3 ms·
How is this a vulnerability?
by vageli 7y ago
How is this a vulnerability?
- MaxBarraclough 7y agoThe software is vulnerable to a MITM attack. There's no reason it should be.
- vageli 7y agoFrankly, I'm surprised the site didn't respond with a 302 redirect to SSL to avoid this kind of thing entirely (versus relying on client to specify the correct protocol).
- MaxBarraclough 7y agoI don't follow. That's quite obviously not a proper fix.
- cwillu 7y agoThe client _must_ use the correct protocol, that's precisely the issue. An insecure request to switch to a secure protocol would just be elided by an attacker. If the client is coded to expect such a switch and fail if it doesn't happen, that client is at best implementing a more complicated, ad-hoc secure protocol.
- tadzik_ 7y agoThe vulnerability, on the high level, is that the Steam app doesn't verify that the store page comes from Valve, meaning that if you own a Wifi hotspot you can potentially scam and cheat the users of the Steam app. This wouldn't have been possible with basic use of SSL by the app. That's what makes this bizarre – the negligence of developers, the triviality of the fix and the complete lack of understanding from people who are supposed to be reviewing security issues.
- user5994461 7y agoThe report could have been better worded IMO, it hardly explains the trivial issue or the trivial fix. Preferring to go at length about what if the ISP is hacked and other crazy scenarios. It wouldn't hurt to say that they simply have a typo in the URL. http instead of https.
- staz 7y agoHow is this not? Steam clients are basically glorified web views for the Shop portion and user regularly enter credit card details in them to buy games or hardware. User also might have virtual currency or valuable stuff in their account worth a lot of real money and users trust everything that's inside theses clients. So by MITM any unencrypted connection to Steam server either credentials or payment info.