Widely-publicized Steam Invite hack has been fixed

News
By published

Reverse-engineering group Secret Club has announced the patch, but other problems go unfixed.

Early last week a non-profit group dedicated to software reverse-engineering publicly announced that a dangerous exploit it had found in the Steam backend had gone unfixed for nearly two years, and worse, Valve was allegedly attempting to prevent them from publicly disclosing its existence. The exploit, involving Steam Invites, allegedly allowed a hacker to gain full control of a victim's system via a remote code execution.

White-hat hacker and software reverse-engineer communities often find exploits in software and report those discreetly to companies. They're often paid for that work through so-called "bug bounty" programs and organizations like HackerOne, however in this case the bounty program was widely perceived as a shield that let the exploit go unfixed: If the good guy discloses the bug they found publicly to try and get it fixed, the reward is put at risk.

The original finder of the exploit has confirmed the fix and says Valve has provided them with permission to disclose details. They are working on a detailed technical writeup for release in the future.

Public concern has now moved to other alleged Source Engine exploits reported by Secret Club which have gone unfixed. These include a Team Fortress 2 community server exploit and two separate CS:GO RCE exploits.

Update: A Valve rep clarified via email that the issue was specifically with the Source Engine, and not Steam. "We made a number of updates last week to address the issue, and responded to the HackerOne report," the rep said. "We believe the issue is resolved and continue to monitor the situation."

Jonathan Bolding
Contributor

Jon Bolding is a games writer and critic with an extensive background in strategy games. When he's not on his PC, he can be found playing every tabletop game under the sun.