[ad_1]
The game's giant Valve called the refusal of a security researcher who reported a vulnerability in the company's Steam game client "an error".
A representative of Valve said ZDNet In an email today, the company sent patches to the Steam client, updated the rules of its bug bonus program, and is currently reviewing the researcher's ban on its bug bonus program. public.
The debacle of bug reports
The company's reaction comes after being criticized for its poor quality, and the HackerOne staff (where Valve runs its bounty program) has processed a vulnerability report in the Steam gaming client.
The bug report was filed by Russian security researcher Vasily Kravets last month, but HackerOne staff told him that the bug was out of reach of the program and that Valve had no intention to correct it.
The bug was a Local Privilege escalation (LPE) issue, which is not as dangerous as a Remote Code Execution (RCE) vulnerability, but still dangerous, because it allows malicious programs already on a computer to use the Steam application to gain administrator rights and take full control of a host.
Although Valve did not intend to fix the bug, HackerOne staff banned Kravets from publicly disclosing the vulnerability, meaning that tens of millions of Steam users would remain vulnerable to attack.
Kravets finally revealed details about the vulnerability and was banned from Valve's bug premium protection program.
Valve sent a fix for the bug leaked by Kravets, but another researcher found a way to get around it within hours.
Kravets then posted information about a second Steam LPE customer on its website, not being able to report it via the company's bug bonus program.
In all of this, Valve found himself face to face with a cake, considered a nasty company that did not want to pay a bonus reward and for banning a researcher from reporting a dangerous bug. .
Valve Modifies the Rules of the Bounty Program
Most of the discussion and criticism of Valve was that the company was unaware of the vulnerabilities of LPE, a class of security holes that almost every company corrects in their products.
But in an email to ZDNet Today, Valve has called all this a massive misunderstanding.
"The rules in our HackerOne program were intended only to exclude reports that Steam was asked to launch malicious software previously installed on a user's machine as a local user," Valve said.
"Instead, a misinterpretation of the rules also led to the exclusion of a more serious attack that would also have caused a rise in local privileges via Steam," he added.
"We have updated our HackerOne program rules to explicitly state that these issues are in scope and should be reported."
Valve will review the researcher's ban
The spokesman also said that refusing Kravets' first report "was a mistake" and that the company is currently reviewing the situation to determine the measures to be taken.
Asked earlier today, Kravets said ZDNet that he was still banned from Valve's HackerOne bug bonus program.
Valve also provided new patches for the two Valve zero-days found by Kravets in an update of its beta client. Once tested and reviewed, these patches will be merged into the primary client.
Earlier this year, HackerOne rated the Valve Bug Bonus Protection Program as the ninth among the top 20 best bug management programs running on its platform.
"Over the last two years, we have worked with 263 community safety researchers and we have rewarded this research, helping us identify and solve about 500 security issues, by paying more than $ 675,000 in premiums," he said. said Valve.
[ad_2]
Source link