Researcher Uses Valve Security Bug To Upload Paint Drying Game On Steam (softpedia.com) 48
An anonymous reader writes: A security researcher found two bypasses in Valve's game review process that eventually allowed him to publish Steam Trading Cards and a full game on the Steam Store called "Watch Paint Dry" (reference to this case from last month involving the British film censors). The game was supposed to be an April Fools' Day prank, but the researcher forgot to set a release date, and [the game] was published on the Steam Store last weekend. Valve has fixed the security bypass in the meantime. These bypasses were extremely dangerous since they allowed anyone to publish games on the Store (possibly containing malware) without a Valve employee ever taking a look at them, or knowing they went through the review process.
Damnit! (Score:5, Funny)
Another Windows-only game!
Re: (Score:2)
Is there a modern "game maker" for old-style SCUMM games? I.E. something that will output game data that can be run on the various SCUMM emulators out there?
Re: (Score:1)
Re: (Score:2)
I'm specifically asking for something that will output SCUMM-compatible data so the game isn't platform-dependant. I DO NOT WANT something that will output a useless Windows executable file.
Re:Damnit! (Score:4, Informative)
According to http://wiki.scummvm.org/index.... [scummvm.org] the best way to go about it is to pick an engine that ScummVM supports (SCI, AGI, or Wintermute 2D) and make a game for that engine.
There's links for each:
http://wiki.scummvm.org/index.... [scummvm.org]
http://wiki.scummvm.org/index.... [scummvm.org]
http://wiki.scummvm.org/index.... [scummvm.org]
Re: (Score:2)
+5 informative, thank you.
Re: (Score:2)
Re:On the bright side. (Score:5, Funny)
However a $500 video card could be used as a paint dryer
Zero-day (Score:2)
Re: (Score:1)
Re: (Score:1)
This is more impressive than a zero-day exploit. It's a negative-three-day exploit!
Re: (Score:3)
My job description... (Score:2)
Re: (Score:2)
Just what we needed... another IT training app.
Consider yourself lucky; they haven't painted the walls of my office since I got here 8 years ago. All that eggshell, and I didn't even get to watch it dry.
Re: (Score:2)
Consider yourself lucky; they haven't painted the walls of my office since I got here 8 years ago.
My current job is government IT on a large campus. I can't turn around a corner without running into a "paint drying" sign. Painters are always busy around here.
Re: (Score:2)
Sigh (Score:4, Insightful)
Sigh.
Validate untrusted data. Don't just rely on a "1" in a form field somewhere to say something is okay.
I mean... seriously, Valve. I was quite impressed that - as yet - still NOTHING came of your "compromise" where the encrypted credit card database of Steam services was stolen, which means you DID IT RIGHT where countless others couldn't.
But, seriously? A form field for validation? For God's sake.
Re: (Score:1)
Better than the time you could reset anyone's password by leaving the email confirmation code empty. Valve has a pretty lousy track record with regard to security, especially over the last year.
Re: (Score:2)
Your argument does not change anything about the flaw in Valve's password reset system. The system should be a fool proof. If it is not a fool proof, then Valve should have made it clear what should be used and what not. If Valve didn't mention anything about it, then it is still Valve's fault regardless how dumb users are.
And it has positive reviews! (Score:2)
(alright, maybe they are all sarcastic but still)
He should have submitted it through normal means, who knows how many people would buy it...
Researchers use valve to let off steam. (Score:2)
Entropy (Score:2)
a walk through on how it was done (Score:4, Informative)
Well that's better than (Score:2)
Paint Drying? Humm that's gotta be better than Civilization Beyond Earth
Re: (Score:2)
I like turn based strategy. I don't have the attention span or reflexes for RTSes any more. Of course I waited for Civ: BE to be on a fairly steep discount, but I quite liked it.
Considering the level of tech support (Score:1)
Steam really needs to move away from the "foll your desk" to the "Hire some bosses" because there's no one choosing to work on stuff like testing and tech support.
I can't get to the store in their steam client, and i've been ignored for over a month and a half now in the tech support ticket.
So the lack of security is no surprise.
If anyone would be cool about this its Valve but.. (Score:2)
Re: (Score:2)
"Review process" (Score:1)
Come on, now. We all know they don't have one.
Interesting Game (Score:1)
It looks like an interesting game, and it looks like it might have a broad base of interested customers.
That is based on what I saw when I loaded the game's page on Steam. Two of the games Steam says are "More like this" are:
Stardew Valley
and
Fallout 4.
Those are rather dissimilar games, for anybody who watches the gaming scene.
I can't wait for the award winning sequel... (Score:1)
Re: I can't wait for the award winning sequel... (Score:2)
Oculus was sort of right (Score:1)