Hacker finds Steam bug that unlocks free games, collects $20K for reporting it

Security researcher Artem Moskowsky found a Steam bug that gave him access to infinite free keys for any game on the digital distribution platform, but instead of abusing the exploit, he reported it to Valve for a $20,000 reward.

Moskowsky told The Register that he accidentally discovered the vulnerability while browsing through the Steam partner portal, which is the website where developers manage games that may be downloaded on the platform. The security researcher, who has made a career as a bug hunter, noticed that it was easy to change the parameters of an API request, which gave him activation keys for certain games.

The API allows developers to acquire license keys for their games, which they can then pass on to gamers. However, as Moskowsky pointed out, it could have been abused by an attacker who has access to the Steam partner portal to generate an infinite number of activation keys for any game on Steam. It is also pretty easy to pose as a developer to gain access to the partner portal, so practically anybody could have taken advantage of the vulnerability.

Moskowsky said that he entered a random string into the API request to check the severity of the bug. He then received 36,000 activation keys for Portal 2, which is being sold at $10 on Steam, for a total value of about $360,000 in just one command.

The Steam bug has now been recorded on the bug bounty website HackerOne, where it can be seen that Moskowsky reported the exploit to Valve on August 7. Valve took only a few days to patch up the vulnerability, and to award Moskowsky with a $15,000 bounty and a $5,000 bonus.

Valve is lucky that the exploit was discovered by an honest hacker like Moskowsky. The $20,000 reward to Moskowsky is minuscule compared to the possible losses that Steam would have suffered if the bug was widely used by pirates to grab free activation keys for every game on the platform.

Impressively, this is not the biggest bounty that Moskowsky has received from Valve. In July, the security researcher was awarded $25,000 for reporting an SQL injection bug, which was also discovered on the Steam partner portal.

Gaming

The Epic Games store is already luring indie studios away from Steam

The Epic Games Store is less than a week old, but it's already making waves among indie studios. Multiple studios have announced that their games will be timed exclusives on the Epic Games Store, with one studio forgoing Steam completely.
Gaming

Need help getting the Sleeper Simulant in 'Destiny 2'? We’ve got you covered

The Sleeper Simulant is one of the coolest new Exotic weapons you can unlock in the Warmind expansion of Destiny 2, but it's an involved process that will take awhile. Here's everything you need to know.
Digital Trends Live

Digital Trends Live: Amazon Go expansions, the robocall onslaught, more

On this episode of Digital Trends' live morning show, Digital Trends Live, hosts Greg Nibler and Jeremy Kaplan explored the news of the day, including Amazon Go's potential expansion, the robocall onslaught, and more.
Gaming

Apple Mac users should take a bite out of these awesome games

Contrary to popular belief, there exists a bevy of popular A-list games compatible for Mac computers. Take a look at our picks for the best Mac games available for Apple fans.
Gaming

Here's where Xur is and what he has for wares this week in 'Destiny 2: Forsaken'

The weekly vendor in Destiny 2: Forsaken always brings Exotic weapons and armor, some of the toughest loot to find in the game. Here's everything you need to know to track down Xur: Where he is, when he shows up, and what he's stocking.
Gaming

‘Fortnite’ removes the Infinity Blade weapon after player backlash

Following player backlash over the Infinity Blade weapon's inclusion in Fortnite's battle royale mode, Epic Games decided to remove the weapon from the game completely. It was not limited to a special mode.
Gaming

Want every suit in 'Marvel's Spider-Man' for PS4? Here's how to get them all

Marvel's Spider-Man features a whopping 33 different suits for Peter Parker to wear as he swings across New York City knocking out baddies. Here are all the suits and how to unlock them.
Gaming

Everything about 'Red Dead Online', including its new microtransaction store

Red Dead Online will gradually rolled out to Red Dead Redemption 2 players via a beta. We've got all the details about the beta's suite of competitive and cooperative modes, as well as what to expect going forward.
Computing

HDR monitors are beginning to have an impact. Here are the best you can buy

HDR isn't the most common of PC monitor features and is often charged at a premium, but the list of available options is growing. These are the best HDR monitors you can buy right now.
Virtual Reality

Oculus Rift vs. HTC Vive: Prices drop, but our favorite stays the same

The Oculus Rift and HTC Vive are the two big names in the virtual reality arena, but most people can only afford one. Our comparison tells you which is best when you pit the Oculus Rift vs. HTC Vive.
Gaming

Xbox One X vs. PS4 Pro: Which console is more powerful?

Far from cooling down, the console wars are only getting more intense. We compare Microsoft's Xbox One X to Sony's PlayStation 4 Pro to help you decide which premium console is right for you.
Gaming

Find the perfect weapon in 'Call of Duty: Black Ops 4' multiplayer with our guide

Call of Duty: Black Ops 4 has several different guns to choose from in its multiplayer mode, and they're split across multiple classes. Here's a guide to all of them and when you should use them.
Gaming

New ‘Stardew Valley’ content on the way, as game’s maker freezes next project

Stardew Valley creator Eric Barone said that he will continue working on new content for the indie farming simulator. The developer previously said that he will devote all his time to his next game, but that has been placed on hold for now.
Gaming

Underwater survival game ‘Subnautica’ free on Epic Games’ online store

The award-winning underwater survival game Subnautica is currently available as a free download on the Epic Games store. The Steam challenger looks to attract players with a new free game every two weeks.