Skip to main content

Teen hacker exposes security flaws by publishing unapproved game on Steam

steam
Image used with permission by copyright holder
A teenager revealed security holes in Valve’s developer site that allowed him to upload a game about watching paint dry to Steam without any approval.

Ruby Nealon, a computer science student in the U.K., discovered that the Steamworks site’s approval process could be skipped when he uploaded his game Watch Paint Dry, a riveting role-playing adventure in which the gamer watches paint dry.

steam-watch-paint-dry
Image used with permission by copyright holder

Nealon detailed his experiment on Medium. First he managed to obtain an account on Steamworks and some in-game trading cards last month. Then he found flaws in the HTML form data that was being sent to Valve’s servers, which allowed him to alter the code into the thinking his cards had been approved by an editor. After that he was able to spoof his session ID number and publish the game.

Recommended Videos

The student has already been in contact with Valve and the holes were plugged before he went public. It was never his plan to cause any problems for other users or attempt to sell the game to anyone, he added. (And after all, who would buy it?) It was instead always his intention to expose the holes and he has also purposefully omitted some particular details on how he pulled this off.

Please enable Javascript to view this content

“Something I’ve definitely learned from doing this is when working with user-generated content that first needs to be approved, do not have ‘Review Ready’ and ‘Reviewed’ as two states of existence for the content,” said Nealon in his advice to Valve and other sites in the future.

“Instead, maybe take an approach where the review of the item has an audit trail by giving each piece of content a ‘review ticket’ or something similar and not allowing the content to switch to the Released state until there is a review ticket for the content,” he said. “Or just don’t allow users to set the item to ‘Released.’”

Jonathan Keane
Former Digital Trends Contributor
Jonathan is a freelance technology journalist living in Dublin, Ireland. He's previously written for publications and sites…
7 excellent game deals you can’t miss during Steam’s Xbox publisher sale
Raz runs on a colorful stage in Psychonauts 2.

Like a lot of modern gamers, I'm an Xbox Game Pass subscriber. I get a lot out of the subscription service, using it to play everything from Microsoft's first-party exclusives to smaller indie sensations like Citizen Sleeper. There's just one downside to that: I don't own any games I play on it. If Microsoft decided to pull a game like Forza Horizon 5 one day, I'd have to shell out if I ever wanted to continue my progress. It's a peculiar side-effect to the gaming subscription era, one that still makes me eager to buy any Game Pass title I love.

If you're in the same boat as me, Steam can help. The PC storefront is currently running an Xbox Publisher Sale, which features major discounts on some of Microsoft's biggest titles. From now until May 4, you'll find heavy hitters like Halo Infinite and Gears 5 discounted. What's particularly eye-catching is that tons of excellent games are currently on sale for $20 or less -- with some of Xbox's best exclusives selling for as low as $5. If you're looking to buy some of your favorite Game Pass titles, here are seven deals you should know about (you can grab all of them for just over $86).
Psychonauts 2 -- $20.39

Read more
Updated Steam mobile app lets you download games from your phone
The Steam remote mobile app shows details for Control.

Valve has released the updated Steam mobile app on Android and iOS, revamped with improvements to its framework and user interface design. The new and improved app also comes with new features, including the ability to download Steam games remotely from your phone and log in with a QR code.

Introducing the updated Steam Mobile app

Read more
Why I sold my gaming laptop to buy a Steam Deck
A Steam Deck sitting on top of a PC.

After waiting for almost a year, I finally have a Steam Deck. I've been excited about this device since Valve first announced it, and although the Steam Deck has some problems, I love using Valve's handheld gaming PC. I love it so much, in fact, that the Steam Deck is replacing my Razer Blade 15 -- a gaming laptop that costs over four times as much.

I won't pretend like the Steam Deck is as powerful as a proper gaming laptop, or that it will kill gaming laptops overall. Calm down. But for me, I can't find a reason to open the lid on my Blade now that the Steam Deck is in my hands. Here's why.
Less powerful, more practical

Read more