Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gamers beware: malicious wallpapers on Steam found stealing accounts

securelist.com

Post reply on HN
Print view View original

11–20 of 28 posts

Re: Gamers beware: malicious wallpapers on Steam found stealing accounts

#11

Post by nosioptar »

wnevets wrote: post #9
beart wrote: post #2

So this vulnerability isn't directly the result of using Steam, or any of the Steam profile customizations, such as avatars and profile page backgrounds. But rather, it is a vulnerability in a third-party application "Wallpaper Engine" which is available on Steam. I recall when screen savers were a common malware vector on Windows. I suppose everything old is new again.

Why do you need an "Engine" for wallpapers in the first place?

Opensuse (pre 11 iirc) used to have a really cool background where the lighting changed throughout the day, that probably used an engine of some sort.

Re: Gamers beware: malicious wallpapers on Steam found stealing accounts

#12

Post by gchamonlive »

fckgw wrote: post #7
beart wrote: post #2

So this vulnerability isn't directly the result of using Steam, or any of the Steam profile customizations, such as avatars and profile page backgrounds. But rather, it is a vulnerability in a third-party application "Wallpaper Engine" which is available on Steam. I recall when screen savers were a common malware vector on Windows. I suppose everything old is new again.

The malicious wallpapers, which use "Wallpaper Engine" are also published through Steam Workshop. It's still a Steam problem.

Irrelevant comment, op said "this vulnerability isn't directly the result of using Steam", not that steam doesn't share responsibility

Re: Gamers beware: malicious wallpapers on Steam found stealing accounts

#13

Post by wxw »

> The whole concept of “application wallpapers” essentially allows foreign code to be run directly on your computer. Cybercriminals took note of this feature and started embedding malware right into these types of wallpapers.

> Because Wallpaper Engine relies on Steam Workshop for content sharing, anyone can create a wallpaper and publish it for the community to download and install for free.

RIP

Re: Gamers beware: malicious wallpapers on Steam found stealing accounts

#14

Post by wongarsu »

wnevets wrote: post #9
beart wrote: post #2

So this vulnerability isn't directly the result of using Steam, or any of the Steam profile customizations, such as avatars and profile page backgrounds. But rather, it is a vulnerability in a third-party application "Wallpaper Engine" which is available on Steam. I recall when screen savers were a common malware vector on Windows. I suppose everything old is new again.

Why do you need an "Engine" for wallpapers in the first place?

Because they are not static images. That's the whole gimmick

Re: Gamers beware: malicious wallpapers on Steam found stealing accounts

#15

Post by jerf »

mrguyorama wrote: post #10
jerf wrote: post #6

Earlier quoted context omitted.

Sexual arousal also tends to inhibit rational thought. I don't mean that in a snarky or sarcastic way, I mean that it is a biological process that has been well-studied and well-established [1]. This has obvious uses for scamming people and doing other things that their executive function might normally catch and prevent. This is also why sexual imagery should generally be kept out of public spaces, not because of "p…

>This is also why sexual imagery should generally be kept out of public spaces, not because of "puritanism" but because it just generally isn't a good idea to go around letting bad actors inhibiting people's executive function willy-nilly Okay but presumeably humans adapt to the level of "sexuality" around them to some degree (like they do nearly every other stimulus), because otherwise you could show less prude cult…

I cited my sources. You're welcome to seek out studies on the question of how it varies between societies, they probably exist somewhere. However as part of the "adaptation" you cite is precisely scammers getting better at scamming people, this isn't something we should treat casually.

It's not as if it's news or anything. "Sex sells" isn't a new phrase. But I think most people assume it's just because it's ambiently appealing, the fact that it also objectively lowers rational barriers to buying what is being sold is less well understood and changes the question from just a matter of appeal to one of psychological abusiveness.

That's how I've come to see it; that sexy chick (sexist language chosen advisedly) on the billboard isn't just a company nicely providing me a beautiful thing to look at for no reason at all, it's an attack on my executive function. It's an incredibly hostile thing to do and should be treated as such.

Re: Gamers beware: malicious wallpapers on Steam found stealing accounts

#16

Post by vel0city »

mrguyorama wrote: post #10
jerf wrote: post #6

Earlier quoted context omitted.

Sexual arousal also tends to inhibit rational thought. I don't mean that in a snarky or sarcastic way, I mean that it is a biological process that has been well-studied and well-established [1]. This has obvious uses for scamming people and doing other things that their executive function might normally catch and prevent. This is also why sexual imagery should generally be kept out of public spaces, not because of "p…

>This is also why sexual imagery should generally be kept out of public spaces, not because of "puritanism" but because it just generally isn't a good idea to go around letting bad actors inhibiting people's executive function willy-nilly Okay but presumeably humans adapt to the level of "sexuality" around them to some degree (like they do nearly every other stimulus), because otherwise you could show less prude cult…

Note the above commenter specifically used the language "sexual imagery" and not "nudity". As you point out, what can be considered "sexual imagery" can vary somewhat based on the cultural norms of the society.

Re: Gamers beware: malicious wallpapers on Steam found stealing accounts

#17

Post by jjmarr »

wnevets wrote: post #9
beart wrote: post #2

So this vulnerability isn't directly the result of using Steam, or any of the Steam profile customizations, such as avatars and profile page backgrounds. But rather, it is a vulnerability in a third-party application "Wallpaper Engine" which is available on Steam. I recall when screen savers were a common malware vector on Windows. I suppose everything old is new again.

Why do you need an "Engine" for wallpapers in the first place?

So you can have an animated or interactive "wallpaper". The malicious wallpapers in the OP are hentai games.

Re: Gamers beware: malicious wallpapers on Steam found stealing accounts

#18

Post by wccrawford »

gchamonlive wrote: post #12
fckgw wrote: post #7

Earlier quoted context omitted.

The malicious wallpapers, which use "Wallpaper Engine" are also published through Steam Workshop. It's still a Steam problem.

Irrelevant comment, op said "this vulnerability isn't directly the result of using Steam", not that steam doesn't share responsibility

It said they are "on Steam" which is true. They are distributed through the Steam Workshop, which Valve runs and attempts to protect from abuse.

While it's not as high-profile as the official profile backgrounds and avatars, it's still in an area that most gamers would think was safe by default, since Valve moderates it.

Re: Gamers beware: malicious wallpapers on Steam found stealing accounts

#19

Post by some_random »

wnevets wrote: post #9
beart wrote: post #2

So this vulnerability isn't directly the result of using Steam, or any of the Steam profile customizations, such as avatars and profile page backgrounds. But rather, it is a vulnerability in a third-party application "Wallpaper Engine" which is available on Steam. I recall when screen savers were a common malware vector on Windows. I suppose everything old is new again.

Why do you need an "Engine" for wallpapers in the first place?

Because it's one of the only ways to get porn in China

Re: Gamers beware: malicious wallpapers on Steam found stealing accounts

#20

Post by _--__--__ »

wnevets wrote: post #9
beart wrote: post #2

So this vulnerability isn't directly the result of using Steam, or any of the Steam profile customizations, such as avatars and profile page backgrounds. But rather, it is a vulnerability in a third-party application "Wallpaper Engine" which is available on Steam. I recall when screen savers were a common malware vector on Windows. I suppose everything old is new again.

Why do you need an "Engine" for wallpapers in the first place?

The 'wallpapers' in question are pirated games made in renpy (python game engine) or rpgmaker (js based), which makes them a really good vector for malware. As another commenter noted this is a bizarrely common way for Chinese people to get porn through the great firewall.
Post reply on HN