"Watch Paint Dry - The Game" or "How to troll Steam's security holes"


Unfortunately pretty much every web app on this planet is similarly full of holes. This is a direct consequence of people believing that copying bits from tutorials makes them a developer even if they don't understand the underlying technology.
 
I won't be that harsh, even for good developers it's pretty hard to have perfect security.
It's already difficult enough to have basic security on big projects with short deadlines (and managers who don't understand the need to spend precious man hours on security stuff that isn't visible to the end-user), and even worse once you start having requirements for features that, while convenient for some people, greatly increase the security risks.
 
"Convenience vs security" you say. I am one of those sick individuals that does seemingly pointless complicated tasks in my spare time to expand my knowledge and experience. I guess that can't happen during work hours, and most people don't want to spend their time off doing things like that. Maybe it is more about money earned and saved. The problem there is one little mistake could cost you all of it.
 
I wonder how many people downloaded it before it was taken down, and if "Steam account for sale with Watch Paint Dry" will start showing up :p
 
It's not only "convenience vs security", it's also the problem of the cost of security, and the threat models.
As you write, one little mistake could cost you all, but that doesn't mean that you need to spend all to protect you from it. If a security problem can cost you a million but the time it would take to fix it could be used to develop a feature that's worth two millions, then fixing the security problem is not worth the cost.

Also when talking about computer security too many people point out the vulns, but they rarely come with threat models and risk assessment, and without these, the vuln doesn't mean much. A lack of lock on a door is a vulnerability, but it's only a problem if there's a risk if the door is left unlocked and it's only worth putting a lock if the cost of the risk is bigger than the cost of putting the lock.
 
I won't be that harsh, even for good developers it's pretty hard to have perfect security.
This wasn't even a web 1.0 style attack/hole though - it was web 0.9 at best. Passing authentication data about using hidden fields or GET arguments with no check on the server is my first website levels of dumb IMO.
 
I agree that it's a pretty basic attack and that any decent web developer should have taken the necessary steps to avoid it without even thinking about it.
However, we don't know how that code was born and how it evolved into this form. It could have been just a quick and dirty PoC someone did to show how the system could work, and then:

Boss: "ok, looks good push it to prod"
Developer: "Err, it's just a very early proof of concept, it's not meant for..."
Sales: "We've already announced the launch of the service, if you don't put it live we'll lose millions."
Manager : "Don't worry, we'll review and fix it ASAP"
Developer: "Ok, let me just fix the..."
Manager : "Don't touch the production code, silly! You want to break down everything?!"
[One day after]
Developer : "So I've got this patch ready and..."
Manager: "Is it about the new feature we need to release today? If not, I'm not interested, we're already late."

I'm not saying that's the case here, but the example above isn't uncommon and people are quick to blame the developer even though it's not necessarily his fault.
 
While this is an extremely basic attack, I can kinda understand how this may have been overlooked.
Back in the day when the Steamworks backend was written, everyone who had a login was a big name and kinda trustable . At least way more trustable compared to most people who can get their stuff on Steam nowadays. It isn't exactly the first thing you spontaneously try to look for vulnerabilities in when there are much bigger attack surfaces with potential higher financial consequences around (Steam Market and inventories for example).
 
I won't be that harsh, even for good developers it's pretty hard to have perfect security.
It's already difficult enough to have basic security on big projects with short deadlines (and managers who don't understand the need to spend precious man hours on security stuff that isn't visible to the end-user), and even worse once you start having requirements for features that, while convenient for some people, greatly increase the security risks.

I don't know whether you have read anything related to this incident like for example my first link.
The interesting thing about this is, that he has
been trying to report to Valve for the past few months — the ability to get any game you want on Steam, without Valve ever even having a look at it
and they completely ignored him until he posted his "game".

If someone tells you about a severe security flaw in your system, you shouldn't completey ignore him but that's how Steam "works".
 
Many business work like this and don't act on vulnerability reports until they're used or exposed.
Sometimes, it's bad practice, sometimes it's not.

Many big software projects have thousands of issue tickets open at all times. Some of them are critical stuff, some of them are typos on a screen that only 0.001% of the users will ever see, and even less will notice. Security problems are part of these tickets. Some of them are critical and must be fixed ASAP, others are just potential annoyance.

This one seems like it could be more of the latter: until it has been used, it's not a big problem. If it gets used, Valve still has the ability to remove the game. If it's used for a small thing that gets only a dozen download, then it's not a very big deal. If it was malicious, Steam can either point to somewhere in its ToS where it says that they're not responsible for that kind of stuff, or they can refund the users. If it's a big thing that's getting a whole lot of downloads, the should probably be able to notice it quickly and be able to pull the plug early and do damage control.

Meanwhile, there might have been hundred of far more dangerous vulnerabilities, stuff that could let attackers steal user's credit card numbers, stuff that could let attacker add malicious code inside someone else's game, stuff that could let attackers steal accounts, etc.

How can you be sure that while they were busy not fixing that one issue, they were not fixing something far more dangerous that we have not heard about because they actually fixed it?
 
But that is still not the point. The point was, that any halfway decent developer *never* would have created such a stupid mistake. It isn't faster or cheaper in any way, it's just wrong (adding security later is much more expensive, it simply is the single most important architectural aspect of any web application). That this happens at a company that actually sells software and related services (and not e.g. on a personal homepage) is really really sad (unfortunately not unexpected).

My experience while beeing an assistent at the university indicates that a large part of the problem are socially challenged students that think they are cool, because they have modded their phone following a detailed step by step guide, scaring away the actually intelligent students. Some don't want to hear it, but AFAICT a large part of the former are white male gamers while the latter typically prefer science to games and are often female. Unfortunately it is commonly believed that computer science is about electronic gadgets and some kind of advanced schooling in Windows/Android usage.

edit: A good indication of a bad developer is one that constantly complains about his tools (computer, programming language, frameworks, ide, etc.), but never admits mistakes. Every developer constantly makes lots of mistakes, because development is difficult. Tools don't help much, adequate (project specific) architecture and open mindedness are the ways to make making mistakes less easy resp. finding and fixing them easier.
 
Last edited:
[...]a large part of the problem are socially challenged students that think they are cool, because they have modded their phone following a detailed step by step guide, scaring away the actually intelligent students. Some don't want to hear it, but AFAICT a large part of the former are white male gamers while the latter typically prefer science to games and are often female. Unfortunately it is commonly believed that computer science is about electronic gadgets and some kind of advanced schooling in Windows/Android usage.
Ahh the tale of the stupid white boy. Racist and sexist remarks are cool as long as they are aimed at a certain direction, right?
 
Ahh the tale of the stupid white boy. Racist and sexist remarks are cool as long as they are aimed at a certain direction, right?
Perhaps it is racist and sexist, but so is the world, and that description seems pretty accurate to me. The problem isn't pointing out what often happens, but claiming that such statements are sexist/racist and ignoring it. I tried to help with that a little, unfortunately you can't just snap your fingers and make the attitude of the students better. The younger guys (and some of the older guys) push away many students in various ways, and when hands are tied about what can be done, everyone just has to accept it. Since I wasn't a paid employee I had a lot more freedom in interacting with other students than instructors and professors did. That still didn't stop some male students from scaring off many female students through sexual harassment (and nearly sexual assault at times) and following them around giving them a hard time, or by treating the women as inferior or just generally bad. Luckily there were some older female students who would also call these people out when they were doing it, but those of us who care and will do something about it can't be everywhere.

If you want to call out racism and sexism, make sure you are pointing at the people doing it, not the people identifying it.
 
As far as I have heard there's a similar lack of female students and employees in the sciences, as there tends to be in computing jobs. So I personally doubt the description of the world is accurate.
 
@Klumpen When there is strong documented evidence to support the claim it isn't a genralization (even tech companies have identified and are trying to change this stuff). Trying to raise the flag on people stating what they witnessed is also not a generalization. This is far from the anti-Muslim stuff you post here, and in fact, this is the same stance I took on that. Now I guess I am an apologist for something else, huh? Since it is white males should we ignore the things that would be unacceptable if they were done by others?

If you want generalizations, the average woman that stuck with the classes I helped out in had a better grasp of the concepts and how to do things than the average man. Also, older people were typically more dedicated to it and spent more time working on things, and had a better understanding of how to do things, and where to find information. What, ageism too? If that's how you want to look at it, go for it.

As far as I have heard there's a similar lack of female students and employees in the sciences, as there tends to be in computing jobs. So I personally doubt the description of the world is accurate.
In genral I think you are right (uh oh, I making generalizations again) that women are not as interested in certain fields. From some I have talked at length to about this topic, some are interested, but feel it is "not their place", which suggests a possible larger cultural attitude (be that family, their schools, the country, the western world, humans, Terrans, the Milk Way, whatever) beyond just how that individual feels. I know a bunch of women around the US that work in IT, and several have said that, in their experience, sexism is present in their workplace and in IT (based on interacting with people outside their company, going to conferences, etc). The one thing I don't remember them saying is that sexism isn't a problem. Yes, this is a two way street, but to say that some or many people aren't sexist in this field is ignoring what is plainly there (or what has been cleverly faked). I guess the only way to find out for sure is to ask women in those jobs some questions, and to test the waters with those involved in education and employment for those positions. Also, you need to take a look at the work environments (as in, are they hostile towards certain people, and if so, why).
 
Back
Top