- Oct 23, 2012
- 12,527
Valve updated the Steam gaming client to fix a severe security issue in the application's crypto package that under certain conditions would have allowed an attacker to view a user's password in plaintext if observing network traffic when the user was authenticating on the platform.
Security researcher Nathaniel Theis (XMPPwocky) is the one that discovered the issue and also wrote an advanced technical write-up detailing the attack's steps.
To understand the attack, users first need to know how Steam's cryptography works. Valve designed the Steam crypto module to keep data secret and to authenticate connections so nobody can pass as another user.
Steam keeps data secret by encrypting all sensitive traffic with a session key. This session key is generated with an AES-256-CBC algorithm, encrypted with RSA-1024 plus a hardcoded public key, and then send to Steam's servers, where it is decrypted and used to decrypt traffic coming from the user.
Security researcher Nathaniel Theis (XMPPwocky) is the one that discovered the issue and also wrote an advanced technical write-up detailing the attack's steps.
To understand the attack, users first need to know how Steam's cryptography works. Valve designed the Steam crypto module to keep data secret and to authenticate connections so nobody can pass as another user.
Steam keeps data secret by encrypting all sensitive traffic with a session key. This session key is generated with an AES-256-CBC algorithm, encrypted with RSA-1024 plus a hardcoded public key, and then send to Steam's servers, where it is decrypted and used to decrypt traffic coming from the user.
.
