A hypothetical Zero Day attack exists in Steam.

[Kiss Alice]

Let's use an unlikely, but possible scenario. I want to bring this to the attention of valve so that a safeguard can be put in place against it. Let's get some discussion going.

Let's say you anger a friend, or let's say you have a really bad break up. Let's assume this person is far more malicious than you possibly knew, let's say that they know how steam works and they want to hurt you in some way.

As a deranged ex, let's say it were me, and I somehow still had access to a mutual apartment we live/lived in, and I could, for a short period of time, get access to your steam account while you are out of the house and it is open on your computer.

All I would have to do to cause the maximal possible damage is to click on any game, hit support, and select "I want to permanently remove this game from my account.", confirm twice- and it's gone. That game is now no longer in your library or to my knowledge recoverable. This attack requires no second layer authentication, your game is just *gone*.

Repeat with every other game in your library. Now, suddenly, you return home to play which ever game you sink the most of your time into and.. it's gone. All of it. Your account looks squeaky clean like a brand new account. You own no games.

Doesn't this scenario bring a little bit of light to the possible damage that having no second-hand password confirmations for game removal can bring?

I highly suggest that you log out of your account when you are not home. Please stay safe, these type of attacks are vulnerable in most any system that does not have double-confirmation with password requirements. Once they're in, it's over.

Valve, you really need to add a second layer of password or 2fa authentication to the game removal prompt. This is dangerous.

[Cathulhu]

1. It is recoverable at any time. Just use the same process you've used to remove the game to restore it.
2. If you fail to secure your computer, then it is not a security issue with Steam.
Every modern OS has a lockscreen. With Windows you can access easily by pressing Win key + L on your keyboard.
3. You have no idea what zero day even means.

This thread is pure clickbait with no substance behind it. Just nonsense.

[Kiss Alice]

Publicado originalmente por Cathulhu:

1. It is recoverable at any time.
2. If you fail to secure your computer, then it is not a security issue with Steam.
Every modern OS has a lockscreen. With Windows you can access easily by pressing Win key + L on your keyboard.
3. You have no idea what zero day even means.

"A zero-day (also known as 0-day) is a computer-software vulnerability either unknown to those who should be interested in its mitigation (including the vendor of the target software) or known and a patch has not been developed. Until the vulnerability is mitigated, hackers can exploit it to adversely affect programs, data, additional computers or a network.[1] "

This fits in rather accurately with that definition considering that valve did not account for possible malicious use of this function to destroy a steam library. If they would have known about this, they would have made a password prompt to remove games from your account.

Hush bud, you're belligerent and nobody asked for it.

[Cathulhu]

So far you haven't provided even the slightest bit of indication that there is in fact a security issue with Steam.
By the way, proper quoting demands you posting the quote, otherwise it's simply copyright infringement.

Again, if someone fails to secure their PC, then the Steam account is the least of their worries.
Again, games can be restored after removal. At any given time. No matter how long ago it was.

[Phoenix]

Could you make this sound any less like a totally constructed argument - or something that has actually happened to you? (If so, my condolsences)

This is not so much a propblem with Steam, but you being unable to secure your appartement.

Changing out the locks after a bad breakup with a deranged ex (provided we even traded keys in the first place) should be a top priority, and Steam would probably among my least concerns in that case.

If she has access to my appartement, what kind of actual damage could she possible cause, that I should be inifitely more concerned about?

For that matter, why is your OS even accessible without any log-in credentials to begin with?

[Cathulhu]

Publicado originalmente por Phoenix:

For that matter, why is your OS even accessible without any log-in credentials to begin with?

THIS! My portable notebook even is Bitlocker encrypted using TPM and PIN.

[Phoenix]

Publicado originalmente por CEO of Hell:

This fits in rather accurately with that definition considering that valve did not account for possible malicious use of this function to destroy a steam library. If they would have known about this, they would have made a password prompt to remove games from your account.

Hush bud, you're belligerent and nobody asked for it.

I'd second you having no idea what you're talking about. The "zero day" you're constructing here is you giving others access to your appartement

The Steam behaviour you're describing is not a vulnerability, and on top of that you are already construing a situation where the "attacker" has physical access to your machine while you are logged in.

Why stop at Steam if the attacker could simply install a trojan/compromise your machine in more serious ways?

[Kiss Alice]

Publicado originalmente por Phoenix:

Publicado originalmente por CEO of Hell:

This fits in rather accurately with that definition considering that valve did not account for possible malicious use of this function to destroy a steam library. If they would have known about this, they would have made a password prompt to remove games from your account.

Hush bud, you're belligerent and nobody asked for it.

I'd second you having no idea what you're talking about. The "zero day" you're constructing here is you giving others access to your appartement :lunar2019crylaughingpig:

You opting to ignore the potential danger of someone getting access to your account (stealing your phone too, for example, while it's unlocked) is not a fault of my argument, it's your unwillingness to acknowledge that yes, this is a potential problem to the system in that it should be a little harder to remove games from your account than pressing three buttons. That is not something that you should be disagreeing with.

[Crazy Tiger]

Go to the support pages, look up the game and choose "It's not in my library" and the game gets restored.

"Permanently" removing a game is just an advanced hide, it doesn't actually remove the game. When the game is "removed" and you want to repurchase it, you get a notification that you cannot buy the game and should restore the game.

Publicado originalmente por CEO of Hell:

Publicado originalmente por Phoenix:

I'd second you having no idea what you're talking about. The "zero day" you're constructing here is you giving others access to your appartement

You opting to ignore the potential danger of someone getting access to your account (stealing your phone too, for example, while it's unlocked) is not a fault of my argument, it's your unwillingness to acknowledge that yes, this is a potential problem to the system in that it should be a little harder to remove games from your account than pressing three buttons. That is not something that you should be disagreeing with.

None of that is a Steam issue, but a user issue. And as said, games are easily recoverable.

[rawWwRrr]

Publicado originalmente por CEO of Hell:

"A zero-day (also known as 0-day) is a computer-software vulnerability either unknown to those who should be interested in its mitigation (including the vendor of the target software) or known and a patch has not been developed. Until the vulnerability is mitigated, hackers can exploit it to adversely affect programs, data, additional computers or a network.[1] "

*eye-roll*
Apparently we need this explained?

Publicado originalmente por CEO of Hell:

This fits in rather accurately with that definition considering that valve did not account for possible malicious use of this function to destroy a steam library. If they would have known about this, they would have made a password prompt to remove games from your account.

The issue though is that it can't "destroy a steam library". It's "Steam", by the way, with a capital "S". At worst it's a major inconvenience to the library owner as they have to go through the process of restoring their games. The act of "remove this from my library" is essentially an advanced hide. The game license is still associated with the account and can be restored at any time.

Publicado originalmente por CEO of Hell:

Hush bud, you're belligerent and nobody asked for it.

Seriously. Change the attitude as it's not doing you any favors.

[logith]

If you have an unwanted visitor in your home, you got much bigger problems than the potential of losing your games (Which you won't actually lose them, since they are restorable)

[Phoenix]

Publicado originalmente por CEO of Hell:

You opting to ignore the potential danger of someone getting access to your account (stealing your phone too, for example, while it's unlocked) is not a fault of my argument, it's your unwillingness to acknowledge that yes, this is a potential problem to the system in that it should be a little harder to remove games from your account than pressing three buttons. That is not something that you should be disagreeing with.

I could also be killed by somebody firing a missile through my window. Yet you don't see me demanding that I should be allowed to install CIWS on my premises.

If you construe a situation where somebody has physical access to your machine, which is also powered on an you're logged in with a privileged user, said attacker exploiting said situation is not a zero-day vulnerability in any underlaying software.

It's a vulnerability in the environment your machine is placed in - an environment you created and failed to secure.

This is like pointing out that your seatbelts are inadequate to protect you when your car is falling down a mountainside.

Yes, indeed they are, but they are not designed to keep you from crossing the road into sheer nothingness.

[Overseer]

If somebody causes you damage with malicious intent you start a lawsuit and bring them to court. That's not a Valve problem. Steam TOS are not the end of all things.

[happy]

If you have any relevant Knowledge or Info of any possible Situations in these Regards, you wouldnt publically post them here on the Steam Forums.

[ShelLuser]

A complete dumb non-issue and as Cathulhu above also said: pure clickbait. In fact, the stupidity of it all (in combination with the "CEO" username) is in my opinion laughable.

I mean, with this kind of reasoning one can also argue that all major banks are vulnerable to exploitation because what would happen if an angry ex uses your cellphone to authorize financial transfers?

Then there's also a huge vulnerability with my favorite online shopping website because I can authorize purchases without a password and even without direct payment requirements.

Heck, all major browsers are vulnerable because they can store passwords which an angry ex can then abuse.

The list is basically endless, which is what makes this whole argument so utterly stupid.

As others also mentioned: there's a very simple solution: secure your computer and/or cellphone. Problem solved.

[Yasahi]

Publicado originalmente por koRRupted mInd:

If you have any relevant Knowledge or Info of any possible Situations in these Regards, you wouldnt publically post them here on the Steam Forums.

They posted nonsense so it's only to be expected that they post it on a public forum. What OP describes is a normal function of any software. A user can access and perform different actions based on their user privileges. The user failing to secure their surroundings and their devices is not something that can be pinned on the software.

The OP is either trying to stir up trouble or woefully confused as to what a 0-day attack is. Even after quoting the definition they fail to see their own mistake.