A few Web wallpaper security concerns

[Messajah]

Hello, I was reading the old discussion:

https://steamcommunity.com/app/431960/discussions/2/3570700856120752190/

In it, you explain that web-based wallpapers are allowed to make outgoing connections to the internet.

I still have a few security concerns:

1. If Webpage-based wallpapers are using Audio Recording (system audio and/or mic audio), do they get the full audio stream? If so, they can literally spy on the user by uploading the audio stream to a 3rd party website.

2. Can webpage-wallpapers access the local filesystem to read files?

3. Can webpage-wallpapers make connections to the local network (such as 192.168.0.1 on port 80 for routers)? In that case they could try to login to routers default passwords and set up backdoors into the network.

If all of this is possible, a bad person could write a wallpaper that makes streams every user's system/microphone audio to me to spy for fun. They could login to routers and change network settings. And I doubt they can read files, but if they can, then things would be even more dire.

---

Of course my hope is for these answers:

1. "No, they only get some basic FFT band data so that they can design visualizers. They do not get the raw, real audio."

2. "No, of course not."

3. "No, we only allow connections to the internet."

---

I also wonder if you could add a feature to Wallpaper Engine: "Block all network activity by Web wallpapers" to literally sandbox them to the local machine. I have never seen a wallpaper that needs to be able to reach the internet, and it would be nice to have this security feature. And on by default. Perhaps even a per-wallpaper toggle to "allow outgoing network connections by wallpaper".

---

I definitely like Wallpaper Engine a lot! Just avoiding Web wallpapers for now, until I know more. Sticking to Scene and Video ones so far...

[Tim]

Hey!

Originally posted by Hello!:

I still have a few security concerns:

1. If Webpage-based wallpapers are using Audio Recording (system audio and/or mic audio), do they get the full audio stream? If so, they can literally spy on the user by uploading the audio stream to a 3rd party website.

No, they are getting a summary of volume levels for the different frequencies, they cannot "listen" to your audio, all they get is data like "bass is at 50% volume right now, treble is at 75% volume right now" which allows creators to create audio visualizers but nothing more.

Originally posted by Hello!:

2. Can webpage-wallpapers access the local filesystem to read files?

No.

Originally posted by Hello!:

3. Can webpage-wallpapers make connections to the local network (such as 192.168.0.1 on port 80 for routers)? In that case they could try to login to routers default passwords and set up backdoors into the network.

Yes, they can connect to local IP addresses. I don't think your scenario is especially realistic but it's in theory feasible. If this is a realistic and huge concern for you, don't use web-based wallpapers or look at the source code before using them.

[Messajah]

Thank you, that's great! So they just get some FFT frequency visualizer bands, no real audio. Fantastic. And no filesystem access. Fantastic!

And yeah, I admit that the router maliciousness scenario is very minor. And I don't have a default router password. And I doubt that any wallpapers actually exploit this.

However, any chance that we could get a global settings toggle to block web access for wallpapers? To totally sandbox Web wallpapers. Would give total peace of mind.

[Tim]

I could lie and say we'll put it on the roadmap but I think you are the first person to ever request this so there does not seem to be that much demand for this relatively complex feature request (we do have to prioritize the things we work on unfortunately). If it's such a big concern for you, I would suggest you simply block webwallpaper32.exe in the firewall application of your choice (might even be possible with the standard Windows firewall, I have never tried) which would have the same effect.

[Messajah]

Thanks, I will block it via the Windows firewall. It does support "block outgoing" per-application. Win10: Settings - Windows Firewall - Advanced Settings - Outbound Rules, then add a new rule with type "Program", set the program path (I'll do both of the webwallpaper32.exe files (bin and distribution\bin)), then choose "Block the connection", tick all boxes for when the rule will apply, then name the rule and save it!

Now I can use web wallpapers with a lot more peace of mind that it won't be able to do anything bad.

As for a program feature: I don't just worry about malicious wallpapers abusing the routers. That's kind of unlikely. I worry more about wallpapers downloading ads in the background to earn money for their authors. Or being coded to send spam emails or web form submissions from my IP. Or running crypto miners in the wallpaper (which would need web access). All of that would be doable by malicious authors, since it's a full JavaScript engine with web access... There could also be jailbreak exploits that haven't been found yet.

I've now blocked wallpaper internet/network access. Thanks for the tip! <3

Wallpaper Engine is very well designed with its Video and Scene performance and security. Web seems pretty secure too, but there are risks that connection blocking eliminates. :-)

(And then there's of course the riskiest kind, Application based wallpapers, which could literally be malware, so I'll never use those. Luckily there aren't really any wallpapers of that kind on the workshop. Most advanced wallpapers are implemented in the web engine instead, yay. :-))

Seriously great work on Wallpaper Engine. I was skeptical at first but loved it immediately.

Thanks again!

[AltCtrlDel435]

Originally posted by Hello!:

Thanks, I will block it via the Windows firewall. It does support "block outgoing" per-application. Win10: Settings - Windows Firewall - Advanced Settings - Outbound Rules, then add a new rule with type "Program", set the program path (I'll do both of the webwallpaper32.exe files (bin and distribution\bin)), then choose "Block the connection", tick all boxes for when the rule will apply, then name the rule and save it!

Now I can use web wallpapers with a lot more peace of mind that it won't be able to do anything bad.

As for a program feature: I don't just worry about malicious wallpapers abusing the routers. That's kind of unlikely. I worry more about wallpapers downloading ads in the background to earn money for their authors. Or being coded to send spam emails or web form submissions from my IP. Or running crypto miners in the wallpaper (which would need web access). All of that would be doable by malicious authors, since it's a full JavaScript engine with web access... There could also be jailbreak exploits that haven't been found yet.

I've now blocked wallpaper internet/network access. Thanks for the tip! <3

Wallpaper Engine is very well designed with its Video and Scene performance and security. Web seems pretty secure too, but there are risks that connection blocking eliminates. :-)

(And then there's of course the riskiest kind, Application based wallpapers, which could literally be malware, so I'll never use those. Luckily there aren't really any wallpapers of that kind on the workshop. Most advanced wallpapers are implemented in the web engine instead, yay. :-))

Seriously great work on Wallpaper Engine. I was skeptical at first but loved it immediately.

Thanks again!

Hi. I am also using this with security in mind. Did you end up losing any functionality by blocking it in the firewall?

[AltCtrlDel435]

Originally posted by Tim:

Hey!

Originally posted by Hello!:

I still have a few security concerns:

1. If Webpage-based wallpapers are using Audio Recording (system audio and/or mic audio), do they get the full audio stream? If so, they can literally spy on the user by uploading the audio stream to a 3rd party website.

No, they are getting a summary of volume levels for the different frequencies, they cannot "listen" to your audio, all they get is data like "bass is at 50% volume right now, treble is at 75% volume right now" which allows creators to create audio visualizers but nothing more.

Originally posted by Hello!:

2. Can webpage-wallpapers access the local filesystem to read files?

No.

Originally posted by Hello!:

3. Can webpage-wallpapers make connections to the local network (such as 192.168.0.1 on port 80 for routers)? In that case they could try to login to routers default passwords and set up backdoors into the network.

Yes, they can connect to local IP addresses. I don't think your scenario is especially realistic but it's in theory feasible. If this is a realistic and huge concern for you, don't use web-based wallpapers or look at the source code before using them.

Hi, Tim. I am trying to do what this person did and disable internet access for Wallpaper Engine. In my antivirus firewall, I blocked connections for wallpaper32.exe, wallpaper64.exe, launcher.exe, as well as wallpaper32.exe and wallpaper64.exe from the distribution folder. I have also blocked webwallpaper32.exe from the bin folder. When I open the program, go the the workshop tab and search for something, I get results. Does this mean that the blocking did not work? I noticed that when searching, it said "Waiting for Steam to respond". I am inclined to think that the search is done through Steam. My question is what do I need to do to block the app from internet access altogether (just keep the ability to swap between the wallpapers I have already downloaded) like the person above me tried to do? Would not doing so present any potential security risk?

[Biohazard]

webwallpaper32.exe is the only process accessing the internet and executing scripts that others uploaded to the Workshop. But only if you subscribe web type wallpapers and use them. The functionality you would lose is that some wallpapers may download data like weather or sounds/videos or anything like that to make it dynamic and then those wallpapers would just stop working, but that's all and won't affect the program much overall.

This is how you disable the Steam integration, it has nothing to do with the firewall: https://help.wallpaperengine.io/en/steam/ingame.html However this isn't "necessary" if you are concerned about internet access since Wallpaper Engine is accessing Steam through the Steamworks SDK just like every single game on Steam does.

[butcho]

I block the webwallpaper32.exe in my firewall since I started using Wallpaper Engine and leaving the ui32.exe and wallpaper32.exe untouched so I can upload stuff and the workshop can do it's thing. I'm not paranoid in any case I just dislike the fact that a process just connects to the internet unasked and downloading idunnowhat which sadly is the norm nowadays.

The OP should consider using a firewall that deserves the name. What M$ calls firewall I call some kind of joke. I'm not talking about configuring iptables the hardcore way, just some decent software firewall for Windows like Comodo Internet Security for example. Even if you're not that skilled with security stuff Comodo is relatively easy to setup and has a nice manual where everything is explained pretty good.

Just a thought if you are concerned about security stuff on a Windows base.

[AltCtrlDel435]

Originally posted by Biohazard:

webwallpaper32.exe is the only process accessing the internet and executing scripts that others uploaded to the Workshop. But only if you subscribe web type wallpapers and use them. The functionality you would lose is that some wallpapers may download data like weather or sounds/videos or anything like that to make it dynamic and then those wallpapers would just stop working, but that's all and won't affect the program much overall.

This is how you disable the Steam integration, it has nothing to do with the firewall: https://help.wallpaperengine.io/en/steam/ingame.html However this isn't "necessary" if you are concerned about internet access since Wallpaper Engine is accessing Steam through the Steamworks SDK just like every single game on Steam does.

Thank you for the quick response. That is exactly what I am looking for. So from what I understand, disabling Steam integration will prevent any of the wallpapers already stored from accessing the internet as well, making the program offline only. Is that correct?

[Biohazard]

Those are two different things:

- Blocking webwallpaper32.exe in the firewall will prevent web type wallpapers from accessing the internet.
- Disabling the Steam integration will disable the Workshop/achievement/screenshot functions meaning you cannot download new wallpapers from the Workshop. Basically it will disable anything related to Steam.

[AltCtrlDel435]

Originally posted by Biohazard:

Those are two different things:

- Blocking webwallpaper32.exe in the firewall will prevent web type wallpapers from accessing the internet.
- Disabling the Steam integration will disable the Workshop/achievement/screenshot functions meaning you cannot download new wallpapers from the Workshop. Basically it will disable anything related to Steam.

So would doing both achieve what I mentioned?

[Tim]

You can just use the "Open URL" functionality and open www.google.com for example. If the page does not load as a wallpaper, then Wallpaper Engine is successfully blocked from accessing the internet.

[AltCtrlDel435]

Originally posted by Tim:

You can just use the "Open URL" functionality and open www.google.com for example. If the page does not load as a wallpaper, then Wallpaper Engine is successfully blocked from accessing the internet.

Background changed to white. Seems like it worked. Thanks!

[AltCtrlDel435]

Originally posted by Tim:

You can just use the "Open URL" functionality and open www.google.com for example. If the page does not load as a wallpaper, then Wallpaper Engine is successfully blocked from accessing the internet.

I have another question. I found a firewall rule named "sheep" in my antivirus firewall, corresponding to the sheep default project. I don't remember seeing it at first. Is it there by default? I removed the sheep folder, but the rule still seems to be there. Would removing that rule break anything considering I deleted the sheep files?

There seems to be no trust rating for sheep.exe, but there is positive trust rating for the other wallpaper engine files in my antiviruses' firewall. Is there supposed to be an exe for that wallpaper?

[Biohazard]

The sheep wallpaper is a Unity engine game. Perhaps the Unity engine creates a firewall rule by default, I don't know, but it doesn't use any features to connect anywhere.