This 16-year-old hacked Steam to promote his rather stupid game on his system
The young hacker exploited a vulnerability in Steam to publish his 45-second "game" without a single person regulating Valve taking it up.
Ruby Nealon, who created the game called Watch Paint Dry, which is a game where you watch paint dry, uploaded it to the website without going through Greenlight or getting a seal of approval from Valve. Thanks to Nealon, the vulnerability has now been patched.
Help them fix this backdoor on Steam.
"I've been in contact with Valve who have now patched the vulnerability," Nealon wrote at the end of a post. "I was responsible for Watch Paint Dry. Getting caught was part of my plan. It was just a prank, bro!"
However, Nealon reported on his incredible hack on Medium. So how did he manage to publish his game on the site? First, he obtained a Steamworks account through some unspecified means. Nealon then manipulated a javascript function on Steam, adding his app ID from his trading cards to make Watch Paint Dry appear in the store. Once this was done, the game was in the New Releases section of Steam.
“One thing I’ve definitely learned from this is that when you’re working with user-generated content that needs to be approved first, you don’t have “Review Ready” and “Reviewed” as two states for the content. Instead, you might approach the point where the review of the item has an audit trail, giving each piece of content a “review ticket” or something similar and not allowing the content to be Released until there’s a review ticket for the content. Or just not allowing users to set the item to “Released.”.
