How a hacker snuck a game onto Steam without Valve’s knowledge

"Watch paint dry" exploited now-patched Steamworks vulnerability.

Read the whole story

 

[MisterGrumps]

GabeSaidItWasOKtoSellTheGame=1

 

[Nowicki]

Ooh thats one sexy looking game

 

[snowman<ca>]

Nowicki[/url]":2dcj7x67]Ooh thats one sexy looking game

I have played games that look worse

 

[paranoidkitten]

Always did wonder how some games got approved...

 

[GaryFisken]

Why is Ruby referred to as she throughout the article? Quite sure it's a guy. https://www.linkedin.com/in/rubymeow

 

[Aurich]

I was waiting for the VR version anyways.

 

[THavoc]

I give them bonus points for quickly patching the flaws that have been found.

 

[Madlyb]

The missing part of the news...

"Within 5 hours of publishing the game, it had received a MetaCritic score of 57 and Valve had discounted it to $1.99 for the deal of the day and Ruby had to declare bankruptcy and go back to his day job of writing Excel macros."

:^)

 

[Mortus]

Complete! Paint dried in 1:32:42. You can apply another coat for only 45 gems! For additional colors, please visit our Color Store.

 

[bthylafh]

Painter's hat now available for Team Fortress 2.

 

[Ragnarredbeard]

So, no game review?

 

[mogbert]

Still more stable then Batman Arkham Knight and Assassin's Creed Unity.

Origin because I have to, Steam because I can.

 

[Old_Fogie_Late_Bloomer]

Aurich[/url]":1m6vxpvs]I was waiting for the VR version anyways.

Comes with VOC-emitting scratch and sniff stickers for the underside of your headset to really complete the experience.

 

[Devin]

This must be a spiritual sequel to Myst.

 

[puppies]

Aurich[/url]":144tqz9n]I was waiting for the VR version anyways.

Before they solve the issue of nausea? No thank you!

 

[THavoc]

puppies[/url]":wsfivdo4]

Aurich[/url]":wsfivdo4]I was waiting for the VR version anyways.

Before they solve the issue of nausea? No thank you!

I thought they did by adding an artificial nose? At least that's what I remember from reading a past Ars article.

 

[Genetix]

Still easier then Greenlight?

 

[Christarp]

This is why incrementing numbers on ID's are a security vulnerability

 

[Quiet Desperation]

Requires always on Internet for fresh coats.

 

[Nulls]

I am just wondering when will the Gawker or Vox editorials come out complaining that there is only 1 color of paint and using it as an example of what is wrong with the video game industry and people who play games.

Maybe it could be in a trope video as an example of over representation of semi-gloss paint in games and not enough representation of matte and eggshell...

Ok enough jokes, serious though I would rather watch paint dry than play some of the games on the steam store.

 

[Sixclaws]

puppies[/url]":u6eiftsh]

Aurich[/url]":u6eiftsh]I was waiting for the VR version anyways.

Before they solve the issue of nausea? No thank you!

It's a feature that allows to you feel what happens when you inhale paint fumes for too long.

 

[Relique]

To be honest, I was getting a pretty bad frame rate in the game. At times I wasn't sure if the game froze or nothing was happening.

 

[Carewolf]

Well, I have seen visual novels on Steam less interactive, and they got away with pretending to be games.

 

[LrdDimwit]

Christarp[/url]":q9l7kbvx]This is why incrementing numbers on ID's are a security vulnerability

Among other vulnerabilities in this process, yes.

How did passing in said account ID result in the system creating a session as that user? Previously, he was logged in as a developer, not a Steam admin. That right there is a privilege escalation vulnerability.

That's at least two things that need to be fixed. Accounts need to be re-created with non-sequential account IDs, and this fraudulent session impersonation vulnerability needs to be fixed.

 

[ZippyPeanut]

Relique[/url]":y5e2dq6y]To be honest, I was getting a pretty bad frame rate in the game. At times I wasn't sure if the game froze or nothing was happening.

Probably your system specs. Minimum specs require a 980 paired with an i7-5960x.

 

[SiberX]

LrdDimwit[/url]":iqmhvqfm]

Christarp[/url]":iqmhvqfm]This is why incrementing numbers on ID's are a security vulnerability

Among other vulnerabilities in this process, yes.

How did passing in said account ID result in the system creating a session as that user? Previously, he was logged in as a developer, not a Steam admin. That right there is a privilege escalation vulnerability.

That's at least two things that need to be fixed. Accounts need to be re-created with non-sequential account IDs, and this fraudulent session impersonation vulnerability needs to be fixed.

The vulnerability was a bit different than was described in the article; modifying the session id revealed the other ID numbers for the drop-down containing the release game state (they were normally hidden from a user who didn't have rights to trigger that state),.

Once they got the correct ID value for Released (5, in this case), they just force-ran the AJAX query with that value and it wasn't checking the return values to confirm that the user in question (after having switched back to a valid session ID) had the necessary permissions for that state.

tl,dr: It didn't create a session as the other user, but it did reveal something nearly as bad (which is that the ReleaseGame AJAX call wasn't making a proper server-side permissions check and was relying on the client front-end for validation).

 

[Kyle Orland]

GaryFisken[/url]":3bsjibt1]Why is Ruby referred to as she throughout the article? Quite sure it's a guy. https://www.linkedin.com/in/rubymeow

Derp. Fixed.

In penance, I'm going to never use the bathroom in North Carolina.

 

[noanoxan]

Kyle Orland[/url]":ckvo9v9l]

GaryFisken[/url]":ckvo9v9l]Why is Ruby referred to as she throughout the article? Quite sure it's a guy. https://www.linkedin.com/in/rubymeow

Derp. Fixed.

In penance, I'm going to never use the bathroom in North Carolina.

Is it penance if it's beneficial?

 

[Tiernoc]

Right? That's like saying your penance will be to avoid truck stops in New Jersey .. hardly a punishment

 

[THavoc]

noanoxan[/url]":38xekhtu]

Kyle Orland[/url]":38xekhtu]

GaryFisken[/url]":38xekhtu]Why is Ruby referred to as she throughout the article? Quite sure it's a guy. https://www.linkedin.com/in/rubymeow

Derp. Fixed.

In penance, I'm going to never use the bathroom in North Carolina.

Is it penance if it's beneficial?

I'm worried what will happen if he's in NC for a week.

That can't be good for his health.

 

[BitSmash]

Wait, what? When I saw that on the Steam Store, I assumed it was an early April Fool's joke. I guess I was sort of right. It just turned out that the people at Valve were the fools.

 

[xXxSqueakxXx]

I tested it with my oculus sniff VR nose, and got it to work after patching my wunderbaum drivers.
I am sad to report that I am disappointed, red paint smells exactly the same as blue paint. /s

 

[ampet]

THavoc[/url]":8d4fw28u]

noanoxan[/url]":8d4fw28u]

Kyle Orland[/url]":8d4fw28u]

GaryFisken[/url]":8d4fw28u]Why is Ruby referred to as she throughout the article? Quite sure it's a guy. https://www.linkedin.com/in/rubymeow

Derp. Fixed.

In penance, I'm going to never use the bathroom in North Carolina.

Is it penance if it's beneficial?

I'm worried what will happen if he's in NC for a week.

That can't be good for his health.

Personally, I have something against, well, number two's when I'm travelling. (You know, the comfort of your own crapper...).

At the end of a 3 or 4-day holiday, I usually end up producing Nibbler's dark matter. Too bad my car won't run on it.

 

[Darkness1231]

GaryFisken[/url]":36ra3zuq]Why is Ruby referred to as she throughout the article? Quite sure it's a guy. https://www.linkedin.com/in/rubymeow

Orange is the New Black is most likely reason why, specifically Ruby Rose.

 

[Urethramancer]

Adriano Petrosillo[/url]":24zpiyy3]
At the end of a 3 or 4-day holiday, I usually end up producing Nibbler's dark matter. Too bad my car won't run on it.

Not driving a hybrid, I see.

 

[Wolfie0827]

Actually, "watch Paint Dry" is what those of us waiting for Half-Life 2 Episode 3 have been doing for years!

 

[contrasia]

I'm shocked it wasn't pulled for pornographic content. I heard it described as a painters wet dream by many individuals!

 

[tgx]

I wonder if this game has smell-o-vision support?

http://www.extremetech.com/extreme/1520 ... l-accuracy