What would you do if you had all the money in the world? Well, if you’re reading this, buying all the video games is probably somewhere at the top of the list. A security researcher recently discovered and reported a Steam exploit via which you could add unlimited funds to your wallet.
As reported by The Daily Swig, researcher drbrix spotted the vulnerability over a week ago and reported it via HackerOne. According to them, the vulnerability allowed attackers to generate funds in their Steam Wallet. The process involved changing the email address to include the term “amount100”.
“With this in place, a would-be attacker would apply to add funds to their wallet, selecting an option that relies on Smart2Pay as the payment method, before going ahead with a small minimum payment of $1,” pointed out The Daily Swig. “If an attacker intercepted the corresponding POST request to the Smart2Pay API, they would find a response that could be edited to change the payment amount, which could be edited to a far larger amount than was actually paid ($100 instead of $1).”
Valve was quick to respond and appreciated drbrix’s report. “Thanks for your report. We've been able to validate this is happening pretty much as described, and are taking steps now. Please stand by as we have not assessed severity or bounty yet,” replied Valve employee JonP. “We are deploying a fix to our production systems now. Can you please retest and let us know what you find? Thank you. We'll follow up with bounty/severity soon.”
The researcher was rewarded for their report with a $7,500 bounty. That’s definitely a big amount, but it’s justified when you compare it to the potential financial damage the exploit could have caused to Valve. JonP noted that they had escalated the assessment to Critical, and hoped to hear from the researcher again regarding exploits.
Valve currently has its hands full, building up to the launch of the Steam Deck. The company seems to be pretty confident of the new product, even going as far as recommending the Steam Deck for your next PC upgrade. “We don't have a strong prediction that a bunch of people are going to choose it as their first PC," said designer Greg Coomer, "but as a lot of people choose to upgrade their existing PCs, we feel fairly confident that Steam Deck will be a choice that they make."