web paradigm where a user requests an HTML file and the server gives it to them.
  - NullPrefix 7y ago
    TLS errors are out of scope. #WONTFIX. Don't you dare to talk about this publically. http://writecodeeveryday.github.io/projects/badqr/ http://writecodeeveryday.github.io/projects/badqr/
    - WrtCdEvrydy 7y ago
      LOL. Banned from HackerOne.
EnFinlay 7y ago
The researcher can still disclose it, they just aren't going to get permission to disclose it on the Hackerone program. Most things out of scope don't get publicly disclosed as far as I know. Doesn't seem too unreasonable.
- hitekker 7y ago
  > Kravets said he was banned from the platform following the public disclosure of the first zero-day. His bug report was heavily covered in the media, and Valve did eventually ship a fix, more as a reaction to all the bad press the company was getting. > The patch was almost immediately proved to be insufficient, and another security researcher found an easy way to go around it almost right away. You might want to read the article.
  - EnFinlay 7y ago
    I was responding to a comment that (I interpreted) to be talking in more general terms than the scope of the article.
    - danShumway 7y ago
      Even in the scope of the original comment, doesn't it create a pretty perverse incentive to allow companies to mark HackerOne bugs as WONTFIX and then ban researchers who disclose them? Isn't security through obscurity largely to be avoided? I thought the working model for most security researchers was: if it's not worth fixing, it's not worth hiding. More to the point, I thought that responsible disclosure always came with an expectation of public disclosure. The advice I've always been given is that you should never disclose with conditions -- ie. "fix this and I won't tell anyone." It should always be, "I am going to tell everyone, but I'm telling you first so you can push a fix before I do." Does HackerOne operate under different rules?
- fencepost 7y ago
  Without seeing the communications it's hard to say, but "When the security researcher -- named Vasily Kravets-- wanted to publicly disclose the vulnerability, a HackerOne staff member forbade him from doing so, even if Valve had no intention of fixing the issue" sounds like more than just not being able to disclose on the H1 program.
Mindless2112 7y ago
Frankly, I think HackerOne deserves a bit of blame for that. Any WONTFIX ought to be made public automatically unless there are extenuating circumstances (like the vulnerability being reported against the wrong product).
- deleted 7y ago
  [deleted]
- daeken 7y ago
  H1 itself has no WONTFIX status, FYI. A bug that's not considered to be a bug by the program will either be closed N/A or informative. Ultimately, disclosures are handled and controlled by the program, not by H1; this is both a good and bad thing (and I say that as both a HackerOne employee and a hacker on the platform -- it's a complicated issue from both sides).
  - kop316 7y ago
    It's complicated on both sides means there is politics involved. Being blunt, that sounds like a cop out to me. This sounds to me like an edge case that H1 should address if it really wants to be taken seriously.
    - daeken 7y ago
      There is definitely politics involved, but not H1 internal. The issue is that every program handles disclosure itself, so H1 itself doesn't really have the power. That could be changed at a policy level, but I'm not sure that'll happen (or should happen, honestly; I don't really know where I land on it).
      - chris_wot 7y ago
        H1 could make it a proviso if using their service that rejected but reports are automatically disclosed.
        7y ago
abtinf 7y ago
I uninstalled Steam the moment I read the previous disclosure and Valve's approach to it. Any company that treats security as it used to be in the 90s ought to be shunned.
- babuskov 7y ago
  If you don't need it, why did you have it installed in the first place?
  - p1necone 7y ago
    Not sure what you're getting at. There's very few things we need, sounds like they're sacrificing a little to avoid giving a company they deem unethical any money.
  - abtinf 7y ago
    I love games and can’t play my steam collection now. But if I have to give that up so that some silly bug elsewhere in my system doesn’t expose me to a ransomware attack (or worse), so be it. I’ll find another way.
    - jay_kyburz 7y ago
      You should be able to play games in your steam library. Just open your Steam\steamapps\common\ folder and find the exe for the game you want to play.
      - cprecioso 7y ago
        Steam's DRM (CEG) customizes the executables so it won't play without the Steam client running and logged in to the correct account. There are lots of not-DRM-enabled games on Steam, but they're decidedly in the minority.
        StavrosK 7y ago
        That's why GOG.com is my first choice. They even provide a nice Steam-like installer (unfortunately, no Linux version of the installer), while letting you download your games DRM-free, archivable and standalone.
one2zero 7y ago
You would think that any platform/app that actually contains the ability to load currency into itself would take any security threat seriously regardless of the scope.

ChuckMcM 7y ago

This story continues to be so sad. Steam is reprising the role of Adobe who, for quite a while, refused to acknowledge that being able to use FlashPlayer as a tool to get you something on Windows was just as bad as breaking FlashPlayer. I heard one Adobe executive say, "Hey you can use a baseball bat to bludgeon someone but that isn't the bat maker's fault is it? If they are forced to make foam bats their product is useless." That position isn't "wrong" so much as it isn't useful in reducing risk.

fortran77 7y ago
You're beating a dead horse. Flash served a purpose once, and now it's reached end-of-life.
- vorpalhex 7y ago
  > You're beating a dead horse With a foam bat. Just because the flash horse is dead doesn't mean it didn't deserve it's beating or can't continue to be a potent reminder of how bad Adobe was at handling security issues and why other platforms, like Steam, should learn instead of emulate.
  - dmix 7y ago
    This also has nothing to do with Flash specifically, rather as you said Adobe's policy. It could have been any software but especially for Flash. Flash was just such a unique special target, ala PDFs and Microsoft word, there were few wide open targets from which a hacker could predictably get the user to open (whether embedded or not) on a targets machine. So it was particularly sensitive to vulnerabilities by design, where a much broader security perspective was clearly needed than most software.
  - socceroos 7y ago
    I'd prefer to describe it as slashing a dead horse's rotten corpse with a katana. As the bloat and flesh of the ecosystem has disintegrated we're able to observe the framework more clearly - the bone structure of the horse, if you will. Using the katana we are making precise, incisive blows to the remnants as we extract meaning from it's corpse - or lessons learned, if you will. ...perhaps I'm taking the analogy too far?

jacobkg 7y ago

The salient part seems to be that the researcher reported the first vulnerability through HackerOne and was (reportedly) told by Steam it wouldn’t be fixed. He then published it after being instructed that was against the rules and was banned

EnFinlay 7y ago
"Please don't do thing" does thing gets banned shocked
- Avamander 7y ago
  It wasn't going to be fixed, you can't ship vulnerable software, it's not okay. He was in every right to publish it and to keep shaming Valve.
  - EnFinlay 7y ago
    And Valve has ever right to ban him from their program, right?
    - Avamander 7y ago
      Yep, and we have every right to laugh at their stupidity.
    - deleted 7y ago
      [deleted]
    - vorpalhex 7y ago
      And the rest of us have the right to tell Valve, as their paying customers, we're very disappointed in their behavior and find it unacceptable. I expect them to take security flaws seriously if they want my continued patronage - and that includes EoPs.
    - JeremyBanks 7y ago
      "muh rights!!!!"

EnFinlay 7y ago

a) Program has scope that doesn't include X b) Researcher reports vulnerability that falls under X c) Since it's out of scope, it's closed as N/A d) Report is locked because company doesn't want to publicly disclose a vulnerability in their system via the Hackerone platform What's the problem here? Just go with normal vulnerability disclosure. Bug bounty programs are a two way street, and respecting the scope is part of that. Edit: I guess the important part is that the researcher was then banned for disclosing the report. Seems reasonable, honestly. I don't agree with it, but I understand it.

PeterisP 7y ago
Well, they did go with normal vulnerability disclosure, and were retaliated against. That's not okay.
- EnFinlay 7y ago
  Retailiated as in he was banned from their bug bounty program. The program with a scope that they went outside of. I think it's reasonable to be banned. Obviously it would be better if Valve fixed the issue and gave a (possibly reduced due to out of scope) bounty.
  - tptacek 7y ago
    That makes sense if the application is, like, a SAAS app, and the scope is, like, "don't employ credential stuffing or test any of our 3rd party dependencies that have not given us permission to be included in this scope". But this is software people install on their desktops, and Valve has no say in how security researchers approach that stuff. Valve can and maybe even should exclude LPEs from their bounty scope (if that's not what they're focusing on right now), but they can't reasonably ban people for publishing vulnerabilities they've scoped out of the only mechanism they've provided for submitting and tracking vulnerabilities.
zelon88 7y ago
Acknowledgement is one thing. Disclosure is another. If Steam had no problem acknowledging that this functionality exists, they should have had no problem with it being disclosed. There lies the problem. In the bathroom with the needle in their arm; "...there's no problem here..." but if you swing the door open they'll still try to shut it. Because they know they're wrong. If HackerOne isn't going to help you they have no right to hinder you. If they want to strongarm everyone into effectively the same agreement as an NDA then there literally is no point in turning vulnerabilities into HackerOne. They seem to only exist as a cow-catcher on the locomotive of software vendors too lazy to actually fix crappy code. "Who needs to fix code and shell out bounty if you can pinpoint and silence the researcher?"

bogwog 7y ago

From what I've read, the original bug involved malware already installed on the PC using the Steam client to run other code. While I'm not a security expert in any way, that doesn't seem to me like a huge exploit. If the attack requires installing malware on the victim's computer, why not just do the evil stuff directly with that malware? If that's the case and I'm not just remembering it wrong, then I could see why Valve wouldn't want to pay up and could see why this guy would go on a social media rant to slander Valve either hoping they'll pay up or just to get petty revenge.

rileymat2 7y ago
> Kravets did eventually publish details about the Steam zero-day, which was an elevation of privilege (also known as a local privilege escalation) bug that allowed other apps or malware on a user's computer to abuse the Steam client to run code with admin rights. No, using this 0-day malware, with lower privilege level, could do stuff it could not do.
- babuskov 7y ago
  > could do stuff it could not do I have trouble parsing this. Did you mean "could do stuff it couldn't have done" perhaps?
  - Grangar 7y ago
    It gets to do fancy admin stuff that regular malware without permissions can't.
dx87 7y ago
It was a priviledge escalation. An attacker could go from running as a compromised user to running with system priviledges.
Rotten194 7y ago
Using the Steam client to run other code at an escalated privilege level.
7y ago

codesushi42 7y ago

Yet another reason to switch to GOG.

tzakrajs 7y ago

Valve figured out how to print money by hooking teenagers with gambling on loot boxes. They stopped having to create AAA titles, they stopped having to do anything remotely creative, and now they are a giant cancer with no value left to add. Their client is an insecure, slow, instable piece of shit and has been this way for well over a decade. I regret being a customer of theirs.

zelon88 7y ago
I remember listening to some of their commentary tracks where the employees talk about how their desks had wheels, there's no managers, and there's no deadlines and no stress. They also at one time had higher profit per employee than Google! [1] Turns out that all along having no accountability in your company would result in complacency and a critical lack of production. I'm curious to see how Valve Software as a company is going to climb over this security wall they've found themselves in front of if seemingly nobody has to answer to anyone and everybody gets to do what they want in a leisurely fashion. I mean we give Chinese IoT vendors crap all day long, and it turns out Steam might be just as bad! [1] https://www.forbes.com/sites/stevedenning/2012/04/27/a-glimpse-at-a-workplace-of-the-future-valve/#138f96275577 https://www.forbes.com/sites/stevedenning/2012/04/27/a-glimp...
- caconym_ 7y ago
  I heard somewhere it's very stressful, toxic politics and so on. Not sure where but it's interesting to see a report to the contrary. Personally I always thought it would be cool to work at Valve, but not anymore. I don't see them doing anything broadly relevant that doesn't involve coasting on the momentum/market share of ancient products. Their VR stuff is cool, but even there it feel like they're lagging behind e.g. Oculus in ways that matter.
  - esyir 7y ago
    Eh, every review of the index has put it head and shoulders over any rift version so far. I'm not sure if we'd consider that "lagging behind oculus"

stOneskull 7y ago

They're arrogant and lazy. Just say thank you and fix it. I hope GOG and HumbleBundle get a nice boost in sales.

babuskov 7y ago
> I hope GOG and HumbleBundle get a nice boost in sales. While there are some DRM-free games, majority of games on HumbleBundle are sold as Steam keys, so you still need Steam to launch them.
- bscphil 7y ago
  I seem to recall the HB site, in the early days, saying something to the effect of "Our promise: 100% DRM free games". They even did a bunch of bundles that donated part of the proceeds to the EFF. It's sad to see them as just another front for Steam sales.
  - driverdan 7y ago
    They're owned by Ziff Davis. It's not surprising.
- stOneskull 7y ago
  oh, i didn't know that. that kinda sucks. well, anyway, valve will probably be changing their tune from now on

c3534l 7y ago

I see this as an example where the system works. Valve has an incentive to pay for bugs. The researcher than has an incentive to disclose them privately. If Valve doesn't pay fairly, the bug is disclosed, Valve pays the price and is forced to fix it, and be running a scam of a bug bounty program, they've exposed themselves to more disclosures. Valve now has an incentive to fix their program either by working with this bug hunter or increasing payouts so other hunters beat him to the point. This is how the system should work. Decentralized self-regulation needs people like Valve to fuck up once in a while so that the forces at play sufficiently punish them until they improve their process.

jupp0r 7y ago
The meta-process might work, Valve's process is still broken.
- jay_kyburz 7y ago
  Everybody makes mistakes, lets see if they can learn from theirs. I haven't heard that they keep making this same mistake (but I could be wrong.)
  - jupp0r 7y ago
    This happened end of June, they should have had ample time to reach out to @viss, make amends and change their process.
    - jay_kyburz 7y ago
      follow up https://www.gamasutra.com/view/news/349352/Valve_tweaks_bug_bounty_program_after_mistakenly_turning_away_researchers.php https://www.gamasutra.com/view/news/349352/Valve_tweaks_bug_...

ssully 7y ago

I wonder if this is a product of Valve's free-form company structure. If as a Valve employee, you have the autonomy to float between projects, how do you maintain a strong security team? Do they even have a dedicate security team?

abtinf 7y ago
I've worked with extremely competent security professionals before. Those people love and are fanatical about security. Based on my experience, it seems a near certainty that Valve doesn't employee even a single such person. These people raise hell if security is ignored and have a job freedom that makes typical software engineers look like panhandlers.
- Traubenfuchs 7y ago
  That is why many people hate security cybersecurity professionals: https://thenextweb.com/security/2019/01/25/everybody-hates-cybersecurity-professionals/ https://thenextweb.com/security/2019/01/25/everybody-hates-c...
freeflight 7y ago
> Do they even have a dedicate security team? Let's remember that Valve is the oldest there is in a business they pretty much pioneered with Steam over 15 years ago. As somebody who's had an account there since day 1, I'm still amazed by how tight they've managed to keep their ship for all these years, even tho plenty of people have been trying to break into that very worthwhile target for over a decade. If I contrast that to my experiences with services like Uplay, and Origin, then those differences are like night&day, because with both my accounts on these services I had lot's of issues due to my accounts getting hijacked (probably trough support) several times. In 15+ years of using Steam, this hasn't happened once to me, so whatever Valve is doing at that end, it seems to have worked well for them and their customers. That's not meant to defend their stance on this particular issue, but imho it's also kinda dishonest to now frame Valve as a company where nobody cares about security. If that'd be really the case then they would have gone out of business over a decade ago.

notyourday 7y ago

I'm amused that anyone does not have a cynical view of H1. H1 is an equivalent of HR for cyber. It exists not to deal with issues or address problems, rather it exists to help companies to manage bad exposure. That's how H1's bread is buttered.

busterarm 7y ago

My opinion, not my (HackerOne customer) employer's: I know this will be unpopular with folks like tptacek, but I've always felt strongly that bug bounty programs offer too many perverse incentives to all parties. More often than not it becomes a tool for companies to sweep issues like this under the rug and then use HackerOne's system to force the reporters to play ball (because they want to keep getting paid). I hate this sytem. I'm 100% behind open, public disclosure and if it were my own product in question, I would offer bounties for _public disclosures_. That keeps everyone honest.

wolco 7y ago
I agree with you from the other side. Before these programs people would disclose issues to the public. The company found out like everyone else. They would fix it immediately because they had to. Now they can hide it for months(ever) allowing others to discover them and keeping the researchers quiet.
- CraftThatBlock 7y ago
  A normal process goes like this: - Researcher finds bug - Researcher discloses to vendor - Vendor fixes (or not) - Researcher discloses bug publically once vendor has fixed, or after X time (whichever is first) This is roughly how Project Zero goes, and it's a good mix between giving the vendor the opportinity to fix it and deploy the update before it gets exploited. It's very naive to assume that bugs can be fixed before others can exploit them. Bugs take time to fix, and the process takes time, especially when dealing with large enterprises.
  - xigency 7y ago
    Why is it whichever is first and not after a fixed time? I see a benefit to waiting X time regardless, because it allows more time for the patch to circulate to everyone. What is the benefit to disclosing it immediately after it is "fixed"?
    - thefifthsetpin 7y ago

deleted 7y ago

[deleted]

mordae 7y ago

This sucks. We run steam on some public PCs with unprivileged accounts and we wouldn't be very happy to find that users were able to gain admin access and steal other people's passwords through a keylogger. Sigh.

sushisource 7y ago
That seems to me the most obvious problem use case here. How can Valve possibly think that isn't important?
- chii 7y ago
  because their security model is too myopic. By defining security vulnerability to be only remote code execution from within the steam client, they save themselves a tonne of work (and cost). I can understand that perspective - steam can't spend the time to rewrite to fix the EoP/LPE issues. Their stance must be that the user has to "be careful" not to install malware or other vulnerable software, instead of fixing steam.
ohithereyou 7y ago
Cybercafes, LAN gaming centers, and PC bangs are about to have some interesting times.

Havoc 7y ago

Drama aside. Valve...I have your software installed. It has a hole. Fix it. This mudslinging isn't helping your PR or making me feel more secure about my steam install regardless of the details.

A4ET8a8uTh0 7y ago
I agree. As a user, I do not care who is at fault much, but I do expect the platform you provide to be somewhat secure.. especially after you are told it is not. I basically uninstalled Steam client after first 0day was found. At least with gog I don't have install galaxy. But thats a different rant..

throwaway156503 7y ago

Since Valve stopped producing games, I wonder what their net income per employee is based on assets they own less revenue produced by third-parties through Steam. If you look at just the assets Valve produces minus rent seeking, are they losing money?

ChrisSD 7y ago

Just a reminder: you can disable the Steam service and still play your games. Some Steam features will be disabled or broken but whether or not this affects you will obviously vary depending on which ones you like to use.

yellowapple 7y ago

This wouldn't be anywhere near as severe a problem as it is if Steam's service wasn't running as something as ridiculously privileged as NTAUTHORITY\SYSTEM. On the plus side, reading the writeup [0] it seems unlikely that this affects the Linux client (or even if it does, it's at least limited to the current user account). So I guess Steam can continue to live on my machine for another day. [0]: https://amonitoring.ru/article/onemore_steam_eop_0day/ https://amonitoring.ru/article/onemore_steam_eop_0day/

batatati 7y ago

Maybe it is also time to switch from the prehistoric model of "hey let's download a .exe on the web, execute it without any sandbox, and let that .exe install other .exe from thousands of other unknown sources around the world and run them without any sandbox either." Steam or any other app should always run sandboxed with no root access, no file access, no camera access, no access to other process, etc. For most users, steam only needs a sandboxed local storage to put its game into it and a internet access (and maybe mic access), that's it. I really hope Flatpak and something similar for Window becomes the norm, the current situation is a security and privacy disaster. There can still be exploits of course but now you have the find a weakness both in the app + in the OS sandbox which is a whole lot harder

umvi 7y ago
Won't sandboxes impact performance of video games? I don't know much about sandboxes except that VMs are often used as sandboxes, and I definitely don't want video games running inside of VMs
- codedokode 7y ago
  Games typically need only access to video adapter, sound card and maybe network. They do not need access to your browser's cookies or history, or documents folder, for example. This probably doesn't require using VM.
  - umvi 7y ago
    > They do not need access to your browser's cookies or history, or documents folder, for example Well, some do... like Doki Doki Literature Club
    - extrapickles 7y ago
      I would think it would work in practice closer to mobile apps, where their access requirements are explicitly stated upfront (eg: needs access to documents folder).

mrtweetyhack 7y ago

Could have sold it to the dark side

dsourajit 7y ago

There's a follow-up article. https://www.zdnet.com/article/valve-patches-recent-steam-zero-days-calls-turning-away-researcher-a-mistake/ https://www.zdnet.com/article/valve-patches-recent-steam-zer...

Jerry1220 7y ago

SERIOUS MINDED PEOPLE SHOULD CONTACT Need a hacker?was in a bit of some really embarrassing cyber issues which led me to meeting some scammers as well but my will to solve my issue eventually paid off when i met Cryto Cyber Hacker,his work rate,professionalism and discretion is top-class. Hit him up at cryptocyberhacker@gmail.com. he's kinda picky though so make mention of the reference. Tell him i referred you. You're welcome.