Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researcher banned on Valve's bug bounty program publishes second Steam 0-day

zdnet.com

Post reply on HN
Print view View original

181–190 of 214 posts

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#181

Post by StavrosK »

ntw1103 wrote: post #146
StavrosK wrote: post #119

Earlier quoted context omitted.

That's why GOG.com is my first choice. They even provide a nice Steam-like installer (unfortunately, no Linux version of the installer), while letting you download your games DRM-free, archivable and standalone.

Not all of the games on GOG are DRM-free at this point. Some require GOGGalaxy, their version of the steam client. I went through a frustrating refund process after learning about this after making a purchase.

Really? That sucks, DRM-free has been their major selling point from the start. Why was the process frustrating and which game was it?

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#182

Post by skocznymroczny »

ChuckMcM wrote: post #3

This story continues to be so sad. Steam is reprising the role of Adobe who, for quite a while, refused to acknowledge that being able to use FlashPlayer as a tool to get you something on Windows was just as bad as breaking FlashPlayer. I heard one Adobe executive say, "Hey you can use a baseball bat to bludgeon someone but that isn't the bat maker's fault is it? If they are forced to make foam bats their product is…

Well, that's the issue with DRMs. I never went into the Steam ecosystem because I don't like dependencies, but most people have no choice and have to use Steam if they want to access their game libraries.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#183

Post by robertony »

kop316 wrote: post #73
daeken wrote: post #70

Earlier quoted context omitted.

H1 itself has no WONTFIX status, FYI. A bug that's not considered to be a bug by the program will either be closed N/A or informative. Ultimately, disclosures are handled and controlled by the program, not by H1; this is both a good and bad thing (and I say that as both a HackerOne employee and a hacker on the platform -- it's a complicated issue from both sides).

It's complicated on both sides means there is politics involved. Being blunt, that sounds like a cop out to me. This sounds to me like an edge case that H1 should address if it really wants to be taken seriously.

You're probably outside the security sphere, but H1 is already taken seriously. There is no per-requisit for them to do so to be taken seriously as you state.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#184

Post by e_proxus »

yellowapple wrote: post #123
tfha wrote: post #69

Earlier quoted context omitted.

At some point this is less of a steam issue and more of a Windows issue. An OS shouldn't allow applications to compromise eachother. Steam should maybe be liable if they are actively thwarting disclosure that would protect users but that's a tough thing to establish legally.

It's a Steam issue, given that background services don't have to run as SYSTEM, and yet Valve decided to have Steam's background service do precisely that. Thankfully, the Linux version doesn't seem to have this problem (AFAICT).

I think it should become a Windows/Microsoft issue, to be honest. A good example is the recent Zoom vulnerability, the software made it possible to perform certain exploits on the user and operating system, so Apple stepped in and disabled the exploit. In this case, I think Microsoft should do the same in order to protect their users. My guess would be that the install base of Steam on Windows is as least on par with Zoom on macOS, if not many times larger.

In the end, Microsoft will get bad reputation for having an insecure OS (not to even mention Valve here, and in the long run it will hurt them as same as it did Adobe with their Flash stubbornness).

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#185

Post by numismatex »

daeken wrote: post #70
Mindless2112 wrote: post #57

Earlier quoted context omitted.

Frankly, I think HackerOne deserves a bit of blame for that. Any WONTFIX ought to be made public automatically unless there are extenuating circumstances (like the vulnerability being reported against the wrong product).

H1 itself has no WONTFIX status, FYI. A bug that's not considered to be a bug by the program will either be closed N/A or informative. Ultimately, disclosures are handled and controlled by the program, not by H1; this is both a good and bad thing (and I say that as both a HackerOne employee and a hacker on the platform -- it's a complicated issue from both sides).

It's a cop-out, and it's because you're biased.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#186

Post by numismatex »

daeken wrote: post #78
kop316 wrote: post #73

Earlier quoted context omitted.

It's complicated on both sides means there is politics involved. Being blunt, that sounds like a cop out to me. This sounds to me like an edge case that H1 should address if it really wants to be taken seriously.

There is definitely politics involved, but not H1 internal. The issue is that every program handles disclosure itself, so H1 itself doesn't really have the power. That could be changed at a policy level, but I'm not sure that'll happen (or should happen, honestly; I don't really know where I land on it).

Power or not, a company line is a company line.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#187

Post by antisemiotic »

MarkSweep wrote: post #55
bogwog wrote: post #15

From what I've read, the original bug involved malware already installed on the PC using the Steam client to run other code. While I'm not a security expert in any way, that doesn't seem to me like a huge exploit. If the attack requires installing malware on the victim's computer, why not just do the evil stuff directly with that malware? If that's the case and I'm not just remembering it wrong, then I could see why…

From Microsoft's perspective, they consider local privilege elevation on a client computer an "important" vulnerability that requires patching and paying a bug bounty: https://msrc-blog.microsoft.com/2018/09/10/microsoft-securit... So some companies consider LPE to be serious.

If Microsoft considered privilege escalation to be serious, they wouldn't have Windows setup a single privileged account on a fresh install. Or at the very least, they wouldn't make it necessary to jump through two hidden hoops to make a separate admin account without (a) a Microsoft profile and (b) without "secure questions" misfeature.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#188

Post by freeflight »

ssully wrote: post #50

I wonder if this is a product of Valve's free-form company structure. If as a Valve employee, you have the autonomy to float between projects, how do you maintain a strong security team? Do they even have a dedicate security team?

> Do they even have a dedicate security team?

Let's remember that Valve is the oldest there is in a business they pretty much pioneered with Steam over 15 years ago.

As somebody who's had an account there since day 1, I'm still amazed by how tight they've managed to keep their ship for all these years, even tho plenty of people have been trying to break into that very worthwhile target for over a decade.

If I contrast that to my experiences with services like Uplay, and Origin, then those differences are like night&day, because with both my accounts on these services I had lot's of issues due to my accounts getting hijacked (probably trough support) several times.

In 15+ years of using Steam, this hasn't happened once to me, so whatever Valve is doing at that end, it seems to have worked well for them and their customers.

That's not meant to defend their stance on this particular issue, but imho it's also kinda dishonest to now frame Valve as a company where nobody cares about security.

If that'd be really the case then they would have gone out of business over a decade ago.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#189

Post by kop316 »

daeken wrote: post #78
kop316 wrote: post #73

Earlier quoted context omitted.

It's complicated on both sides means there is politics involved. Being blunt, that sounds like a cop out to me. This sounds to me like an edge case that H1 should address if it really wants to be taken seriously.

There is definitely politics involved, but not H1 internal. The issue is that every program handles disclosure itself, so H1 itself doesn't really have the power. That could be changed at a policy level, but I'm not sure that'll happen (or should happen, honestly; I don't really know where I land on it).

From what I see, your value proposition is both to bug bounty hunters and to companies who see a value in having Hackerone manage their bug bounty program.

This effect (no matter the cause) of incident is about the worst thing that could happen to a company whose value proposition is that. It's like the bad old days where companies would legally threaten you if you found a bug, and from an outside perspective, Hackerone seems to promote it.

If I were an ethical hacker, I'd think twice before using your bug bounty program for fear of that treatment.

If I were a potential customer (or even a current customer), I don't know if I'd want to be associated with a company that tolerates veiled threats against ethical hackers.

Edit: I should add from this, it actually looks like its Hackerone making the veiled legal threat: https://mobile.twitter.com/enigma0x3/status/1160961861560479...

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#190

Post by kop316 »

robertony wrote: post #183
kop316 wrote: post #73

Earlier quoted context omitted.

It's complicated on both sides means there is politics involved. Being blunt, that sounds like a cop out to me. This sounds to me like an edge case that H1 should address if it really wants to be taken seriously.

You're probably outside the security sphere, but H1 is already taken seriously. There is no per-requisit for them to do so to be taken seriously as you state.

I'm not sure if you realize this, but your response comes off as gatekeeping.
Post reply on HN