Researcher banned on Valve's bug bounty program publishes second Steam 0-day

Post by awirth » Thu, Aug 22, 2019, 2:07 AM UTC

tptacek wrote: post #143

chris_wot wrote: post #85

Earlier quoted context omitted.

H1 could make it a proviso if using their service that rejected but reports are automatically disclosed.

1. The overwhelming majority of rejected H1 reports are garbage. 2. It is not the case that all reporters want their findings disclosed publicly, even if they're rejected. 3. Reporters already retain the right to publish findings however they'd like. The worst H1 or a client can do is kick you off the platform. 4. A bug bounty platform that mandated disclosure of any sort would lose all its customers to the platform…

Post by tptacek » Thu, Aug 22, 2019, 2:13 AM UTC

awirth wrote: post #151

tptacek wrote: post #143

Earlier quoted context omitted.

1. The overwhelming majority of rejected H1 reports are garbage. 2. It is not the case that all reporters want their findings disclosed publicly, even if they're rejected. 3. Reporters already retain the right to publish findings however they'd like. The worst H1 or a client can do is kick you off the platform. 4. A bug bounty platform that mandated disclosure of any sort would lose all its customers to the platform…

"The worst H1 or a client can do is kick you off the platform." As a hacker on hackerone, this is not my understanding of the relationship. Generally speaking the programs give you "authorized access" under the CFAA conditional on following the disclosure guidelines . I don't know about for other countries, but for the US I'm pretty sure this means that breaking the guidelines means you've retroactively committed a f…

Post by busterarm » Thu, Aug 22, 2019, 2:17 AM UTC

awirth wrote: post #151

tptacek wrote: post #143

Earlier quoted context omitted.

1. The overwhelming majority of rejected H1 reports are garbage. 2. It is not the case that all reporters want their findings disclosed publicly, even if they're rejected. 3. Reporters already retain the right to publish findings however they'd like. The worst H1 or a client can do is kick you off the platform. 4. A bug bounty platform that mandated disclosure of any sort would lose all its customers to the platform…

"The worst H1 or a client can do is kick you off the platform." As a hacker on hackerone, this is not my understanding of the relationship. Generally speaking the programs give you "authorized access" under the CFAA conditional on following the disclosure guidelines . I don't know about for other countries, but for the US I'm pretty sure this means that breaking the guidelines means you've retroactively committed a f…

Post by babuskov » Thu, Aug 22, 2019, 2:32 AM UTC

rileymat2 wrote: post #19

bogwog wrote: post #15

From what I've read, the original bug involved malware already installed on the PC using the Steam client to run other code. While I'm not a security expert in any way, that doesn't seem to me like a huge exploit. If the attack requires installing malware on the victim's computer, why not just do the evil stuff directly with that malware? If that's the case and I'm not just remembering it wrong, then I could see why…

> Kravets did eventually publish details about the Steam zero-day, which was an elevation of privilege (also known as a local privilege escalation) bug that allowed other apps or malware on a user's computer to abuse the Steam client to run code with admin rights. No, using this 0-day malware, with lower privilege level, could do stuff it could not do.

Post by codedokode » Thu, Aug 22, 2019, 2:54 AM UTC

umvi wrote: post #152

batatati wrote: post #150

Maybe it is also time to switch from the prehistoric model of "hey let's download a .exe on the web, execute it without any sandbox, and let that .exe install other .exe from thousands of other unknown sources around the world and run them without any sandbox either." Steam or any other app should always run sandboxed with no root access, no file access, no camera access, no access to other process, etc. For most use…

Won't sandboxes impact performance of video games? I don't know much about sandboxes except that VMs are often used as sandboxes, and I definitely don't want video games running inside of VMs