19 ms·

Steam hit by major security breach

300 points by aestetix 11y ago

watbe 11y ago
The exploit has been fixed, and this video shows how easy it was to perform: https://www.youtube.com/watch?v=QPl_BJoBaVA https://www.youtube.com/watch?v=QPl_BJoBaVA TL;DW: Steam accepted blank recovery codes for password resets, enabling passwords to be changed without needing access to the recovery email account. I hope someone is writing a new test case.
- baby 11y ago
  This is just insane how crazy this is easy to exploit. What did the developers think?? Also for how long was this exploitable? If it was a long time, this could show that we tend to over estimate the security of our websites... (a huge amount of people took a long time to find a super easy bug)
  - cookiecaper 11y ago
    There is absolutely a mess of little oversights like this in every non-trivial software project (I just fixed one not 30 minutes ago). The effects are sometimes very serious, as in this case. Cyber-warfare is scary precisely because of this. There is nothing we can do about it IMO, though things like SELinux/AppArmor and even good filesystem-level permissions help a little bit.
    - andrewchambers 11y ago
      In this particular case, the advice to avoid it is more simple. When designing test cases choose the extreme values, no text, too much text, etc.
    - deleted 11y ago
      [deleted]
    - Taek 11y ago
      There is something you can do about it, but it's expensive and different from what you are used to. Safer languages is a good place to start. Input validation can be made to be machine-verified, and anit-patterns can be learned and avoided. Static analysis tools can raise red and yellow flags. Finally, frameworks are being built for handling security critical things like account validation, crypto key handling, an related tasks that are important to get right. As the space continues to evolve, things like this will become less common, and someone who is aware of the trade and is diligent will be less likely to make mistakes.
      - LoSboccacc 11y ago
        > anit-patterns can be learned a spell checker didn't save you from a typo. not nitpicking, just using this example to illustrate a point: for an app to be secure, developers have to be 100% of the time on ball, while an attacker just has to be lucky once. the weight is so much in favor of attacker than only few of the biggest can afford to pay for a competitive level of security, it being a race: security is effective not when perfect, but when it costs more to attack a site than what you'd gain of it.
        mdpopescu 11y ago
        Or even when the gain/cost ratio for attacking YOUR site is greater than the one for other sites. (You don't have to outrun the bear, you have to outrun the other people.)
        ethbro 11y ago
        > a spell checker didn't save you from a typo Believe this is where parent's preference for high-quality, easy-to-use libraries handling common security operations comes from. It's a lot easier to make a typo (or logical mistake) in 250 lines of your own code than in (hopefully) <250 lines of a library invocation. Honestly, library functionality like this in any given language should be thought of as an analog to infrastructure spending. We're finally seeing reinvestment from end-users and value capturers (Facebook, Google, MS, etc) back down the chain to the OSS projects they depend on. Language guiders (and in some cases the support businesses who are attached to languages) should be equally serious about this. If your language doesn't have high-quality, easy-to-use libraries to mitigate attack surfaces, that's a fundamental weakness in your language eco-system... (Aka the "Perl+CPAN is better than a lot of more advanced languages, because code" argument)
    - weavie 11y ago
      This is precisely the sort of error that Fuzz testing should have uncovered.
      - baby 11y ago
        When you have such a huge application (steam) how can you afford to Fuzz everything? Also to setup fuzzing for every parts of your applications
    - InclinedPlane 11y ago
      There's plenty that can be done about it, but it imposes a cost that most software shops don't want to pay today, despite the enormous costs of these breaches. Formal code reviews. Longer pipelines between checkin and deployment. Penetration testing during pre-release. Better QA, both manual and automated. Better security policies in general. And so on. Making a change to security related code should trigger a process that represents and avalanche of attention. There should be a shit-ton of scrutiny on any such change. The fact that something this simple wasn't caught is indicative not that "nothing can be done" but rather that most security related code today is handled in an amateurish way by teams who barely care about the consequences of their actions.
  - on_and_off 11y ago
    Writing such an exploitable code is entirely forgivable. However, I would expect such a critical module to be thoroughly unit tested. I am going to venture that it probably was not the case.
    - gauravagarwalr 11y ago
      Not exactly sure how forgivable this is. But yes, unit testing and writing a few negative scenarios would have caught this problem early on.
  - Strilanc 11y ago
    They were thinking about how to make it work instead of how to make it break. Classic mistake (e.g. [1]). 1: https://www.youtube.com/watch?v=vKA4w2O61Xo https://www.youtube.com/watch?v=vKA4w2O61Xo
    - tripzilch 11y ago
      Watching that, it amazes me how many people don't get that. Not long ago there was an article on HN about this very experiment (from NY Times, IIRC). Now I can imagine, if you're not a software-tester by heart, that you'd maybe try to "win" the first or two tries, out of habit. I'm not a professional tester, just a coder, and reading the aforementioned article, I also first tried 3/6/12 and then some arbitrary increasing sequence, before catching myself and realizing if I want to figure out the rule I need some negative examples. Is this something you need to be a programmer to realize? Or maybe you need to have a "scientific" mind or something? I'm going to try this on some of my friends, see if I can figure it out. I expect a big part of it to be some psychological barrier against "failing" or getting "no" as an answer, especially if you're being put on the spot about some math-related puzzle. Many people feel uncomfortable with maths and perhaps fear giving a "wrong" answer and appearing "stupid". But "fear of maths" isn't what I'd be testing for, it's "willingness/realization to try an experiment with an (expected) negative outcome". So I'll make sure to formulate the problem in an appropriate manner, just like the guy in the video did, that the goal is to figure out the rule, not to finish the sequence. Try to make them comfortable, but not as far as saying "It's okay to ask me about a sequence that does not follow my rule", because that would obviously bias the experiment. Though I wonder now, there's some really interesting studies to be done (probably many already have been done), what if the puzzle is about some other rule for a sequence of three, that doesn't have anything to do with numbers? Say the rule is "objects of increasing size", but the (similarly misleading) example is bicycle / car / train.
      - jdmichal 11y ago
        I would think the phenomenon is basically equivalent to confirmation bias. A hypothesis is formed immediately upon seeing the question. Then, only further information which confirms their hypothesis is tested. Testing the negative is something that should be fairly routine in a scientific-testing mindset. For instance, medical experiments testing both placebos (negative) and medicine (positive) and looking for differences.
- cookiecaper 11y ago
  I worked on a big name project that had this same problem, which we found because users had begun exploiting it. The problem was caused when a user would intentionally prevent the recovery_code from submitting with the rest of the form, which resulted in recovery_code being nil, which resulted in "SELECT something FROM users WHERE recovery_code IS NULL AND email = targeted_email" hitting the database. This wouldn't work if you'd requested a password reset code and not yet used it, but everyone else was vulnerable. Sounds like something similar happened here. EDIT: Updated explanation of problem because I originally explained it wrong (required omission of the value on submission, not just a blank value).
  - johansch 11y ago
    How did the string go from "" to nil automagically?
    - krainboltgreene 11y ago
      Bad database constraints obviously.
      - deleted 11y ago
        [deleted]
    - cookiecaper 11y ago
      I explained it incorrectly. It actually wasn't as simple as leaving the recovery code blank, because as you note, that would result in an empty string. What they did was delete the recovery_code element from the form entirely and then submit. It was a Rails project, so when the application requested params[:recovery_code], it would get back nil, since Ruby gives nil when you request a key that doesn't exist in a hash. If you left the box blank, you wouldn't hit the bug, because "" != NULL.
    - ajanuary 11y ago
      It wasn't the case here, but Oracle effectively treats empty string and null as the same value.
- ars 11y ago
  > Steam accepted blank recovery codes for password resets Sample buggy code (that I just made up): (user_token is user supplied token, token is the correct token) for(i = 0; i < strlen(user_token); i++) { if(user_token[i] != token[i]) return false; } return true; If code is blank this will falsely return true. This is also subject to truncation attacks. I'm trying to think of a bug where blank fails, but truncated versions do not.
  - brobinson 11y ago
    Another not-so-obvious bug with your example buggy code: it's also vulnerable to timing attacks. http://codahale.com/a-lesson-in-timing-attacks/ http://codahale.com/a-lesson-in-timing-attacks/
    - tomjen3 11y ago
      True, but I don't think Steam allows you enough tries to make it viable.
    - deleted 11y ago
      [deleted]
    - kibibu 11y ago
      Also not a bug, but putting strlen() inside the loop condition makes my eyes twitch
  - deleted 11y ago
    [deleted]
  - jwiley 11y ago
    No idea or visibility into Steam's backend. Hope to god they are not using C for this very reason. Great for games, terrible for SAS
    - ars 11y ago
      If you wrote it like that this bug would happen in every language. There is nothing in there that is worse because of C.
- deleted 11y ago
  [deleted]
ekianjo 11y ago
This is what concerns me the most with Valve: you build a library of games over the years, and one day someone hijacks your account (because of improper testing on Valve's side) and you lose it or it becomes banned, and you are left with nothing but your eyes to cry. At least with GOG this would never happen (at long as you save your games locally), but the GOG catalog is way smaller than Steam's.
- NamTaf 11y ago
  The good thing with Valve is that although they make comically terrible mistakes like this, they know they're bad at getting stuff right and put traceable information on everything Get falsely VAC banned? They'll detect this and know exactly what happened and revert the issue. Have your account hijacked? They'll trace exactly what happens and fix it all up. Not to mention that this change triggered the standard 'you can't trade or market any games/items on your account for 7 days' block, so even when someone takes your account you don't actually lose anything. Valve makes some incredibly bad bugs in their software (games as well as Steam itself), but at least they track and trace everything so they can unwind their screw-ups.
  - ekianjo 11y ago
    > Valve makes some incredibly bad bugs in their software (games as well as Steam itself), but at least they track and trace everything so they can unwind their screw-ups. Well for the recent but on Steam Linux that erased your hard drive if you moved the Steam library folder somewhere else, there was nothing they could do to "unwind their screw-ups", except fixing it in the code once the damage was done.
    - taspeotis 11y ago
      Steam on Windows has some odd behaviour too [1]. Warning: The uninstallation process deletes the folder Steam was installed to to ensure it is fully uninstalled. If you accidentally installed Steam to a folder containing other data, for example C:\Program Files\ instead of C:\Program Files\Steam\, STOP! [1] https://support.steampowered.com/kb_article.php?ref=9609-OBMP-2526 https://support.steampowered.com/kb_article.php?ref=9609-OBM...
ejcx 11y ago
One little know cool thing steam has done for a while is encrypt passwords with a RSA public key before they are sent server side. Yes, js crypto is not worth a whole lot but it is a valuable security tool to be used with TLS. There are some neat things they could be doing with this encrypted password (other than plainly decrypting it) that add a fair bit of security (no more than just a regular hash though).
- codexon 11y ago
  No not really. It highlights how incompetent Valve is at security. If you cannot trust the webserver or whatever is being served to you, JS crypto isn't going to do anything. They could just send you a login script that sends your unencrypted password elsewhere.
  - ejcx 11y ago
    It highlights how incompetent Valve is at security. Adding one feature shows they are incompetent at security? Great real. Without more information about the scheme there's nothing to know. Whether useful or not it is still neat and can be used for benefit, but not for something TLS like.
    - codexon 11y ago
      Yes, it does. It was a complete waste of time and does nothing useful except chew more CPU cycles. This is why all the security experts say that JS crypto is useless.
      - ejcx 11y ago
        I'm not going to argue but I might as well explain some of the uses here. For example, encrypting clientside and not decrypting serverside will mean it's impossible to have a plaintext password leak in the future, which decreases risk. It also forces passive MITM to become active. Turning Eve into Mallory gives theoretical attackers much more work. There are more benefits beyond this. What you're thinking of is using this for actual password protection, which it won't provide. It can't be used as a TLS replacement. If you've actually read tptacek's big blog post about this you would notice it has to do with using js crypto being used to protect something, which this won't provide, but it can successfully be used to protect a service from itself and many other things. It's impossible to know all the details and benefits and pitfalls of their scheme though, without all the code from the server too.
nodesocket 11y ago
Wow reset token blank worked. How in the world could their backend not check for an empty token, or even how is this validating true against the value in the database?
- curiousjorge 11y ago
  I'd expected better but it's quiet perplexing as to how they missed it.
  - XMPPwocky 11y ago
    They don't seem to have any automated or manual testing before deployment (or at least, extremely little)- for example, one recent bug was that all the prices on the store disappeared, and nobody could buy anything.
tptacek 11y ago
Take a few minutes and re-evaluate your password reset scheme. They are treacherously difficult to get right. Every pentest we did, we made a beeline for the password reset functionality; it was often a cheap, quick gameover bug.
- _asummers 11y ago
  What are some examples of ways you've seen people screw them up?
  - tptacek 11y ago
    * Not being very careful with the lifecycle of a token. * Encrypting tokens and expecting users to feed back the same encrypted token, and failing to authenticate. * Simple parse errors and SQL injection on the tokens themselves. * Exploitable generation (for instance, non-cryptographic RNGs) for the tokens themselves. * Having multi-page flows starting from the receipt and validation of a reset token, and then having standard web flaws somewhere in that flow (for instance: userid is validated only at the start of the flow). * Mishandling of cases where users have multiple outstanding reset requests. * Accepting the email address to send token to from web user, validating the address, and then using the user input directly as the email address to send the token to; as in: systems that will send token to user@real.com;attacker@evil.com. One bug everyone has in their password resets: they don't cancel outstanding tokens when users change their passwords, so that long after a user has reset their password, their email boxes still contain password-equivalent tokens. That's not a high-severity bug, but it's a meaningful one.
    - ghuntley 11y ago
      * Accepting the email address to send token to from web user, validating the address, and then using the user input directly as the email address to send the token to; as in: systems that will send token to user@real.com;attacker@evil.com. Ouch, that's really devious and extremely clever.
      - 11y ago
rdudek 11y ago
How long has this been active? Reason I ask is that I once had my account hacked many years ago, it took a few days but I got it back.
- skymt 11y ago
  Until recently Steam handled password resets through the client. The new web-based reset interface was introduced less than a month ago: http://steamcommunity.com/groups/SteamClientBeta#announcements/detail/52138466991582333 http://steamcommunity.com/groups/SteamClientBeta#announcemen... I'd assume that this bug was added then.
andrewchambers 11y ago
Does anyone know if you are liable for disclosing bugs irresponsibly?
- nness 11y ago
  You could be liable when disclosing bugs responsibly too, as some researchers have learned when investigating voting machine security.
- lawnchair_larry 11y ago
  No, mainly because there is no such thing as "irresponsibly".
tracker1 11y ago
This is why the bigger you are, the more important it is to log almost everything that you can... It sucks from one side, because it is a security risk to log potentially sensitive information, on the other hand it's critical to be able to diagnose problems in the wild. In this case, if requests for password resets are logging the codes sent (even if the error is present), they would be able to determine which accounts were affected, and return them to the appropriate registered email address (if they were changed). On the one hand, the storage and compute costs for these kinds of things suck.. but this is exactly what big table solutions are for, be they C*, ElasticSearch, Google, Azure or AWS table storage solutions. If you have more than 10K users on your system, and logging everything possible isn't routine, it should be. Access to read that log data is another issue entirely.
fivedogit 11y ago
The first thing that came to mind when I read this headline was Valve's famous structureless work environment. If there's no structure, who handles all the grunt work noboday wants to do... like security? Even if somebody is explicitly assigned to security, I'm not very confident they'd have the authority to make all these freewheeling ad hoc teams adhere to good practices.
- codexon 11y ago
  And you are correct. Bug fixes from Valve are few and far inbetween with many bugs being unpatched for years. https://github.com/ValveSoftware/Source-1-Games/issues/assigned/triage-valve https://github.com/ValveSoftware/Source-1-Games/issues/assig...
  - XMPPwocky 11y ago
    And that includes security issues; there's one notable vuln where a malicious server or custom map can execute arbitary code on clients. Reported that a few months ago, it's fixed in CS:GO and TF2, but other Valve games apparently aren't receiving fixes (Portal, Portal 2, Left 4 Dead, Left 4 Dead 2, Counter-Strike: Source, HL2DM...) And that's not to mention the folks who license the Source engine from Valve, who I'm currently trying to contact en masse and get them to fix this (and many other security-critical issues). Apparently, Valve doesn't push security patches downstream to them...
- manachar 11y ago
  Plenty of places with deeply hierarchical systems have had major security bugs.
  - jschwartzi 11y ago
    Indeed, it's less a matter of organizational style and more a matter of people in the company valuing QA enough to hire dedicated personnel, and then getting out of their way.
- PhasmaFelis 11y ago
nness 11y ago
This isn't one of those "change your passwords" moments, is it? Based on how this exploit worked, I would assume you'd already know if your account was breached and that there is no on-going risk after the fix?
- dhagz 11y ago
  I changed mine anyway; I've been meaning to change to a more secure password. I definitely think that if your account wasn't compromised, you don't need to change your password.
MichaelGG 11y ago
What a hyperbolic article. Valve will undo any damage. It's absolutely silly to think that they'd enforce a VAC ban due to abuse on their system.
- ewillbefull 11y ago
  It's a bit hyperbolic, but historically Valve have been very strict about VAC bans. If your account is hacked and someone cheats, they can get it permanently VAC banned and Valve will not negotiate or be lenient about it -- ever. I know this from experience and it's well known. In this case Valve will probably remove the VAC bans because it's such a high profile mistake on their part, but you can see why people are concerned -- especially when they haven't said anything publicly yet.
- Strom 11y ago
  This exploit was mostly used to hit Twitch streamers. People whose job involves using their Steam account. They had hours of reduced revenue due to this attack and I find it unlikely that Valve will even acknowledge any opportunity costs, let alone reimburse them.
  - MichaelGG 11y ago
    Nor should they. Is someone paying Valve for a particular SLA? I'd guess not. I was talking about stolen items and VAC and so on. As if this was a physical robbery where priceless stuff could be lost.
keypusher 11y ago
Enable Steam Guard, and it will force anyone logging in from an unrecognized device to submit a code they send you via text or email.
- hav 11y ago
  From the post: > It’s not yet clear if Steam Guard offers sufficient protection from the exploit, as there have been some reports from users claiming that their accounts have been compromised even with Steam Guard enabled. It's always good to have some kind of 2FA active, but it's unclear if it helped in this case.
  - shin_lao 11y ago
    If you get hacked from a machine your previously authenticated I guess Steam guard will not work.
ninja_to_be 11y ago
As part of one of my academic projects, I did a bit of research on password reset functionality of about a dozen major websites. It was interesting to note that each and every website had implemented it in a different manner. So much difference in the process and the lack of a standard procedure was shocking, though understandable. It was interesting to brainstorm and discuss about the rationale behind each of the password reset process and the User Experience decisions involved. I also noticed a frighteningly large number of small websites that get 'password reset' absolutely wrong, compromising their users' accounts. It is something that is very difficult to get right, unless thought through completely before implementation. Whenever I signup for a new user account on a fairly new website, I try to use a dummy throwaway password on the first attempt and then try the password reset option to see if the website is actually serious about security. It is like a litmus test for me to decide about continuing to use the website and trusting them with more of my data.
- fr0styMatt2 11y ago
  Can you give some examples of what you'd consider red flags in a site's password reset procedure? I'd be really curious; this is an area that I've thought about as a "necessary but horrible-for-security thing".
  - ninja_to_be 11y ago
    A few examples of unacceptable practices followed by certain websites include: - Sending your password to your email in plain text. - Allowing user to set new password just by answering simple personal details like DOB, Zip code etc which might be known to a number of your friends and family members. Often it is simple enough to implement a password reset functionality with a reset-link that contains a GUID which expires after a certain period of time. It could be more secure, but is a tradeoff between providing greater security and a longer reset process. One of the major risks of websites with very naive reset procedures is that many people use the same password with multiple websites. So if a user's password gets compromised on a site, then the attacker can easily try those passwords with other services and gain easy access to user data.
coherentpony 11y ago
This site raises my blood pressure; I can't view the content because of nonsense popups giving me definitions of words like "account".
- degenerate 11y ago
  No need to have a stroke. Just install ublock origin. Underline and ad-popups are gone. Done.
fr0styMatt2 11y ago
FYI Steam also has a mobile authenticator as part of the Steam app now; I remember seeing a banner for it pop up in Steam news not too long ago: https://support.steampowered.com/kb_article.php?ref=8625-WRAH-9030 https://support.steampowered.com/kb_article.php?ref=8625-WRA...
koyao 11y ago
Did Steam just go down? Maybe from the load that Hacker News is generating? https://isitup.org/store.steampowered.com https://isitup.org/store.steampowered.com store.steampowered.com seems to be down!
- Chilinot 11y ago
  Considering the ammount of people visiting the store page each summer sale (well any sale), i dont think hacker news can generate that large amount of traffic.
- orf 11y ago
  I highly doubt the HN traffic caused Steam to go down, their statistics page[1] shows how much traffic they process each hour (and it's a lot). 1. http://store.steampowered.com/stats/content/ http://store.steampowered.com/stats/content/
- noelsusman 11y ago
  It's been down off and on for the last 3-4 days.
fsiefken 11y ago
Is it advisable to change your password in this case? Is there anything other you can or should do to secure your account even though some report it is fixed?
farresito 11y ago
Now I understand how I lost my account a week ago. Not that I used it too much.
tcfunk 11y ago
How is it that I don't see anything about this exploit on any of their sites? It's not on the steam store website, not on the Valve site, and not in Valve's news feed.
Pxtl 11y ago
The big disappointment is how long it took them to acknowledge the issue. I was freaking out thinking my gmail account had been compromised. Was up into the wee hours of the morning trying to scrape log-files from my Android devices trying to figure out which one was leaking, since Google said nothing else was connected to my account. I found out because somebody on Steam forums linked me to a Reddit thread on the subject. Yeah, this is one of those "let the users know ASAP!" things.
Pxtl 11y ago
Text of the message sent to Steam users: "Dear Steam User, On July 25th we learned of a Steam bug that could have impacted the password reset process on your Steam account during the period July 21-July 25. The bug has now been fixed. To protect users, we are resetting passwords on accounts that changed passwords during that period using the account recovery wizard. You will receive an email with your new password. Once that email is received, it is recommended that you login to your account via the Steam client and set a new password. Please note that while your password was potentially modified during this period the password itself was not revealed. Also, if you had Steam Guard enabled, your account was protected from unauthorized logins even if your password was modified. We apologize for any inconvenience."
- tripzilch 11y ago
  > Please note that while your password was potentially modified during this period the password itself was not revealed. Why would you tell people this? :-) The worst that can happen is that they figure out password re-use is a bad thing, panic and change it on all those other sites they use it ;-)
Pxtl 11y ago
Dollars to donuts somebody wrote an overly-permissive NULL check. Nullity ruins everything.
xianglifei 11y ago
……

300 points by aestetix 11y ago

watbe 11y ago

The exploit has been fixed, and this video shows how easy it was to perform: https://www.youtube.com/watch?v=QPl_BJoBaVA https://www.youtube.com/watch?v=QPl_BJoBaVA TL;DW: Steam accepted blank recovery codes for password resets, enabling passwords to be changed without needing access to the recovery email account. I hope someone is writing a new test case.

baby 11y ago
This is just insane how crazy this is easy to exploit. What did the developers think?? Also for how long was this exploitable? If it was a long time, this could show that we tend to over estimate the security of our websites... (a huge amount of people took a long time to find a super easy bug)
- cookiecaper 11y ago
  There is absolutely a mess of little oversights like this in every non-trivial software project (I just fixed one not 30 minutes ago). The effects are sometimes very serious, as in this case. Cyber-warfare is scary precisely because of this. There is nothing we can do about it IMO, though things like SELinux/AppArmor and even good filesystem-level permissions help a little bit.
  - andrewchambers 11y ago
    In this particular case, the advice to avoid it is more simple. When designing test cases choose the extreme values, no text, too much text, etc.
  - deleted 11y ago
    [deleted]
  - Taek 11y ago
    There is something you can do about it, but it's expensive and different from what you are used to. Safer languages is a good place to start. Input validation can be made to be machine-verified, and anit-patterns can be learned and avoided. Static analysis tools can raise red and yellow flags. Finally, frameworks are being built for handling security critical things like account validation, crypto key handling, an related tasks that are important to get right. As the space continues to evolve, things like this will become less common, and someone who is aware of the trade and is diligent will be less likely to make mistakes.
    - LoSboccacc 11y ago
      > anit-patterns can be learned a spell checker didn't save you from a typo. not nitpicking, just using this example to illustrate a point: for an app to be secure, developers have to be 100% of the time on ball, while an attacker just has to be lucky once. the weight is so much in favor of attacker than only few of the biggest can afford to pay for a competitive level of security, it being a race: security is effective not when perfect, but when it costs more to attack a site than what you'd gain of it.
      - mdpopescu 11y ago
        Or even when the gain/cost ratio for attacking YOUR site is greater than the one for other sites. (You don't have to outrun the bear, you have to outrun the other people.)
      - ethbro 11y ago
        > a spell checker didn't save you from a typo Believe this is where parent's preference for high-quality, easy-to-use libraries handling common security operations comes from. It's a lot easier to make a typo (or logical mistake) in 250 lines of your own code than in (hopefully) <250 lines of a library invocation. Honestly, library functionality like this in any given language should be thought of as an analog to infrastructure spending. We're finally seeing reinvestment from end-users and value capturers (Facebook, Google, MS, etc) back down the chain to the OSS projects they depend on. Language guiders (and in some cases the support businesses who are attached to languages) should be equally serious about this. If your language doesn't have high-quality, easy-to-use libraries to mitigate attack surfaces, that's a fundamental weakness in your language eco-system... (Aka the "Perl+CPAN is better than a lot of more advanced languages, because code" argument)
  - weavie 11y ago
    This is precisely the sort of error that Fuzz testing should have uncovered.
    - baby 11y ago
      When you have such a huge application (steam) how can you afford to Fuzz everything? Also to setup fuzzing for every parts of your applications
  - InclinedPlane 11y ago
    There's plenty that can be done about it, but it imposes a cost that most software shops don't want to pay today, despite the enormous costs of these breaches. Formal code reviews. Longer pipelines between checkin and deployment. Penetration testing during pre-release. Better QA, both manual and automated. Better security policies in general. And so on. Making a change to security related code should trigger a process that represents and avalanche of attention. There should be a shit-ton of scrutiny on any such change. The fact that something this simple wasn't caught is indicative not that "nothing can be done" but rather that most security related code today is handled in an amateurish way by teams who barely care about the consequences of their actions.
- on_and_off 11y ago
  Writing such an exploitable code is entirely forgivable. However, I would expect such a critical module to be thoroughly unit tested. I am going to venture that it probably was not the case.
  - gauravagarwalr 11y ago
    Not exactly sure how forgivable this is. But yes, unit testing and writing a few negative scenarios would have caught this problem early on.
- Strilanc 11y ago
  They were thinking about how to make it work instead of how to make it break. Classic mistake (e.g. [1]). 1: https://www.youtube.com/watch?v=vKA4w2O61Xo https://www.youtube.com/watch?v=vKA4w2O61Xo
  - tripzilch 11y ago
    Watching that, it amazes me how many people don't get that. Not long ago there was an article on HN about this very experiment (from NY Times, IIRC). Now I can imagine, if you're not a software-tester by heart, that you'd maybe try to "win" the first or two tries, out of habit. I'm not a professional tester, just a coder, and reading the aforementioned article, I also first tried 3/6/12 and then some arbitrary increasing sequence, before catching myself and realizing if I want to figure out the rule I need some negative examples. Is this something you need to be a programmer to realize? Or maybe you need to have a "scientific" mind or something? I'm going to try this on some of my friends, see if I can figure it out. I expect a big part of it to be some psychological barrier against "failing" or getting "no" as an answer, especially if you're being put on the spot about some math-related puzzle. Many people feel uncomfortable with maths and perhaps fear giving a "wrong" answer and appearing "stupid". But "fear of maths" isn't what I'd be testing for, it's "willingness/realization to try an experiment with an (expected) negative outcome". So I'll make sure to formulate the problem in an appropriate manner, just like the guy in the video did, that the goal is to figure out the rule, not to finish the sequence. Try to make them comfortable, but not as far as saying "It's okay to ask me about a sequence that does not follow my rule", because that would obviously bias the experiment. Though I wonder now, there's some really interesting studies to be done (probably many already have been done), what if the puzzle is about some other rule for a sequence of three, that doesn't have anything to do with numbers? Say the rule is "objects of increasing size", but the (similarly misleading) example is bicycle / car / train.
    - jdmichal 11y ago
      I would think the phenomenon is basically equivalent to confirmation bias. A hypothesis is formed immediately upon seeing the question. Then, only further information which confirms their hypothesis is tested. Testing the negative is something that should be fairly routine in a scientific-testing mindset. For instance, medical experiments testing both placebos (negative) and medicine (positive) and looking for differences.
cookiecaper 11y ago
I worked on a big name project that had this same problem, which we found because users had begun exploiting it. The problem was caused when a user would intentionally prevent the recovery_code from submitting with the rest of the form, which resulted in recovery_code being nil, which resulted in "SELECT something FROM users WHERE recovery_code IS NULL AND email = targeted_email" hitting the database. This wouldn't work if you'd requested a password reset code and not yet used it, but everyone else was vulnerable. Sounds like something similar happened here. EDIT: Updated explanation of problem because I originally explained it wrong (required omission of the value on submission, not just a blank value).
- johansch 11y ago
  How did the string go from "" to nil automagically?
  - krainboltgreene 11y ago
    Bad database constraints obviously.
    - deleted 11y ago
      [deleted]
  - cookiecaper 11y ago
    I explained it incorrectly. It actually wasn't as simple as leaving the recovery code blank, because as you note, that would result in an empty string. What they did was delete the recovery_code element from the form entirely and then submit. It was a Rails project, so when the application requested params[:recovery_code], it would get back nil, since Ruby gives nil when you request a key that doesn't exist in a hash. If you left the box blank, you wouldn't hit the bug, because "" != NULL.
  - ajanuary 11y ago
    It wasn't the case here, but Oracle effectively treats empty string and null as the same value.
ars 11y ago
> Steam accepted blank recovery codes for password resets Sample buggy code (that I just made up): (user_token is user supplied token, token is the correct token) for(i = 0; i < strlen(user_token); i++) { if(user_token[i] != token[i]) return false; } return true; If code is blank this will falsely return true. This is also subject to truncation attacks. I'm trying to think of a bug where blank fails, but truncated versions do not.
- brobinson 11y ago
  Another not-so-obvious bug with your example buggy code: it's also vulnerable to timing attacks. http://codahale.com/a-lesson-in-timing-attacks/ http://codahale.com/a-lesson-in-timing-attacks/
  - tomjen3 11y ago
    True, but I don't think Steam allows you enough tries to make it viable.
  - deleted 11y ago
    [deleted]
  - kibibu 11y ago
    Also not a bug, but putting strlen() inside the loop condition makes my eyes twitch
- deleted 11y ago
  [deleted]
- jwiley 11y ago
  No idea or visibility into Steam's backend. Hope to god they are not using C for this very reason. Great for games, terrible for SAS
  - ars 11y ago
    If you wrote it like that this bug would happen in every language. There is nothing in there that is worse because of C.
deleted 11y ago
[deleted]

ekianjo 11y ago

This is what concerns me the most with Valve: you build a library of games over the years, and one day someone hijacks your account (because of improper testing on Valve's side) and you lose it or it becomes banned, and you are left with nothing but your eyes to cry. At least with GOG this would never happen (at long as you save your games locally), but the GOG catalog is way smaller than Steam's.

NamTaf 11y ago
The good thing with Valve is that although they make comically terrible mistakes like this, they know they're bad at getting stuff right and put traceable information on everything Get falsely VAC banned? They'll detect this and know exactly what happened and revert the issue. Have your account hijacked? They'll trace exactly what happens and fix it all up. Not to mention that this change triggered the standard 'you can't trade or market any games/items on your account for 7 days' block, so even when someone takes your account you don't actually lose anything. Valve makes some incredibly bad bugs in their software (games as well as Steam itself), but at least they track and trace everything so they can unwind their screw-ups.
- ekianjo 11y ago
  > Valve makes some incredibly bad bugs in their software (games as well as Steam itself), but at least they track and trace everything so they can unwind their screw-ups. Well for the recent but on Steam Linux that erased your hard drive if you moved the Steam library folder somewhere else, there was nothing they could do to "unwind their screw-ups", except fixing it in the code once the damage was done.
  - taspeotis 11y ago
    Steam on Windows has some odd behaviour too [1]. Warning: The uninstallation process deletes the folder Steam was installed to to ensure it is fully uninstalled. If you accidentally installed Steam to a folder containing other data, for example C:\Program Files\ instead of C:\Program Files\Steam\, STOP! [1] https://support.steampowered.com/kb_article.php?ref=9609-OBMP-2526 https://support.steampowered.com/kb_article.php?ref=9609-OBM...

ejcx 11y ago

One little know cool thing steam has done for a while is encrypt passwords with a RSA public key before they are sent server side. Yes, js crypto is not worth a whole lot but it is a valuable security tool to be used with TLS. There are some neat things they could be doing with this encrypted password (other than plainly decrypting it) that add a fair bit of security (no more than just a regular hash though).

codexon 11y ago
No not really. It highlights how incompetent Valve is at security. If you cannot trust the webserver or whatever is being served to you, JS crypto isn't going to do anything. They could just send you a login script that sends your unencrypted password elsewhere.
- ejcx 11y ago
  It highlights how incompetent Valve is at security. Adding one feature shows they are incompetent at security? Great real. Without more information about the scheme there's nothing to know. Whether useful or not it is still neat and can be used for benefit, but not for something TLS like.
  - codexon 11y ago
    Yes, it does. It was a complete waste of time and does nothing useful except chew more CPU cycles. This is why all the security experts say that JS crypto is useless.
    - ejcx 11y ago
      I'm not going to argue but I might as well explain some of the uses here. For example, encrypting clientside and not decrypting serverside will mean it's impossible to have a plaintext password leak in the future, which decreases risk. It also forces passive MITM to become active. Turning Eve into Mallory gives theoretical attackers much more work. There are more benefits beyond this. What you're thinking of is using this for actual password protection, which it won't provide. It can't be used as a TLS replacement. If you've actually read tptacek's big blog post about this you would notice it has to do with using js crypto being used to protect something, which this won't provide, but it can successfully be used to protect a service from itself and many other things. It's impossible to know all the details and benefits and pitfalls of their scheme though, without all the code from the server too.

nodesocket 11y ago

Wow reset token blank worked. How in the world could their backend not check for an empty token, or even how is this validating true against the value in the database?

curiousjorge 11y ago
I'd expected better but it's quiet perplexing as to how they missed it.
- XMPPwocky 11y ago
  They don't seem to have any automated or manual testing before deployment (or at least, extremely little)- for example, one recent bug was that all the prices on the store disappeared, and nobody could buy anything.

tptacek 11y ago

Take a few minutes and re-evaluate your password reset scheme. They are treacherously difficult to get right. Every pentest we did, we made a beeline for the password reset functionality; it was often a cheap, quick gameover bug.

_asummers 11y ago
What are some examples of ways you've seen people screw them up?
- tptacek 11y ago
  * Not being very careful with the lifecycle of a token. * Encrypting tokens and expecting users to feed back the same encrypted token, and failing to authenticate. * Simple parse errors and SQL injection on the tokens themselves. * Exploitable generation (for instance, non-cryptographic RNGs) for the tokens themselves. * Having multi-page flows starting from the receipt and validation of a reset token, and then having standard web flaws somewhere in that flow (for instance: userid is validated only at the start of the flow). * Mishandling of cases where users have multiple outstanding reset requests. * Accepting the email address to send token to from web user, validating the address, and then using the user input directly as the email address to send the token to; as in: systems that will send token to user@real.com;attacker@evil.com. One bug everyone has in their password resets: they don't cancel outstanding tokens when users change their passwords, so that long after a user has reset their password, their email boxes still contain password-equivalent tokens. That's not a high-severity bug, but it's a meaningful one.
  - ghuntley 11y ago
    * Accepting the email address to send token to from web user, validating the address, and then using the user input directly as the email address to send the token to; as in: systems that will send token to user@real.com;attacker@evil.com. Ouch, that's really devious and extremely clever.
    - 11y ago

rdudek 11y ago

How long has this been active? Reason I ask is that I once had my account hacked many years ago, it took a few days but I got it back.

skymt 11y ago
Until recently Steam handled password resets through the client. The new web-based reset interface was introduced less than a month ago: http://steamcommunity.com/groups/SteamClientBeta#announcements/detail/52138466991582333 http://steamcommunity.com/groups/SteamClientBeta#announcemen... I'd assume that this bug was added then.

andrewchambers 11y ago

Does anyone know if you are liable for disclosing bugs irresponsibly?

nness 11y ago
You could be liable when disclosing bugs responsibly too, as some researchers have learned when investigating voting machine security.
lawnchair_larry 11y ago
No, mainly because there is no such thing as "irresponsibly".

tracker1 11y ago

This is why the bigger you are, the more important it is to log almost everything that you can... It sucks from one side, because it is a security risk to log potentially sensitive information, on the other hand it's critical to be able to diagnose problems in the wild. In this case, if requests for password resets are logging the codes sent (even if the error is present), they would be able to determine which accounts were affected, and return them to the appropriate registered email address (if they were changed). On the one hand, the storage and compute costs for these kinds of things suck.. but this is exactly what big table solutions are for, be they C*, ElasticSearch, Google, Azure or AWS table storage solutions. If you have more than 10K users on your system, and logging everything possible isn't routine, it should be. Access to read that log data is another issue entirely.

fivedogit 11y ago

The first thing that came to mind when I read this headline was Valve's famous structureless work environment. If there's no structure, who handles all the grunt work noboday wants to do... like security? Even if somebody is explicitly assigned to security, I'm not very confident they'd have the authority to make all these freewheeling ad hoc teams adhere to good practices.

codexon 11y ago
And you are correct. Bug fixes from Valve are few and far inbetween with many bugs being unpatched for years. https://github.com/ValveSoftware/Source-1-Games/issues/assigned/triage-valve https://github.com/ValveSoftware/Source-1-Games/issues/assig...
- XMPPwocky 11y ago
  And that includes security issues; there's one notable vuln where a malicious server or custom map can execute arbitary code on clients. Reported that a few months ago, it's fixed in CS:GO and TF2, but other Valve games apparently aren't receiving fixes (Portal, Portal 2, Left 4 Dead, Left 4 Dead 2, Counter-Strike: Source, HL2DM...) And that's not to mention the folks who license the Source engine from Valve, who I'm currently trying to contact en masse and get them to fix this (and many other security-critical issues). Apparently, Valve doesn't push security patches downstream to them...
manachar 11y ago
Plenty of places with deeply hierarchical systems have had major security bugs.
- jschwartzi 11y ago
  Indeed, it's less a matter of organizational style and more a matter of people in the company valuing QA enough to hire dedicated personnel, and then getting out of their way.
PhasmaFelis 11y ago

nness 11y ago

This isn't one of those "change your passwords" moments, is it? Based on how this exploit worked, I would assume you'd already know if your account was breached and that there is no on-going risk after the fix?

dhagz 11y ago
I changed mine anyway; I've been meaning to change to a more secure password. I definitely think that if your account wasn't compromised, you don't need to change your password.

MichaelGG 11y ago

What a hyperbolic article. Valve will undo any damage. It's absolutely silly to think that they'd enforce a VAC ban due to abuse on their system.

ewillbefull 11y ago
It's a bit hyperbolic, but historically Valve have been very strict about VAC bans. If your account is hacked and someone cheats, they can get it permanently VAC banned and Valve will not negotiate or be lenient about it -- ever. I know this from experience and it's well known. In this case Valve will probably remove the VAC bans because it's such a high profile mistake on their part, but you can see why people are concerned -- especially when they haven't said anything publicly yet.
Strom 11y ago
This exploit was mostly used to hit Twitch streamers. People whose job involves using their Steam account. They had hours of reduced revenue due to this attack and I find it unlikely that Valve will even acknowledge any opportunity costs, let alone reimburse them.
- MichaelGG 11y ago
  Nor should they. Is someone paying Valve for a particular SLA? I'd guess not. I was talking about stolen items and VAC and so on. As if this was a physical robbery where priceless stuff could be lost.

keypusher 11y ago

Enable Steam Guard, and it will force anyone logging in from an unrecognized device to submit a code they send you via text or email.

hav 11y ago
From the post: > It’s not yet clear if Steam Guard offers sufficient protection from the exploit, as there have been some reports from users claiming that their accounts have been compromised even with Steam Guard enabled. It's always good to have some kind of 2FA active, but it's unclear if it helped in this case.
- shin_lao 11y ago
  If you get hacked from a machine your previously authenticated I guess Steam guard will not work.

ninja_to_be 11y ago

As part of one of my academic projects, I did a bit of research on password reset functionality of about a dozen major websites. It was interesting to note that each and every website had implemented it in a different manner. So much difference in the process and the lack of a standard procedure was shocking, though understandable. It was interesting to brainstorm and discuss about the rationale behind each of the password reset process and the User Experience decisions involved. I also noticed a frighteningly large number of small websites that get 'password reset' absolutely wrong, compromising their users' accounts. It is something that is very difficult to get right, unless thought through completely before implementation. Whenever I signup for a new user account on a fairly new website, I try to use a dummy throwaway password on the first attempt and then try the password reset option to see if the website is actually serious about security. It is like a litmus test for me to decide about continuing to use the website and trusting them with more of my data.

fr0styMatt2 11y ago
Can you give some examples of what you'd consider red flags in a site's password reset procedure? I'd be really curious; this is an area that I've thought about as a "necessary but horrible-for-security thing".
- ninja_to_be 11y ago
  A few examples of unacceptable practices followed by certain websites include: - Sending your password to your email in plain text. - Allowing user to set new password just by answering simple personal details like DOB, Zip code etc which might be known to a number of your friends and family members. Often it is simple enough to implement a password reset functionality with a reset-link that contains a GUID which expires after a certain period of time. It could be more secure, but is a tradeoff between providing greater security and a longer reset process. One of the major risks of websites with very naive reset procedures is that many people use the same password with multiple websites. So if a user's password gets compromised on a site, then the attacker can easily try those passwords with other services and gain easy access to user data.

coherentpony 11y ago

This site raises my blood pressure; I can't view the content because of nonsense popups giving me definitions of words like "account".

degenerate 11y ago
No need to have a stroke. Just install ublock origin. Underline and ad-popups are gone. Done.

fr0styMatt2 11y ago

FYI Steam also has a mobile authenticator as part of the Steam app now; I remember seeing a banner for it pop up in Steam news not too long ago: https://support.steampowered.com/kb_article.php?ref=8625-WRAH-9030 https://support.steampowered.com/kb_article.php?ref=8625-WRA...

koyao 11y ago

Did Steam just go down? Maybe from the load that Hacker News is generating? https://isitup.org/store.steampowered.com https://isitup.org/store.steampowered.com store.steampowered.com seems to be down!

Chilinot 11y ago
Considering the ammount of people visiting the store page each summer sale (well any sale), i dont think hacker news can generate that large amount of traffic.
orf 11y ago
I highly doubt the HN traffic caused Steam to go down, their statistics page[1] shows how much traffic they process each hour (and it's a lot). 1. http://store.steampowered.com/stats/content/ http://store.steampowered.com/stats/content/
noelsusman 11y ago
It's been down off and on for the last 3-4 days.

fsiefken 11y ago

Is it advisable to change your password in this case? Is there anything other you can or should do to secure your account even though some report it is fixed?

farresito 11y ago

Now I understand how I lost my account a week ago. Not that I used it too much.

tcfunk 11y ago

How is it that I don't see anything about this exploit on any of their sites? It's not on the steam store website, not on the Valve site, and not in Valve's news feed.

Pxtl 11y ago

The big disappointment is how long it took them to acknowledge the issue. I was freaking out thinking my gmail account had been compromised. Was up into the wee hours of the morning trying to scrape log-files from my Android devices trying to figure out which one was leaking, since Google said nothing else was connected to my account. I found out because somebody on Steam forums linked me to a Reddit thread on the subject. Yeah, this is one of those "let the users know ASAP!" things.

Pxtl 11y ago

Text of the message sent to Steam users: "Dear Steam User, On July 25th we learned of a Steam bug that could have impacted the password reset process on your Steam account during the period July 21-July 25. The bug has now been fixed. To protect users, we are resetting passwords on accounts that changed passwords during that period using the account recovery wizard. You will receive an email with your new password. Once that email is received, it is recommended that you login to your account via the Steam client and set a new password. Please note that while your password was potentially modified during this period the password itself was not revealed. Also, if you had Steam Guard enabled, your account was protected from unauthorized logins even if your password was modified. We apologize for any inconvenience."

tripzilch 11y ago
> Please note that while your password was potentially modified during this period the password itself was not revealed. Why would you tell people this? :-) The worst that can happen is that they figure out password re-use is a bad thing, panic and change it on all those other sites they use it ;-)

Pxtl 11y ago

Dollars to donuts somebody wrote an overly-permissive NULL check. Nullity ruins everything.

xianglifei 11y ago

……