{"id":3925,"date":"2012-10-17T12:42:42","date_gmt":"2012-10-17T10:42:42","guid":{"rendered":"http:\/\/blog.netspark.de\/?p=3925"},"modified":"2012-10-30T13:08:32","modified_gmt":"2012-10-30T12:08:32","slug":"steam-network-with-security-hole","status":"publish","type":"post","link":"https:\/\/blog.netspark.de\/?p=3925","title":{"rendered":"Steam network with security hole"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-Post Icon wp-image-3926\" title=\"Steam\" src=\"https:\/\/blog.netspark.de\/wp-content\/uploads\/2012\/10\/Steam-64x64.png\" alt=\"\" width=\"64\" height=\"64\" srcset=\"https:\/\/blog.netspark.de\/wp-content\/uploads\/2012\/10\/Steam-64x64.png 64w, https:\/\/blog.netspark.de\/wp-content\/uploads\/2012\/10\/Steam-150x150.png 150w, https:\/\/blog.netspark.de\/wp-content\/uploads\/2012\/10\/Steam-24x24.png 24w, https:\/\/blog.netspark.de\/wp-content\/uploads\/2012\/10\/Steam.png 256w\" sizes=\"auto, (max-width: 64px) 100vw, 64px\" \/>When it comes to gaming, many people know Steam, a platform where you<br \/>\ncan purchase and download games from. The advantage: You don&#8217;t have to<br \/>\nstore\u00a0 hundreds of discs somewhere in some shaft once you have installed a<br \/>\ngame. The disadvantages: You need an online connection and there are risks.<\/p>\n<p><!--more-->One of the risks which seem to be of a rather important category is the way, how the Steam client or the system\u00a0 is treating special URL-Streams. So is it possible to run and modify batch files with an URL like this<\/p>\n<pre>steam:\/\/run\/id\/language\/url_encoded_parameters<\/pre>\n<p>The danger in between is that this modified URL is also capable to read log files and\/or modify batch files if the string is properly formed. All the attacker needs to know, is, which games the victim has installed.<\/p>\n<p>Although the danger looks serious, there are browsers which warn the user before opening a special URL protocol type like the given one. The only sad exception: Apple and it&#8217;s browser Safari which tends to bypass these URL protocol types without any warning.<\/p>\n<p>Valve is adressing this problem and trying to issue a suitable patch.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When it comes to gaming, many people know Steam, a platform where you can purchase and download games from. The advantage: You don&#8217;t have to store\u00a0 hundreds of discs somewhere in some shaft once you have installed a game. The disadvantages: You need an online connection and there are risks.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[55,3],"tags":[1837,1085,2132],"class_list":["post-3925","post","type-post","status-publish","format-standard","hentry","category-computer-2","category-news","tag-patch","tag-steam","tag-vulnerability"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.netspark.de\/index.php?rest_route=\/wp\/v2\/posts\/3925","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.netspark.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.netspark.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.netspark.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.netspark.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3925"}],"version-history":[{"count":0,"href":"https:\/\/blog.netspark.de\/index.php?rest_route=\/wp\/v2\/posts\/3925\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.netspark.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.netspark.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3925"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.netspark.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}