Malware in wallpapers?

[Tim]

If you have seen the Kaspersky report on the Steam Workshop being abused to distribute malware and if you are worried about if you were or if you are at risk, here are some facts to put this matter into perspective (and why you are almost certainly NOT affected):

1. The issue was limited to a set of wallpapers of the "Application" type, mainly targeting Chinese users.
2. Application type wallpapers are turned off by default in the search. The majority of people never come across them for this reason.
3. Even if you enabled application type wallpapers in the search in the past, there is an unskippable warning that provides a detailed explanation about the theoretical risk of application wallpapers. This warning shows up for every single application wallpaper. You cannot disable this message or ever accidentally run a new application wallpaper without your full knowledge. This warning also comes with a countdown timer, forcing you to read it every time, you cannot skip past it accidentally.
4. The affected Workshop items were not popular uploads, they had odd titles in Chinese, if you never actively went to seek them out, it is unlikely that you just came across them while browsing the Workshop. That is not to say you should consider wallpapers with Chinese names as suspicious, it mostly means that all things considered (hidden by default, unpopular, cryptic Chinese names, unskippable warning) made them very "unattractive" to absolute vast majority of people.

99%+ of users never use Application wallpapers. Scene and Video wallpapers are very safe and for web wallpapers we also take precautions to make them as safe as possible. We have unfortunately seen a lot of wrong information floating around where people mixed up Scene wallpapers and Application wallpapers. Almost all interactive and dynamic wallpapers on the app use the safe "Scene" type, not "Application".

We have already recently tightened up security months ago which is why the items reported by Kaspersky were from December - we have new measures in place that prevent this abuse on a large scale today and we will do another sweep through the Workshop.

The affected uploads have of course been banned and Steam automatically deletes them from the hard disk. If you're wondering if your wallpapers are affected, the answer is almost certainly "no" just by checking if your wallpapers are still online / on your disk.

Again, if you never enabled Application type wallpapers in the filters, then searched for application wallpapers with Chinese names and then ignored the big red warning, you are not affected by this.

[Tim]

By the way, the "Sheep" wallpaper comes pre-installed, so if you see that application wallpaper, it's obviously safe and unaffected.

[Peter_BigMeater]

Thank you for keeping us updated, to be honest I was a little worried after hearing this information when it came out!

[FurrNationalUwU🔞✯]

Yeah

[LootHamster]

thanks for the clarification! so basically just user error.

[Slepi]

Why even have such a feature to download "application" type file ? You should know there's always people who can't read and simply click such as kids.

And since 99% of users never use it. Just remove it.

[sinfnam915]

thank you GOAT

[kingslycamben]

Originally posted by Slepi:

Why even have such a feature to download "application" type file ? You should know there's always people who can't read and simply click such as kids.

And since 99% of users never use it. Just remove it.

Yeah I agree, unfortunately people seem to be incapable of reading warnings. IMO it should just be removed because its a unnecessary risk. It only makes wallpaper engine and by extension the devs, look bad.

[Coffee]

So basicallyit's okay if you get infected because you declined it? If you provide a such function, you have to ensure it isn't using maliciously.

[♰Zero7th♰]

I love the app, but it's not possible hahaha, I'm forced to remove it and it leaves my static wallaper, every time there's a problem, remove it and everyone who does the same will definitely download the app again

[Tim]

Originally posted by Coffee:

So basicallyit's okay if you get infected because you declined it? If you provide a such function, you have to ensure it isn't using maliciously.

The text is not blaming anyone, it is adding context to show how limited the spread of this was and how unlikely it is that someone was / is affected by this. Some social media posts are blowing the scale of this way out of proportion and it sounds like every wallpaper type is suddenly at the risk of infection which is wrong.

There is no need to cause unnecessary panic or pretend like this is some gaping security hole that everyone needs to look out for all of the sudden. The risk of application wallpapers was always there and clearly communicated (also on the forums) and the spread of this was limited precisely because we do have many precautions in place.

And as I wrote, independent of this report, we have already tightened up security a few months ago. The Workshop is not a virus spreading machine as some news / social media posts make it out to be.

[DIVE]

so web wallpapers are not as safe as scene or video wallpapers?

[NOX]

So, just to be sure, is the stable version now completely safe to use, or would you still recommend using the beta version?

[LouisDaEpikGamer]

im paranoid for sure

[Tim]

Originally posted by Concept-X:

so web wallpapers are not as safe as scene or video wallpapers?

Web wallpapers are basically web pages with custom wallpaper features build in. They are as risky as browsing the internet with Google Chrome (which isn't really all that risky). There is an abstract risk (like with anything really) but the risk is infinitely lower than app wallpapers. There is no reason to uninstall any web type wallpapers or to be worried.

Originally posted by NOX:

So, just to be sure, is the stable version now completely safe to use, or would you still recommend using the beta version?

It's safe, there is no security hole in the app itself, no fix is needed. Just do not use Application type wallpapers (they are disabled by default anyway) unless you fully trust the author. This has been the same stance in the past ten years. As the post explains, the vast majority of users never touches app wallpapers since they are disabled by default and show a big, red, scary warning before launching them for the first time - you could not have missed it.

[MONK3Y]

I commend your effort in clarifying the issue. I agree with the fact that giving warning is a good effort. According to me, this response is still evasive in nature. I'm sure you mean well.

Please disable/remove all wallpapers from the workshop using application wallpaper. Disable the Application Wallpapers to be able to to be installed(not warning, completely disabled). Only bring this features back until you have taken appropriate measures to sandbox these "application wallpapers" so that they can not run executables in background that can access outside information.

This response is reactive, when the signs were there(in reviews) before the Kaspersky report (which is also 2 days old). These measures should've been proactive especially with paid software.