Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researcher banned on Valve's bug bounty program publishes second Steam 0-day

zdnet.com

Post reply on HN
Print view View original

131–140 of 214 posts

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#131

Post by mark-r »

yorwba wrote: post #64
cwkoss wrote: post #49

Earlier quoted context omitted.

I submitted an XSS on the tesla website to hackerone, it was marked as a duplicate. A week later, shared it with an XSS mailing list and got an angry email from HackerOne soon after. Public disclosure violates the terms of their reporting program EVEN if they reject your report. I'm really curious how much of what is reported to HackerOne ever gets and actual patch. It kind of seems like there are bunch of known vuln…

> HackerOne should start requiring companies pay researchers for duplicates That would create a perverse incentive for researchers to tell their friends about the vulnerability so that they can resubmit it and also get a bounty. The problem could be solved on the side of the researchers by splitting the bounty among all submissions of the same bug, but anyone else with access to the report (employees of either Hacker…

Obligatory Dilbert: https://dilbert.com/strip/1995-11-13

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#132

Post by hraedon »

EnFinlay wrote: post #127
hraedon wrote: post #106

Earlier quoted context omitted.

I don't know how many people care about the ban, per se, but Valve's strategy here is an extremely bad and pointless one. Was Valve technically within their rights to ban this researcher? Sure. Was it a move that advanced Valve's interests in any way? Obviously not.

I'm having trouble articulating this, so bear with me. In general, having a Bug Bounty program is good. We can agree on that, right? Most Bug Bounty programs have a scope, and staying inside the scope is important to the business for reasons . My guess is that most scopes are defined by a combination of confidence in the security of the code, resources to triage vulnerabilities in that part of the code, and the risk…

Exclusions from a bug bounty are a part of the game, but if something is excluded, you—as the entity excluding it—can't reasonably demand secrecy re: an out of scope bug. You either accept that you're going to eat a reputational hit (and likely be forced to fix the exploit anyway) or make an exception to your policy.

If Valve wanted to try and defend the structure of their bug bounty program by essentially arguing that Steam is such a mess that local privilege escalations are out of bounds, they should be forced to publicly reckon with that stance.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#133

Post by bscphil »

babuskov wrote: post #91
stOneskull wrote: post #44

They're arrogant and lazy. Just say thank you and fix it. I hope GOG and HumbleBundle get a nice boost in sales.

> I hope GOG and HumbleBundle get a nice boost in sales. While there are some DRM-free games, majority of games on HumbleBundle are sold as Steam keys, so you still need Steam to launch them.

I seem to recall the HB site, in the early days, saying something to the effect of "Our promise: 100% DRM free games". They even did a bunch of bundles that donated part of the proceeds to the EFF. It's sad to see them as just another front for Steam sales.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#134

Post by soraminazuki »

EnFinlay wrote: post #127
hraedon wrote: post #106

Earlier quoted context omitted.

I don't know how many people care about the ban, per se, but Valve's strategy here is an extremely bad and pointless one. Was Valve technically within their rights to ban this researcher? Sure. Was it a move that advanced Valve's interests in any way? Obviously not.

I'm having trouble articulating this, so bear with me. In general, having a Bug Bounty program is good. We can agree on that, right? Most Bug Bounty programs have a scope, and staying inside the scope is important to the business for reasons . My guess is that most scopes are defined by a combination of confidence in the security of the code, resources to triage vulnerabilities in that part of the code, and the risk…

Valve is free to define their own scope, but as a user, I'd expect them to place a big fat warning if it means any user on the system with Steam installed could get root. Their currently defined scope goes against user expectations of security.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#135

Post by driverdan »

bscphil wrote: post #133
babuskov wrote: post #91

Earlier quoted context omitted.

> I hope GOG and HumbleBundle get a nice boost in sales. While there are some DRM-free games, majority of games on HumbleBundle are sold as Steam keys, so you still need Steam to launch them.

I seem to recall the HB site, in the early days, saying something to the effect of "Our promise: 100% DRM free games". They even did a bunch of bundles that donated part of the proceeds to the EFF. It's sad to see them as just another front for Steam sales.

They're owned by Ziff Davis. It's not surprising.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#136

Post by caconym_ »

zelon88 wrote: post #46
tzakrajs wrote: post #43

Valve figured out how to print money by hooking teenagers with gambling on loot boxes. They stopped having to create AAA titles, they stopped having to do anything remotely creative, and now they are a giant cancer with no value left to add. Their client is an insecure, slow, instable piece of shit and has been this way for well over a decade. I regret being a customer of theirs.

I remember listening to some of their commentary tracks where the employees talk about how their desks had wheels, there's no managers, and there's no deadlines and no stress. They also at one time had higher profit per employee than Google! [1] Turns out that all along having no accountability in your company would result in complacency and a critical lack of production. I'm curious to see how Valve Software as a co…

I heard somewhere it's very stressful, toxic politics and so on. Not sure where but it's interesting to see a report to the contrary.

Personally I always thought it would be cool to work at Valve, but not anymore. I don't see them doing anything broadly relevant that doesn't involve coasting on the momentum/market share of ancient products. Their VR stuff is cool, but even there it feel like they're lagging behind e.g. Oculus in ways that matter.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#137

Post by Mtinie »

Karunamon wrote: post #121
cprecioso wrote: post #112

Earlier quoted context omitted.

Steam's DRM (CEG) customizes the executables so it won't play without the Steam client running and logged in to the correct account. There are lots of not-DRM-enabled games on Steam, but they're decidedly in the minority.

There are a number of tools called “steamworks emulators” that allow one to bypass this outright for many games. These are generally seen as piracy tools, but there’s no good reason you couldn’t use them when you wanted to play your purchased game collection without DRM. Be a bit careful when experimenting, though. You may run into problems syncing your cloud saves for some games if/when you go back to the official c…

Now you've swapped one attack surface for another (of a dubious origin).

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#138

Post by ChrisSD »

chupasaurus wrote: post #124
ChrisSD wrote: post #102

Earlier quoted context omitted.

Disable the Steam service. Run Steam only on a separate user session with limited rights (no admin and no access to your files). So essentially you'd have to manually switch user, via the login screen, to play your games.

You've missed "Install Steam somewhere inside separate user's home directory" to not dealing with UAC on each update. I moved to separate Wintendo box which is the best solution.

As far as I'm aware, Steam makes its own folder writeable by everybody. Besides, you should get an error instead of the UAC if you're running as a non-admin account.

But yes, separate hardware is safer.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#139

Post by peterkelly »

thethirdone wrote: post #94
poizan42 wrote: post #83

Earlier quoted context omitted.

Not if they haven't granted access to the files to you. In fact by default the files in a user's home folder (including Documents, Videos etc.) are inaccessible to other (non-privileged) users on Windows.

If they have physical access, then they don't need to boot into Windows. They could boot from a flashdrive and access any files they want.

That won't help in the case of full-disk encryption.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#140

Post by [deleted] »

hraedon wrote: post #132
EnFinlay wrote: post #127

Earlier quoted context omitted.

I'm having trouble articulating this, so bear with me. In general, having a Bug Bounty program is good. We can agree on that, right? Most Bug Bounty programs have a scope, and staying inside the scope is important to the business for reasons . My guess is that most scopes are defined by a combination of confidence in the security of the code, resources to triage vulnerabilities in that part of the code, and the risk…

Exclusions from a bug bounty are a part of the game, but if something is excluded, you—as the entity excluding it—can't reasonably demand secrecy re: an out of scope bug. You either accept that you're going to eat a reputational hit (and likely be forced to fix the exploit anyway) or make an exception to your policy. If Valve wanted to try and defend the structure of their bug bounty program by essentially arguing th…

[deleted]
Post reply on HN