Steam含有權限擴張漏洞,波及1億用戶 - Steam

By Dorothy
at 2019-08-10T10:08
at 2019-08-10T10:08
Table of Contents
Steam含有權限擴張漏洞,波及1億用戶
https://www.ithome.com.tw/news/132344
研究人員發現Steam客戶端程式暗藏的零時差漏洞,讓安裝了Steam的Windows電腦陷入安
全風險
文/陳曉莉 | 2019-08-09發表
代號為Felix的俄羅斯安全研究人員在本周揭露了Windows版的Steam客戶端程式,含有一
零時差的權限擴張漏洞,將允許駭客取得管理員權限,於系統上執行任意程式,雖然他曾
先行通報Steam,卻遭到Steam拒絕,使得Felix決定公布漏洞細節,波及超過1億的Steam
註冊用戶。
根據Felix的說明,Steam的客戶端程式有一項基於系統權限執行的Steam Client Service
功能,奇怪的是來自「使用者」(Users)群組的任何人,都有權啟用或關閉該功能,繼
之他發現所有使用者都能存取該功能的登錄機碼,也讓駭客可利用它來擴張權限。
Felix指出,這意味著只要Windows電腦安裝了Steam,駭客就可取得系統管理員權限並執
行任意程式。
Steam為美國業者Valve所開發的遊戲數位發行平台,它支援Windows、macOS、Linux、
Android與iOS等平台。根據Steam Spy的估計,Steam的全球用戶數超過2.4億,而Steam今
年7月的調查則顯示,約有71.5%的用戶使用Windows 10作業系統,代表至少有1.7億的用
戶受到該漏洞的影響。
Felix表示,他是在今年6月透過Valve,於HackerOne上執行的抓漏獎勵專案回報了該漏洞
,該漏洞已經通過了HackerOne的審核,卻被Valve打了回票,理由是:駭客必須有能力在
使用者檔案系統上置放檔案,也必須實際接觸使用者裝置,因此不適用於該專案。但當他
準備公布漏洞資訊時,Valve還曾制止他。
而在Felix公布了漏洞資訊之後,即有另一名研究人員於GitHub上釋出了針對該漏洞的概
念性驗證攻擊程式。截至新聞發布前,Valve仍未公開回應此事。
心得:
好吧,我決定考慮用Linux來玩遊戲了,Windows系統好恐怖,防不慎防
--
https://www.ithome.com.tw/news/132344
研究人員發現Steam客戶端程式暗藏的零時差漏洞,讓安裝了Steam的Windows電腦陷入安
全風險
文/陳曉莉 | 2019-08-09發表
代號為Felix的俄羅斯安全研究人員在本周揭露了Windows版的Steam客戶端程式,含有一
零時差的權限擴張漏洞,將允許駭客取得管理員權限,於系統上執行任意程式,雖然他曾
先行通報Steam,卻遭到Steam拒絕,使得Felix決定公布漏洞細節,波及超過1億的Steam
註冊用戶。
根據Felix的說明,Steam的客戶端程式有一項基於系統權限執行的Steam Client Service
功能,奇怪的是來自「使用者」(Users)群組的任何人,都有權啟用或關閉該功能,繼
之他發現所有使用者都能存取該功能的登錄機碼,也讓駭客可利用它來擴張權限。
Felix指出,這意味著只要Windows電腦安裝了Steam,駭客就可取得系統管理員權限並執
行任意程式。
Steam為美國業者Valve所開發的遊戲數位發行平台,它支援Windows、macOS、Linux、
Android與iOS等平台。根據Steam Spy的估計,Steam的全球用戶數超過2.4億,而Steam今
年7月的調查則顯示,約有71.5%的用戶使用Windows 10作業系統,代表至少有1.7億的用
戶受到該漏洞的影響。
Felix表示,他是在今年6月透過Valve,於HackerOne上執行的抓漏獎勵專案回報了該漏洞
,該漏洞已經通過了HackerOne的審核,卻被Valve打了回票,理由是:駭客必須有能力在
使用者檔案系統上置放檔案,也必須實際接觸使用者裝置,因此不適用於該專案。但當他
準備公布漏洞資訊時,Valve還曾制止他。
而在Felix公布了漏洞資訊之後,即有另一名研究人員於GitHub上釋出了針對該漏洞的概
念性驗證攻擊程式。截至新聞發布前,Valve仍未公開回應此事。
心得:
好吧,我決定考慮用Linux來玩遊戲了,Windows系統好恐怖,防不慎防
--
Tags:
Steam
All Comments

By Sarah
at 2019-08-11T12:26
at 2019-08-11T12:26

By Rosalind
at 2019-08-15T18:24
at 2019-08-15T18:24

By Connor
at 2019-08-17T06:51
at 2019-08-17T06:51

By Rae
at 2019-08-21T01:14
at 2019-08-21T01:14

By Donna
at 2019-08-25T18:47
at 2019-08-25T18:47

By Rachel
at 2019-08-29T06:51
at 2019-08-29T06:51

By Puput
at 2019-08-30T21:02
at 2019-08-30T21:02

By Olga
at 2019-09-03T14:25
at 2019-09-03T14:25

By Sarah
at 2019-09-05T22:58
at 2019-09-05T22:58

By Audriana
at 2019-09-10T16:14
at 2019-09-10T16:14

By Hedda
at 2019-09-14T17:23
at 2019-09-14T17:23

By Dorothy
at 2019-09-16T20:23
at 2019-09-16T20:23

By Dinah
at 2019-09-20T15:16
at 2019-09-20T15:16

By Aaliyah
at 2019-09-21T22:23
at 2019-09-21T22:23

By Regina
at 2019-09-23T09:45
at 2019-09-23T09:45

By Rae
at 2019-09-27T09:37
at 2019-09-27T09:37

By Valerie
at 2019-09-30T22:55
at 2019-09-30T22:55

By Mia
at 2019-10-05T03:32
at 2019-10-05T03:32

By Kama
at 2019-10-05T09:30
at 2019-10-05T09:30

By Ophelia
at 2019-10-09T12:48
at 2019-10-09T12:48

By Candice
at 2019-10-13T21:00
at 2019-10-13T21:00

By William
at 2019-10-17T12:37
at 2019-10-17T12:37

By Rae
at 2019-10-20T22:41
at 2019-10-20T22:41

By Freda
at 2019-10-23T20:56
at 2019-10-23T20:56

By Una
at 2019-10-27T21:14
at 2019-10-27T21:14

By Jake
at 2019-10-28T06:09
at 2019-10-28T06:09

By Ina
at 2019-10-28T15:24
at 2019-10-28T15:24

By Kelly
at 2019-10-29T11:27
at 2019-10-29T11:27

By Linda
at 2019-11-02T23:11
at 2019-11-02T23:11

By Oscar
at 2019-11-07T16:58
at 2019-11-07T16:58

By Michael
at 2019-11-11T00:01
at 2019-11-11T00:01

By Daniel
at 2019-11-11T04:55
at 2019-11-11T04:55

By Oscar
at 2019-11-15T20:22
at 2019-11-15T20:22

By Liam
at 2019-11-17T18:57
at 2019-11-17T18:57

By Puput
at 2019-11-20T00:27
at 2019-11-20T00:27

By Edith
at 2019-11-23T02:05
at 2019-11-23T02:05

By Tom
at 2019-11-25T02:56
at 2019-11-25T02:56

By Zenobia
at 2019-11-26T19:19
at 2019-11-26T19:19

By Gilbert
at 2019-12-01T16:10
at 2019-12-01T16:10

By Erin
at 2019-12-06T02:08
at 2019-12-06T02:08

By Christine
at 2019-12-06T10:37
at 2019-12-06T10:37

By Jacky
at 2019-12-07T02:37
at 2019-12-07T02:37

By Erin
at 2019-12-09T13:51
at 2019-12-09T13:51

By Agatha
at 2019-12-14T13:32
at 2019-12-14T13:32

By Hazel
at 2019-12-17T04:32
at 2019-12-17T04:32

By Kelly
at 2019-12-20T07:04
at 2019-12-20T07:04

By Andy
at 2019-12-24T21:05
at 2019-12-24T21:05

By Christine
at 2019-12-27T22:46
at 2019-12-27T22:46

By Steve
at 2019-12-31T20:42
at 2019-12-31T20:42

By Noah
at 2020-01-03T06:09
at 2020-01-03T06:09

By Ingrid
at 2020-01-06T18:49
at 2020-01-06T18:49

By Donna
at 2020-01-09T21:52
at 2020-01-09T21:52

By Franklin
at 2020-01-13T18:03
at 2020-01-13T18:03

By Ida
at 2020-01-15T21:13
at 2020-01-15T21:13

By Audriana
at 2020-01-18T07:50
at 2020-01-18T07:50

By Donna
at 2020-01-20T22:30
at 2020-01-20T22:30

By Edith
at 2020-01-21T07:00
at 2020-01-21T07:00

By Isla
at 2020-01-26T06:50
at 2020-01-26T06:50

By Tracy
at 2020-01-27T11:33
at 2020-01-27T11:33

By Edith
at 2020-01-28T21:18
at 2020-01-28T21:18

By Isabella
at 2020-01-30T00:28
at 2020-01-30T00:28

By Aaliyah
at 2020-01-31T00:59
at 2020-01-31T00:59

By Freda
at 2020-01-31T18:36
at 2020-01-31T18:36

By Hedwig
at 2020-02-04T10:46
at 2020-02-04T10:46

By Valerie
at 2020-02-08T16:51
at 2020-02-08T16:51

By Rachel
at 2020-02-09T21:49
at 2020-02-09T21:49

By Zenobia
at 2020-02-09T23:33
at 2020-02-09T23:33

By Kumar
at 2020-02-11T10:05
at 2020-02-11T10:05

By Zora
at 2020-02-12T13:22
at 2020-02-12T13:22

By Mason
at 2020-02-15T20:07
at 2020-02-15T20:07

By Rachel
at 2020-02-19T20:21
at 2020-02-19T20:21

By Cara
at 2020-02-23T08:40
at 2020-02-23T08:40

By Irma
at 2020-02-26T14:09
at 2020-02-26T14:09

By Noah
at 2020-02-29T19:57
at 2020-02-29T19:57

By Kama
at 2020-03-02T12:59
at 2020-03-02T12:59

By Lauren
at 2020-03-06T19:50
at 2020-03-06T19:50

By Ina
at 2020-03-11T14:29
at 2020-03-11T14:29

By Ina
at 2020-03-15T17:11
at 2020-03-15T17:11

By Vanessa
at 2020-03-16T12:21
at 2020-03-16T12:21

By Vanessa
at 2020-03-18T15:52
at 2020-03-18T15:52

By Odelette
at 2020-03-21T05:57
at 2020-03-21T05:57

By Daph Bay
at 2020-03-21T15:05
at 2020-03-21T15:05

By Sarah
at 2020-03-22T10:24
at 2020-03-22T10:24

By Damian
at 2020-03-26T14:39
at 2020-03-26T14:39

By Hardy
at 2020-03-28T07:46
at 2020-03-28T07:46

By Megan
at 2020-04-02T05:24
at 2020-04-02T05:24

By Mia
at 2020-04-06T12:19
at 2020-04-06T12:19

By Elizabeth
at 2020-04-09T23:56
at 2020-04-09T23:56

By Ophelia
at 2020-04-12T04:34
at 2020-04-12T04:34

By Puput
at 2020-04-16T13:55
at 2020-04-16T13:55

By Agnes
at 2020-04-18T03:39
at 2020-04-18T03:39

By Zenobia
at 2020-04-19T08:13
at 2020-04-19T08:13

By Charlotte
at 2020-04-19T23:09
at 2020-04-19T23:09

By Rae
at 2020-04-21T23:24
at 2020-04-21T23:24

By Donna
at 2020-04-24T19:11
at 2020-04-24T19:11

By Jacky
at 2020-04-29T02:08
at 2020-04-29T02:08

By Olga
at 2020-05-02T08:31
at 2020-05-02T08:31

By Puput
at 2020-05-04T02:24
at 2020-05-04T02:24

By Charlie
at 2020-05-05T14:43
at 2020-05-05T14:43

By Olga
at 2020-05-09T17:51
at 2020-05-09T17:51

By Kelly
at 2020-05-12T05:09
at 2020-05-12T05:09

By Frederica
at 2020-05-14T03:21
at 2020-05-14T03:21

By Iris
at 2020-05-18T13:54
at 2020-05-18T13:54

By Sandy
at 2020-05-23T05:32
at 2020-05-23T05:32

By Liam
at 2020-05-24T14:49
at 2020-05-24T14:49

By Lydia
at 2020-05-27T17:10
at 2020-05-27T17:10

By Selena
at 2020-05-30T04:01
at 2020-05-30T04:01

By Robert
at 2020-06-02T18:23
at 2020-06-02T18:23

By Gary
at 2020-06-06T10:07
at 2020-06-06T10:07

By Ivy
at 2020-06-08T11:26
at 2020-06-08T11:26

By Una
at 2020-06-10T12:04
at 2020-06-10T12:04

By Linda
at 2020-06-15T09:33
at 2020-06-15T09:33

By Hazel
at 2020-06-18T12:55
at 2020-06-18T12:55

By Kristin
at 2020-06-18T21:50
at 2020-06-18T21:50

By Elvira
at 2020-06-21T10:18
at 2020-06-21T10:18

By Rosalind
at 2020-06-22T13:07
at 2020-06-22T13:07

By Linda
at 2020-06-26T23:45
at 2020-06-26T23:45

By William
at 2020-06-30T21:20
at 2020-06-30T21:20

By Suhail Hany
at 2020-07-02T07:11
at 2020-07-02T07:11

By George
at 2020-07-04T11:27
at 2020-07-04T11:27

By Odelette
at 2020-07-05T04:54
at 2020-07-05T04:54

By Regina
at 2020-07-07T04:40
at 2020-07-07T04:40

By Annie
at 2020-07-09T06:43
at 2020-07-09T06:43
Related Posts
steam上有無自製拼圖的遊戲或工具?

By Andy
at 2019-08-10T10:02
at 2019-08-10T10:02
[ETS2]歐卡2社群活動:Goodyear Roll-Out!

By Leila
at 2019-08-10T08:46
at 2019-08-10T08:46
請問常用的第三方網站

By Skylar DavisLinda
at 2019-08-10T02:13
at 2019-08-10T02:13
【2019 PUBG 全明星賽】訪談篇:最強組合

By Puput
at 2019-08-10T00:01
at 2019-08-10T00:01
《戰爭機器5(Gears 5)》開發完成

By Ursula
at 2019-08-09T23:28
at 2019-08-09T23:28