Browse
Category
DiscussionsOff Topic

Valve Patched Massive Vulnerability in Steam (that was there for 10+ years)

Open
Jack2Shepard

that was there for 10+ years! :
http://www.guru3d.com/news-story/valve-patched-massive-vulnerability-in-steam-(that-was-there-for-10-years).html

P.S : The most terrifying launch of a calculator app ever seen.

5 years ago

Comment has been collapsed.

4 Comments
Pietruszek

Hmm, I wonder if it's connected to the "they disabled my Steam Guard and stole my Steam account" issue. Over the last year I've heard about two different people who had this happen to them.

5 years ago
Permalink

Comment has been collapsed.
madjoki

It's very likely that it has never been abused in wild.

They would still need to capture your connection to Steam first (eg. hacking your ISP, modem, etc.) to able to abuse this.
If they already can listen on your connection, being able to crash Steam isn't your biggest problem.

Simply UDP spoofing might be possible depending on ISP but:

"In order for an attacker’s UDP packets to be accepted by the client, they must observe an outbound (client->server) datagram being sent in order to learn the client/server IDs of the connection along with the sequence number."

If your connection is secure, they can do nothing. If your connection isn't secure, you're already fucked up in other ways.

5 years ago
Permalink

Comment has been collapsed.

Deleted

This comment was deleted 11 months ago.

5 years ago
Permalink

Comment has been collapsed.
TheKarmoCR

And that's why you never setup a program to "Launch as an Administrator" if that program doesn't have a valid reason to do so.

I cringe every time someone suggests to do that when some software or game doesn't launch otherwise. If this ever went live, and people had Steam set up to "launch as an administrator" because X or Y game didn't work otherwise, an attacker could possibly have done anything they wanted on the remote machine. Anything.

5 years ago
Permalink

Comment has been collapsed.

Sign in through Steam to add a comment.