I managed to bypass the verification of ownership of the game by changing only one parameter. To exploit the vulnerability, it was necessary to make only one request. The flaw could have been abused by anyone who has access to the portal, generating thousands of keys and selling them to players.
He noticed that, by slightly changing parameters in the API request, he could acquire license key for a selected game. While there are millions of players using it, there are also thousands of developers hosting their games on the platform with the help of Steam partner portal – the API used to generate keys and pass them on to gamers or reporters to review.Īrtem was visiting the website and discovered the bug accidentally. Steam developer site could have been used by any bad actorĬurrently, Steam is the most popular platform in the world, with concurrent users number peaking at 18.5 million. Moskowsky said that he has been searching for security flaws since school times and in the past few years, he is making a living out of the activity. The company also awarded the researcher $20,000 for reporting the vulnerability via the HackerOne bug bounty program. Upon discovery, Artem Moskowsky did not abuse the system to earn large sums of money but instead reported the flaw to Valve, creator of Steam gaming platform. However, those who thought got a perfect opportunity to harvest thousands of games for free, are too late, as the vulnerability was already patched in August. The glitch allowed any game developer that uses Steam partner portal to retrieve unlimited license keys for any game that is available on Steam. Security researcher and self-described “bug hunter” Artem Moskowsky accidentally discovered a bug in Steam gaming platform. Steam is a video game digital distribution service by Valve.Valve awarded the flaw hunter $20,000 for disclosing the bug that allowed unlimited access to all games on the Steam platformĪrtem Moskowsky, a self-proclaimed bug hunter, receives $20,000 bounty for the discovery of a critical flaw in Steam partner portal API We not support any kind of hijacking or illegal use of accounts. Attention: The accounts mentioned on Gametimeprime are submitted by users or collected from other open-access portals.
0 kommentar(er)
