Skip to main content
  1. Home
  2. Computing
  3. News

Steam community site suffers profile vulnerability but Valve makes quick fix

Mark Coppock
By

steam community site suffers profile vulnerability steamdev
Image used with permission by copyright holder
If you’re any kind of PC gamer, then you likely frequent Valve’s Steam service to procure at least some of your games. And if you’re a Steam customer, then you likely spend some time on Steam’s community site — and until just recently, that might not have been the safest place to be.

It appears that the Steam community site suffered from an exploit involving user profiles that could redirect users to alternate pages and download PHP code, Ars Technica reports. Valve was able to fix the exploit soon after it was announced, but not before a number of people had created profiles that exploited the vulnerability.

Recommended Videos

The exploit was first identified on the Steam subreddit, described as such:

Related

“Currently, there is a risk (i.e. phishing, malicious script execution, etc.) involved when viewing or simply opening PROFILE pages of other steam users as well as your OWN activity feed (both desktop and mobile versions on all browsers including steam browser/chromium). I would advise against viewing suspicious profiles until further notice and disable JavaScript in your browser options. Do NOT click suspicious (real) steam profile links and Disable JavaScript on Browser. Appropriate information has been forward to Valve and this issue should be resolved soon, sorry for any inconvenience.”

Since that post was first created, Valve was able to fix the exploit and was able to classify Steam profiles and activity feeds as safe to visit. The exploit was subsequently explained in full in a follow-up Reddit post. Steam has more than 125 million users and any exploit on the Steam community site could have serious repercussions.

Apparently, the chances of long-term problems caused by the vulnerability were slim, but nevertheless, anyone who might have suffered from the exploit while it was live is recommended to turn on two-factor authentication, keep up with Valve’s official channels for more information, and, of course, change their Steam password.

Editors' Recommendations

Topics
Mark Coppock
Mark Coppock
Computing Writer
Mark has been a geek since MS-DOS gave way to Windows and the PalmPilot was a thing. He’s translated his love for…
Valve is reviewing every game on Steam for the Steam Deck
Two players using Steam Decks to play Stardew Valley.

To make sure that players aren't disappointed once they finally have their Steam Decks, Valve has said it would test every single game on Steam for the handheld console. The statement comes as part of a larger post regarding the Steam Deck's verification process, which grades games based on their performance on Valve's console.

There are four grades that games can get, ranging from Verified, which means a game can simply be played on a Steam Deck with no issue, to Unsupported. While a large number of games will either be Verified or at least Playable, which means users can play the game after some tooling around with controller configuration, a solid chunk of Steam games will be completely unsupported. Specifically, Steam Deck users won't be able to tape the console to their heads and play VR titles, although that should be a given.

Read more
Valve reveals Steam Deck internals, showing how hard it is to upgrade
A Steam Deck lying on a gridded table with its back panel removed.

The Steam Deck is Valve’s hotly-anticipated Switch-like handheld, and we finally have a look at the console’s internal hardware. As originally reported by videocardz.com, Valve has released an official teardown video showing the components and how to replace some of the more prominent parts.

Well, it’s not a teardown video in the traditional sense. The video mainly shows users how to replace the thumbsticks and the SSD, but it gives a great look at the components overall. The video also claims that it is showing why users shouldn’t do this on their own.

Read more
No, Valve’s rumored SteamPal won’t be a Nintendo Switch killer
how to play steam games on android valve link v2

A Nintendo Switch killer may be in the works … or another attempt at one, at least. Ars Technica reports that Valve is working on a portable console code-named SteamPal.

Details on the rumored project are a little hazy. Ars Technica says that multiple sources confirmed that the hardware has quietly been in development for a while now. That report was backed up this week when SteamDB operator Pavel Djundik found references to the device in a Steam update.

Read more