JACK WHITHAM PhD MEng
 Professional Activities - Publications - Software - Articles 		   
       
    Home -> Articles -> How to harden the security of Source Engine games on Steam    

Introduction

Valve's Steam platform is "iTunes for games"; an online shop where you can buy, download and play a wide variety of games. Steam is excellent, but there is a security problem which bothers me.

Most Steam games are hosted on third-party servers. Games including Counter-strike Source and Team Fortress 2 are sufficiently popular that Valve can rely on the players to set up and run the servers that host them. A certain amount of customisation is possible, and many server administrators install "plugins" to add features such as voting and modify game rules. But administrators are not limited to changing the game itself. They can also cause web pages to open within the game.

What's the problem?

A web page opens when a player connects to a server: this page usually has information about the server. It appears in a mini browser window which is actually Internet Explorer, "embedded" in the game. This mini browser shares every security hole that might exist in Internet Explorer, which has a notoriously poor security record as an Internet search will tell you. Just as a malicious website or ad banner could install malware on your computer, a malicious game server could do the same. This would be a great way to steal Steam usernames and passwords.

Server administrators can also send commands to open a web page on your machine as you play. For example, Mani's Admin Plugin for Counter-strike Source provides the "ma_browse" command. Using "ma_browse", a server administrator can cause any webpage to open on any player's computer, using Internet Explorer. It makes no difference if you usually use another browser, such as Firefox: Internet Explorer is always used.

What can I do?

My suggested solution to this problem is to block Internet Explorer from accessing the Internet. (Warning -- there is a caveat below which you should read before you try this.) Unfortunately a complete block will break the Steam application and also prevent custom map downloads. You need an incomplete block, so that only a short "whitelist" of trusted sites can be displayed. In particular, you will want your whitelist to include the following:

The last is required for custom map downloads - note that another useful side-effect of the whitelist is that music files won't play when you join a server, which is almost certainly a good thing.

There are probably many ways to implement the whitelist, but I recommend the following:

Danger! -- you are changing the global Windows proxy settings. These don't affect Firefox or Windows Update, and Steam works normally, but many other Windows applications are affected, including Opera, and some VOIP programs and instant messengers. If you use these applications and they don't work properly, you should right click on the Privoxy icon in your system tray and untick Enable. Then your applications will work normally. Tick Enable again when you are playing a game.

Another option is to add new web sites to the whitelist by editing "user.action". This is time consuming; I don't recommend it.

Conclusion

Privoxy provides a neat way to filter Internet access from Internet Explorer, enforcing a whitelist of permitted sites. This allows you to be sure that game servers are not able to infect your computer with malware while you play. Hopefully, the ability to disable the Internet Explorer mini browser will be built into Steam at some point in the future.


       
  Copyright (C) Jack Whitham 1997-2008