Last week we reported that despite being warned, Valve did nothing to fix a massive Source Engine vulnerability for the past two years. However, the vulnerability now appears to be fixed.
Not-for-profit reverse-engineering group, The Secret Club, combs through publicly available software and publishes vulnerabilities in hopes that the developers fix them before the event of a major data breach. The group had reportedly approached Valve with the issue, but to no avail.
Two years on, The Secret Club’s Twitter account put out a video to show just how easy it would be for someone to have their data breached because of the vulnerability. A mere acceptance of an invitation to play a Source Engine game on Steam by the victim could grant the hacker complete access to the victim’s PC and personal data. Additionally, Valve also restricted the group from publicly disclosing the issue.
However, it seems that public pressure may have forced Valve’s hand, as the issue appears to be resolved. @floesen_, a member of The Secret Club, who initially brought the issue to light, confirmed that it had been solved. Furthermore, he also said that Valve has given them a go ahead for a technical writeup detailing the issues that led to the vulnerability.
“Good news! Valve fixed my recent exploit and gave me permissions to disclose details. That being said, I am working on a detailed technical write-up which I am going to release soon. Stay tuned!” said @floesen_.
This isn’t the only issue that The Secret Club has reported about Steam. Exploits with regard to Team Fortress 2 and CS: GO have been reported by the group earlier but have still not been fixed. However, given the fact the Valve bowed to public outcry and fixed the earlier issue, don’t be surprised if these issues get addressed sometime soon too.
According to industry insider Tyler McVicker, Valve has been trying to get Xbox Game Pass to its platform. McVicker mentioned this on a recent podcast where he answered a number of questions from his fans, including one that pondered if Valve was trying to set up its own competing subscription service.