TECH NEWS – A security researcher noticed a security gap in Valve‘s system, and Gabe Newell’s company paid him for his discovery.

Valve had a flaw that could have significantly hit the company’s income, because if more people knew about it, then the Steam wallets would have held a lot more money than they were supposed to. In short, the flaw allowed anyone to falsify the amount the wallet had. For instance, you could have turned a one-dollar deposit into a one-hundred-dollar deposit, which is a 100x difference… and since Valve is nowadays spending a lot of money on manufacturing the Steam Deck, it would have hurt them badly.

How could this exploit be used? It was accomplished by changing the account’s email address to one including “amount100,” then intercepting a message to a payment company API (Smart2Pay). If you made both of these moves, you could fake the amount your wallet had.

The writeup for the hack was then posted on white-hat hacking bug bounty site HackerOne by the handle drbrix. (Don’t worry, white-hat hackers are ethical hackers who notify the company whose flaws they discovered. So nothing harmful.) Valve noticed the issue, and they looked into the case to see if they can recreate the defect.

Drbrix first posted the bug as a “medium” priority, saying, “I think the impact is pretty obvious, an attacker can generate money and break steam market, sell game keys for cheap, etc.” (So it would have gone into not just GREY market reselling but the BLACK market, given how the keys would have been created for a fracture of the price…) Valve then tested the exploit, tried a fix, and subsequently upgraded the bug to “Critical” severity. It was followed by a 7500 USD payout, “reflecting the potential cost to the business. We hope to hear more from you in the future,” the Valve staff said.

“Thanks to the person who reported this bug, we were able to work with the payment provider to resolve the issues without any impact on customers,” Valve told The Daily Swig. Still, they did not say whether anyone had abused the potential exploit.

Source: PCGamer