Steam browser security loop hole.

"A report from hardware and software security firm Revuln has been posted online, highlighting a security flaw that could allow attackers to target PCs using Steam browser launch commands. The steam:// URL is a quick way to install and launch games from a browser. Revuln point out that Safari can launch steam:// commands silently without the user knowing, providing a window of opportunity for attackers.

The report highlights ways in which local processes that exist on our PCs as part of game installations could be misused to cause mischief. Revuln highlight different attack strategies using Source and Unreal engine games. The good news is that major browsers like Internet Explorer, Firefox and Chrome, give warning before programs are launched. Valve will surely be right on this, if they havent found a fix already. Until then it might be wise to avoid Safari and, as always, say no to any unexpected program launches."

http://www.pcgamer.com/2012/10/16/steam-security-breachxx/

This begs the question, why are people even using Safari as a web browser....

I've been messaging steam about this problem for ages. Every time I go on around July or Christmas a huge of chunk of money disappears from my bank account!blue_hazy_basic

I've been messaging steam about this problem for ages. Every time I go on around July or Christmas a huge of chunk of money disappears from my bank account!blue_hazy_basic

[QUOTE="SaltyMeatballs"][QUOTE="blue_hazy_basic"]I've been messaging steam about this problem for ages. Every time I go on around July or Christmas a huge of chunk of money disappears from my bank account!clyde46

The most I ever spent on one sale was $14.98 that was my 2nd Steam sale ever.

I purchased Indie Story Pack, The Witcher Enhanced Edition Director's Cut, and S.T.A.L.K.E.R. Call of Pripyat+ Shadow of Chernobyl.

"A report from hardware and software security firm Revuln has been posted online, highlighting a security flaw that could allow attackers to target PCs using Steam browser launch commands. The steam:// URL is a quick way to install and launch games from a browser. Revuln point out that Safari can launch steam:// commands silently without the user knowing, providing a window of opportunity for attackers.

The report highlights ways in which local processes that exist on our PCs as part of game installations could be misused to cause mischief. Revuln highlight different attack strategies using Source and Unreal engine games. The good news is that major browsers like Internet Explorer, Firefox and Chrome, give warning before programs are launched. Valve will surely be right on this, if they havent found a fix already. Until then it might be wise to avoid Safari and, as always, say no to any unexpected program launches."

http://www.pcgamer.com/2012/10/16/steam-security-breachxx/

This begs the question, why are people even using Safari as a web browser....

clyde46

So it's actually a Safari security problem. Safari has never been known as the most secure browser, and it is pretty much only used by mac users (there is a crappy windows version)

[QUOTE="blue_hazy_basic"][QUOTE="clyde46"] A first time Steam account holder can and will spend a lot of money during their first time in the Sales. I know I did.SaltyMeatballs

You're probably better off. I bought games during the summer I will likely never play again or finish :(

[QUOTE="blue_hazy_basic"]I've been messaging steam about this problem for ages. Every time I go on around July or Christmas a huge of chunk of money disappears from my bank account!clyde46

I've been messaging steam about this problem for ages. Every time I go on around July or Christmas a huge of chunk of money disappears from my bank account!blue_hazy_basic

lol it took me 3 minutes to realize what you was saying

Safari? Why am I not surprised that this is Apple's fault.

Also that.

Mac + Steam /// Does not compute

Mac + Steam /// Does not compute

Maneil99

(but only a few)

Mac + Steam /// Does not compute

Maneil99

[QUOTE="Maneil99"]

Mac + Steam /// Does not compute

Timstuff

(but only a few)

[QUOTE="Timstuff"]

[QUOTE="Maneil99"]

Mac + Steam /// Does not compute

clyde46

(but only a few)

Meh I don't even use the steam browser. It's very slow compared to a real browser, and most games you can easily switch out of.

Meh I don't even use the steam browser. It's very slow compared to a real browser, and most games you can easily switch out of.

cain006

[QUOTE="cain006"]

Meh I don't even use the steam browser. It's very slow compared to a real browser, and most games you can easily switch out of.

clyde46

[QUOTE="clyde46"]

"A report from hardware and software security firm Revuln has been posted online, highlighting a security flaw that could allow attackers to target PCs using Steam browser launch commands. The steam:// URL is a quick way to install and launch games from a browser. Revuln point out that Safari can launch steam:// commands silently without the user knowing, providing a window of opportunity for attackers.

The report highlights ways in which local processes that exist on our PCs as part of game installations could be misused to cause mischief. Revuln highlight different attack strategies using Source and Unreal engine games. The good news is that major browsers like Internet Explorer, Firefox and Chrome, give warning before programs are launched. Valve will surely be right on this, if they havent found a fix already. Until then it might be wise to avoid Safari and, as always, say no to any unexpected program launches."

http://www.pcgamer.com/2012/10/16/steam-security-breachxx/

This begs the question, why are people even using Safari as a web browser....

lostrib

So it's actually a Safari security problem. Safari has never been known as the most secure browser, and it is pretty much only used by mac users (there is a crappy windows version)