The patched Steam exploit allows players to add unlimited money to their Steam wallets • Eurogamer.net

[ad_1]

We hope to hear more from you in the future.

Valve awarded a security researcher $7,500 for reporting a bug that allowed players to forge balances in their Steam wallet.

As spotted by The Daily Swig, researcher “drbrix” reported the exploit via HackerOne, stating that they “discovered [a] A vulnerability that allows an attacker to create a Steam wallet balance.” The bug — which has since been resolved — would allow players with a “100 sum” in their Steam account email address to artificially intercept and inflate payments made via Smart2Pay (thanks, NME).

After detailing how the exploit was created, Valve’s JonP immediately thanked drbrix and agreed that the team at Valve were able to “verify that this is happening largely as described,” and were taking steps to address it.

After inviting drbrix to try the exploit again after screening through Valve, JonP awarded the reporter a $7,500 bounty – about £5,400 – and upgraded the issue from moderate to critical.

“Thank you for that report,” John B said. “This was clearly written and was helpful in identifying the real business risks. We changed the risk rating to ‘Critical’, which reflects the potential cost of the business, and applied a bonus accordingly. We hope to hear more from you in the future.”

At the time of writing, there is no word from Valve if the vulnerability has been abused by hackers, or if it has managed to improve the problem before it can be abused.

ICYMI, Valve posted its first video on its official YouTube channel in eight months: “Introducing Steam Deck”.

As Wes summarized yesterday, the video is a live recap of Valve’s upcoming handheld features, and it briefly outlines the state of the device.

Demand for Steam Deck remains strong, with availability being delayed shortly after bookings became available. Check out Digital Foundry’s Steam Deck analysis for more information.

[ad_2]