Hacker News Reader

Comment by dx87 | Hacker News Reader

I'm not suprised at the response they got when they reported the vulnerability. Somebody reported an XSS vulnerability in the Dota 2 UI, and they wouldn't fix it. So (probably the reporter) created a worm in the client that spread through your friends list in game and defaced the client. People also found out you could crash the client by using the XSS to download very large images. There was no way to protect yourself either, because messages from friends are automatically displayed with no user interaction.

View on HN

I like to say "The capabilities of attackers are not bounded by your imagination."

It is possible to get a "security bug" that is technically a security bug, but still isn't really all that important. But you generally want to be very careful in making that assessment, because just because one particular person, even someone fairly skilled in security, doesn't think it can be used to do anything truly harmful doesn't mean that the attackers won't figure something out.

XSS has been a particular rich source of this; it's very easy for someone not too up on security to say "Oh, whoopdedo, it lets you pop up an alert box or change the client side display", when in fact XSS can steal login cookies if you haven't properly secured them (which seems likely to correlate highly with people who don't think XSS is a big problem) and be used to proxy web connections to other resources in the context of the user, conforming to the same-origin policy [1]. So, for instance, with the recent story about a guy finding an XSS in Tesla's service management page, they were correct to respond to that as a serious issue; it wasn't just a way of moderately inconveniencing a service tech, it was a back door into their entire service system, potentially. XSS has a huge mismatch between the general developer's impression of its severity and its actual severity.

[1]: https://github.com/beefproject/beef/wiki/Tunneling

I think the Tesla example you gave serves your point particularly well, because the researcher himself didn’t even know that there was a vulnerability until several weeks after he had placed a probe and someone in Tesla accessed an internal page.

I found XSS in Steam, reported via ticket and email, eventually posted on their forums and found my steam account disabled. It took them 3 weeks and repeated attempts to contact them for them to silently reenable my account.

The XSS was in the screenshot viewer. Names of Source Mods were not escaped. Their fix was to never show Source Mod names on Steam Community at all.

I wonder if that's something to do with their famous lack of hierarchy. A bit hard to tell someone to fix it if you are all equals.

I remember at some point while playing, the main page of the dota 2 client was full of porn. I thought my DNS cache was poisoned at the time, and now, some years later I find out it was an exploit.

I seem to remember that it spread through 4chan on the /vg/ board, someone there found that you could make text look differnt and then it began rolling until someone made a worm. I am not sure it was reported to valve beforehand.

Yeah, it's been fixed a couple of times, but future updates would occasionally cause a regression. There was someone who had been paid for multiple vulnerabilities though HackerOne, but was upset that they didn't get paid for this one, so they showed people how to do it.

Reply on news.ycombinator.com