Atredis Partners, an information security research and consulting firm, released the results of its investigation into a vulnerability in Steam on October 28.
Vulnerabilities in Inter-Device Communication
In this investigation, security researcher Bryan Alexander and his team examined the security of Steam and reported discovering two issues related to “remote code execution” and four issues related to “local privilege escalation.” They present the issues confirmed in a Windows environment and the results of their proof-of-concept tests.
The remote code execution vulnerability—which allows an attacker to execute a program on a target PC from a separate PC—was discovered in the communication process between Steam clients logged in under the same account. The report explains that there were flaws in the handling of messages notifying users of changes to download schedules and messages notifying users of game installation and update status, respectively.
The attack requires that the attacker be able to manipulate a client authenticated with the same Steam account as the target. Under these conditions, Alexander and his team combined these vulnerabilities with another bug that causes information leaks, demonstrating “zero-click” code execution—which requires no additional action from the target user, such as clicking a link or opening a file.
Meanwhile, local privilege escalation involves fraudulently obtaining privileges—such as administrator rights—that the user does not normally possess on their PC. This investigation reported issues such as the exploitation of game installation script processing to execute programs with SYSTEM privileges.
According to Alexander, all of these issues have already been reported through Valve’s HackerOne program. The details made public are either issues that have already been fixed or those for which the disclosure window (the period before public disclosure) has expired.
The remote code execution demonstrated in this instance does not allow for indiscriminate targeting of unspecified PCs from the outside; rather, it requires that the user be “logged into the same Steam account.”Therefore, while the risk of an immediate attack by a third party in a typical usage environment is considered low (and the issues have already been reported to Valve), given the recent frequency of cyberattacks and data breaches, this remains a cause for concern—not just in this specific case.
