Guru3D.com
  • HOME
  • NEWS
    • Channels
    • Archive
  • DOWNLOADS
    • New Downloads
    • Categories
    • Archive
  • GAME REVIEWS
  • ARTICLES
    • Rig of the Month
    • Join ROTM
    • PC Buyers Guide
    • Guru3D VGA Charts
    • Editorials
    • Dated content
  • HARDWARE REVIEWS
    • Videocards
    • Processors
    • Audio
    • Motherboards
    • Memory and Flash
    • SSD Storage
    • Chassis
    • Media Players
    • Power Supply
    • Laptop and Mobile
    • Smartphone
    • Networking
    • Keyboard Mouse
    • Cooling
    • Search articles
    • Knowledgebase
    • More Categories
  • FORUMS
  • NEWSLETTER
  • CONTACT

New Reviews
Guru3D Rig of the Month - February 2021
ASUS GeForce RTX 3060 STRIX Gaming OC review
EVGA GeForce RTX 3060 XC Gaming review
MSI GeForce RTX 3060 Gaming X TRIO review
PALIT GeForce RTX 3060 DUAL OC review
ZOTAC GeForce RTX 3060 AMP WHITE review
Fractal Design Meshify 2 Compact chassis review
Sabrent Rocket 4 PLUS 2TB NVMe SSD review
MSI Radeon RX 6900 XT GAMING X TRIO review
Guru3D Q1 Winter 20/21 PC Buyer Guide

New Downloads
Media Player Classic - Home Cinema v1.9.10 Download
GeForce 461.72 WHQL driver download
AIDA64 Download Version 6.32.5640 beta
CrystalDiskInfo 8.11.2 Download
AMD Radeon Adrenalin Edition 21.2.3 driver download
GPU-Z Download v2.37.0
Intel HD graphics Driver Download Version: DCH27.20.100.9313
HWiNFO Download v6.43 - 4380 Beta
AMD Radeon Adrenalin Edition 21.2.2 driver download
3DMark Download v2.17.7137 + Time Spy


New Forum Topics
GeForce 461.72 WHQL drivers: download & discussion Nvidia and dithering controls..how to enable? Brand new to all this, just picked up a 3070 strix and I have a couple questions Need help with HPET AMD Radeon RX 6700 XT is a yes, 6700 is a no ... Radeon Pro win10 Who needs a 3080 if you can get GeForce Now.. Free to Grab: Black Desert Online on Steam NASA Perseverance rover 200 MHZ CPU costs $200K Any way to "Half-Refresh V-Sync" with AMD GPUs? Thanks!




Guru3D.com » News » A Steam Bug Would Let You Get Free Keys For Any Game

A Steam Bug Would Let You Get Free Keys For Any Game

by Hilbert Hagedoorn on: 11/13/2018 07:57 AM | source: hackerone | 13 comment(s)
A Steam Bug Would Let You Get Free Keys For Any Game

Up to late August Steam has had a bug where it was possible for anyone to grab activation keys for any game on Steam. Fortunately for Valve, a security researcher decided to give Valve a heads-up and report the issue. 

On August 7, Moskowsky reported the issue to Valve via security bounty site HackerOne. While it's not possible to view the details of the exploit in the report, the following description is provided:

Using the /partnercdkeys/assignkeys/ endpoint on partner.steamgames.com with specific parameters, an authenticated user could download previously-generated CD keys for a game which they would not normally have access.

Audit logs were not bypassed using this method, and an investigation of those audit logs did not show any prior or ongoing exploitation of this bug.

This API is accessible using a regular Steam account and takes several parameters, but the ones most relevant are appid (representing the game), keyid (representing the identifier of a set of CD keys), and keycount (representing the number of CD keys that Steam needs to return inside a CD key set). Apparently initially when he found the flaw he was able to generate 36.000 valid keys for Portal 2 but then he realized the full scope of the flaw and that it affected every game on Steam.

Moskowsky says that under normal circumstances when he attempted to retrieve CD keys for games he didn't own, Steam's API gave him an error, which is what's supposed to happen.

Within four days, Valve had fixed the issue and awarded Moskowsky a bounty of $US20,000 A few days later, Moskowsky requested the bug be reported publicly, though it took Valve almost two months to agree, on November 1 it was published. The problem has been plugged.







« Review: Corsair K70 RGB MK.2 Low Profile Rapidfire · A Steam Bug Would Let You Get Free Keys For Any Game · AMD will not implement DirectX ray tracing anytime soon »

3 pages 1 2 3


Kaarme
Senior Member



Posts: 2265
Joined: 2013-03-10

#5606454 Posted on: 11/13/2018 01:16 PM
$20,000 is easily enough for Moskowsky to buy a brand new Moskvitch.

RzrTrek
Senior Member



Posts: 2513
Joined: 2012-04-16

#5606482 Posted on: 11/13/2018 02:51 PM
At least it has been patched and they let us know all about it.

ManuKey
Member



Posts: 36
Joined: 2011-11-10

#5606489 Posted on: 11/13/2018 03:07 PM
Puleez if someone had posted the exploit online, 90% of Russia and China would be playing stolen Valve games. :rolleyes:

Without any doubt...

schmidtbag
Senior Member



Posts: 5634
Joined: 2012-11-10

#5606492 Posted on: 11/13/2018 03:14 PM
That's cool Valve paid him (they should have, anyway).

Netherwind
Senior Member



Posts: 7645
Joined: 2009-11-13

#5606575 Posted on: 11/13/2018 05:56 PM
Even if i knew i wouldn't have abused it.

Me neither, my backlog is already absolutely terrible so I wouldn't want to make it even worse by adding free games :D

3 pages 1 2 3


Post New Comment
Click here to post a comment for this news story on the message forum.


Guru3D.com © 2021