An interesting piece of info this week as there was apparently a bug in Steam’s system that could grant you access to every game managed by Valve. And when we say every game, we mean EVERY game. The exploit allowed people access to essentially get free game codes out of the marketplace whenever they wanted if they knew where to look and how to get it. Like finding loose change in the sofa, only the change was $60 a pop for every free game they could snag. Unfortunately for you would be hackers, a researcher named Artem Moskowsky did the right thing and reported it to Valve, which they rewarded by paying the man $20,000. A quick snippet from The Register about the exploit.
“This bug was discovered randomly during the exploration of the functionality of a web application,” Moskowsky explained. “It could have been used by any attacker who had access to the portal.”
Essentially, anyone who had an account on the developer portal would be able to access the game activation keys for any other game Steam hosted, and sell or distribute them for pirates to use to play games from Steam. Fetching from the
/partnercdkeys/assignkeys/API with a zero key count returned a huge bunch of activation keys.
“To exploit the vulnerability, it was necessary to make only one request,” Moskowsky told El Reg. “I managed to bypass the verification of ownership of the game by changing only one parameter. After that, I could enter any ID into another parameter and get any set of keys.”
There’s no official report as to how many Steam keys were lost due to the exploit, but knowing Valve, they probably have a way to trace all interactions now that they know the source.
- Valve is Putting an End to Steam Link Hardware
- Valve is Hosting a Preview Tournament for Artifact Tomorrow
- Valve Pushes the Artifact Beta Into November
- Valve Removes Over 170 "Trolling" Games From Steam's Library
- Counter Strike: Global Offensive is Going Free-to-Play
- Valve Brings their Virtual TCG Artifact to PAX West
- Valve is Apparently Launching Its Own Streaming Channel Called Stream TV
- YouTube Channel “Super Best Friends” Ending After Internal Issues - December 16, 2018
- Street Fighter V: Arcade Edition Welcomes a New Fighter with Kage - December 16, 2018
- Electronic Arts Releases a New Anthem Trailer With a Hint of Story - December 16, 2018
- Tetsuya Nomura Issues Twitter Statement on Kingdom Hearts III Leak - December 16, 2018
- Macaulay Culkin Visits the Angry Video Game Nerd for Christmas - December 16, 2018