Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researcher banned on Valve's bug bounty program publishes second Steam 0-day

zdnet.com

Post reply on HN
Print view View original

101–110 of 214 posts

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#101

Post by thefifthsetpin »

xigency wrote: post #96
CraftThatBlock wrote: post #90

Earlier quoted context omitted.

A normal process goes like this: - Researcher finds bug - Researcher discloses to vendor - Vendor fixes (or not) - Researcher discloses bug publically once vendor has fixed, or after X time (whichever is first) This is roughly how Project Zero goes, and it's a good mix between giving the vendor the opportinity to fix it and deploy the update before it gets exploited. It's very naive to assume that bugs can be fixed b…

Why is it whichever is first and not after a fixed time? I see a benefit to waiting X time regardless, because it allows more time for the patch to circulate to everyone. What is the benefit to disclosing it immediately after it is "fixed"?

It's generally not possible to release a fix without effectively disclosing the vulnerability. It's just too easy for people to deduce what the vulnerability was by looking at the patch.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#102

Post by ChrisSD »

burk96 wrote: post #72
jessaustin wrote: post #14

Earlier quoted context omitted.

Knowledgeable people can just add Steam to the set of applications that must be installed in its own isolated environment. How would the typical Steam user know to do that? Is there a prominent warning on the install screen informing users that Steam will be used to hack their machine and anything they have stored on it?

How would one achieve this on Windows short of having the entire Windows install be isolated from your main OS? I would assume most users would not want to run their games in a VM inside Windows for performance reasons.

Disable the Steam service. Run Steam only on a separate user session with limited rights (no admin and no access to your files). So essentially you'd have to manually switch user, via the login screen, to play your games.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#103

Post by jay_kyburz »

abtinf wrote: post #98
babuskov wrote: post #89

Earlier quoted context omitted.

If you don't need it, why did you have it installed in the first place?

I love games and can’t play my steam collection now. But if I have to give that up so that some silly bug elsewhere in my system doesn’t expose me to a ransomware attack (or worse), so be it. I’ll find another way.

You should be able to play games in your steam library. Just open your Steam\steamapps\common\ folder and find the exe for the game you want to play.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#105

Post by zelon88 »

thethirdone wrote: post #94
poizan42 wrote: post #83

Earlier quoted context omitted.

Not if they haven't granted access to the files to you. In fact by default the files in a user's home folder (including Documents, Videos etc.) are inaccessible to other (non-privileged) users on Windows.

If they have physical access, then they don't need to boot into Windows. They could boot from a flashdrive and access any files they want.

This is true, and also why I lock down my BIOSs and set the OS as the only boot device. TRK is a bootable portable linux specifically for resetting and unlocking local admin accounts.

Encryption, however, cannot be broken without your credentials. These can be obtained from default running instance of Windows with Mimikatz if the admin credentials are still in memory from an earlier session.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#106

Post by hraedon »

EnFinlay wrote: post #86
scarejunba wrote: post #75

Earlier quoted context omitted.

What's the point of stating these obvious tautologies? Yes, they have that right, he has the right to post on Twitter, someone has the right to post that on HN, we have the right to call Valve out, you have the right to defend Valve, we have the right to reply to your defence, and so on ad inf. All true and utterly worthless to point out.

I'm not trying to defend Valve, I'm just surprised that everyone seems to be so upset about the ban.

I don't know how many people care about the ban, per se, but Valve's strategy here is an extremely bad and pointless one.

Was Valve technically within their rights to ban this researcher? Sure. Was it a move that advanced Valve's interests in any way? Obviously not.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#107

Post by jay_kyburz »

yorwba wrote: post #64
cwkoss wrote: post #49

Earlier quoted context omitted.

I submitted an XSS on the tesla website to hackerone, it was marked as a duplicate. A week later, shared it with an XSS mailing list and got an angry email from HackerOne soon after. Public disclosure violates the terms of their reporting program EVEN if they reject your report. I'm really curious how much of what is reported to HackerOne ever gets and actual patch. It kind of seems like there are bunch of known vuln…

> HackerOne should start requiring companies pay researchers for duplicates That would create a perverse incentive for researchers to tell their friends about the vulnerability so that they can resubmit it and also get a bounty. The problem could be solved on the side of the researchers by splitting the bounty among all submissions of the same bug, but anyone else with access to the report (employees of either Hacker…

I like your first idea of splitting the bounty. I think its unlikely employees of HackerOne or the relevant company would risk their job for a small share in a bug bounty.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#108

Post by dmix »

vorpalhex wrote: post #28
fortran77 wrote: post #10

Earlier quoted context omitted.

You're beating a dead horse. Flash served a purpose once, and now it's reached end-of-life.

> You're beating a dead horse With a foam bat. Just because the flash horse is dead doesn't mean it didn't deserve it's beating or can't continue to be a potent reminder of how bad Adobe was at handling security issues and why other platforms, like Steam, should learn instead of emulate.

This also has nothing to do with Flash specifically, rather as you said Adobe's policy. It could have been any software but especially for Flash.

Flash was just such a unique special target, ala PDFs and Microsoft word, there were few wide open targets from which a hacker could predictably get the user to open (whether embedded or not) on a targets machine. So it was particularly sensitive to vulnerabilities by design, where a much broader security perspective was clearly needed than most software.

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#109

Post by jay_kyburz »

jupp0r wrote: post #68
c3534l wrote: post #47

I see this as an example where the system works. Valve has an incentive to pay for bugs. The researcher than has an incentive to disclose them privately. If Valve doesn't pay fairly, the bug is disclosed, Valve pays the price and is forced to fix it, and be running a scam of a bug bounty program, they've exposed themselves to more disclosures. Valve now has an incentive to fix their program either by working with thi…

The meta-process might work, Valve's process is still broken.

Everybody makes mistakes, lets see if they can learn from theirs. I haven't heard that they keep making this same mistake (but I could be wrong.)

Re: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

#110

Post by thethirdone »

zelon88 wrote: post #105
thethirdone wrote: post #94

Earlier quoted context omitted.

If they have physical access, then they don't need to boot into Windows. They could boot from a flashdrive and access any files they want.

This is true, and also why I lock down my BIOSs and set the OS as the only boot device. TRK is a bootable portable linux specifically for resetting and unlocking local admin accounts. Encryption, however, cannot be broken without your credentials. These can be obtained from default running instance of Windows with Mimikatz if the admin credentials are still in memory from an earlier session.

Yeah, there are definitely ways of securing versus someone with physical access, but I expect most machines with a non-sandboxed steam installed probably don't have them.

This privilege escalation attack is probably never going to be used if the attacker has physical access.

Post reply on HN