Is having Steam installed a security risk?

Question

Speaking to one of our security administrators at work, he insists that Steam is a well understood security risk and it shouldn't be installed on work machines.

Saying it's not work related I understand, but is there a genuine security threat from having it installed (and if so broadly what is it), or is this someone providing a fictional reason for not allowing something they just don't want to allow?

(As I say, I'm not disputing their right to say what should and shouldn't be installed, just trying to understand the reasons).

Answer 1

From what I can tell, there have only been two serious public vulnerabilities in Steam.

• Markup injection (XSS) from steam:// links
• HTTPS man-in-the-middle attack

Neither are current. I can't see any real risk. However, since Steam is completely unnecessary at work, it's a minor potential risk that could be avoided.

Most likely, he's nit-picking because he doesn't think having Steam installed is appropriate at work, but he doesn't want to be the bad guy.

Answer 2

Steam should be treated just like any other application installed on a business computer. Ask yourself if it is needed to perform your job correctly.

When your computer has more software install, it has more areas it can be attacked.

• Steam may not have a vulnerability now, but they may accidental release an update that will have a vulnerability in it.

• There may be 0-day vulnerabilities in steam that are not yet released to the public.

• A hacker may be able to get into the Steam code and make some modifications that will allow a backdoor with all updated Steam client.

With this in mind, not having Steam installed will prevent any of those vulnerabilities.

Furthermore, good system administrators will remove any unnecessary programs or services for servers or workstations.

Go though a thought process like the following:

• Does my windows 7 machine need Bluetooth?
• Is it enable or enabled by default?
• If my system is compromised, is my data still safe?
• How much money should I invest in preventing an intrusion?

Of course if you develop the steam software or develop software that uses steam, you probably should have it.

Answer 3

Stream itself may or may not be a risk, but let's not forget that it installs other programs (games), and those will very likely have security vulnerabilities.

Answer 4

Steam records game usage, time and other game characteristics. In addition, Steam reports configuration details and all installed applications. So, Steam can be considered as a spyware itself when the configuration or the installed applications are an important strategy key of the company.

Answer 5

Anytime you install an application, you increase the attack surface for that box. This is true even in the case of antivirus. Obviously there are times when this is absolutely necessary and proper risk analysis should be completed to determine whether or not an application should become a standard for the environment.

On the other hand, we security professionals have a nasty habit of spreading FUD (Fear, Uncertainty and doubt). That is to say we make policy, rules or decisions without applying any validation to the root cause.