3 ms·

1.7M DiRT 3 keys leaked from AMD promo due to missing .htaccess

24 points by waffle_ss 15y ago

citricsquid 15y ago
Keys on the left activate on Steam. I'd personally recommend against using one, although they are supposed to be consumed by the public (they're available if you enter your details, it's not as if these were supposed to be charged for) if AMD request it Steam will revoke them and it has the potential to put your account in bad standing (although v. unlikely)
- Fliko 15y ago
  They've already dealt with similar problems and haven't put any accounts into bad standing. The good standing/bad standing is more for VAC anyways.
klodolph 15y ago
This is really not the proper way to report a vulnerability.
- citricsquid 15y ago
  It has been all over the internet for most of today, the original list was leaked and now someone has leaked the directory.
Culver 15y ago
Mine worked, thanks I guess? Already own the game for XB360.
nathanhammond 15y ago
The other piece that everybody seems to be missing is that they've just leaked the unique IDs for every eligible AMD product. I don't know if those can be abused in some manner, but those are out there too, now.
genbattle 15y ago
I don't know how they'll resolve this... Ban all the steam accounts of people who've activated the keys? They'll get a whole lot of people who legitimately submitted hardware keys at the same time. Invalidate/revoke the keys from steam? The hardware IDs they were using to run the promotion are still going to be out there in the wild, so they can't re-run the promotion, this would just minimize their losses in terms of lost profit. As far as the keys being in plain text on the server, this doesn't even make sense from the perspective of how you design a web app; why not put the data on a separate remote/secure server? Why not at least encrypt it? Also, how are they matching the hardware IDs to the keys when people submit the official promo; are they actually doing a search through each text file to find the matching hardware key? The .htaccess mis-configuration is bad enough, but it's not the only issue here.

24 points by waffle_ss 15y ago

Keys on the left activate on Steam. I'd personally recommend against using one, although they are supposed to be consumed by the public (they're available if you enter your details, it's not as if these were supposed to be charged for) if AMD request it Steam will revoke them and it has the potential to put your account in bad standing (although v. unlikely)

Fliko 15y ago
They've already dealt with similar problems and haven't put any accounts into bad standing. The good standing/bad standing is more for VAC anyways.

klodolph 15y ago

This is really not the proper way to report a vulnerability.

citricsquid 15y ago
It has been all over the internet for most of today, the original list was leaked and now someone has leaked the directory.

Culver 15y ago

Mine worked, thanks I guess? Already own the game for XB360.

nathanhammond 15y ago

The other piece that everybody seems to be missing is that they've just leaked the unique IDs for every eligible AMD product. I don't know if those can be abused in some manner, but those are out there too, now.

genbattle 15y ago

I don't know how they'll resolve this... Ban all the steam accounts of people who've activated the keys? They'll get a whole lot of people who legitimately submitted hardware keys at the same time. Invalidate/revoke the keys from steam? The hardware IDs they were using to run the promotion are still going to be out there in the wild, so they can't re-run the promotion, this would just minimize their losses in terms of lost profit. As far as the keys being in plain text on the server, this doesn't even make sense from the perspective of how you design a web app; why not put the data on a separate remote/secure server? Why not at least encrypt it? Also, how are they matching the hardware IDs to the keys when people submit the official promo; are they actually doing a search through each text file to find the matching hardware key? The .htaccess mis-configuration is bad enough, but it's not the only issue here.