Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Speaking to one of our security administrators at work, he insists that Steam is a well understood security risk and it shouldn't be installed on work machines.

Saying it's not work related I understand, but is there a genuine security threat from having it installed (and if so broadly what is it), or is this someone providing a fictional reason for not allowing something they just don't want to allow?

(As I say, I'm not disputing their right to say what should and shouldn't be installed, just trying to understand the reasons).

share|improve this question
11  
If your company has to worry about NIST compliance, look at SP 800-53 for CM-07 "Least Functionality". –  Iszi Jul 26 '12 at 14:38
    
I'll assume that your company doesn't manufacture, develop or support video games... –  makerofthings7 Dec 29 '12 at 14:08
1  
I'd like to point out that Steam also provides "non-game" software, so this isn't just about people who'd like to faff about at work. –  TheTerribleSwiftTomato Feb 27 at 21:03
add comment

6 Answers

Of course it is.

I have no doubt that there are vulnerabilities in Steam. Why would you think game developers are magically capable of writing secure C/C++ code, when no mainstream OS developers have been able to do so, despite that they are largely security focused?

I used to make cheats for Crysis, and accidentally stumbled across a format string vulnerability. This was a highly acclaimed game, and yet I found a vulnerability in it without even trying. Around the same time, Luigi Auriemma was finding vulnerabilities in top titles like Call of Duty 4, Halo, Quake 3, and various game tools like Ventrilio. He found tons of vulnerabilities in all these products like it was nothing. There must be tons more.

So it's safe to say that there are tons of vulnerabilities in games and related products such as Steam, and people most likely do have 0days for them, not to mention Steam devs or anyone selling a product over steam could choose to distribute malware to you.

It's still rare that you see 0days published for Steam and video games in general, so unless you are a worthwhile target, you probably aren't going to get exploited this way.

share|improve this answer
add comment

Steam should be treated just like any other application installed on a business computer. Ask yourself if it is needed to perform your job correctly.

When your computer has more software install, it has more areas it can be attacked.

  • Steam may not have a vulnerability now, but they may accidental release an update that will have a vulnerability in it.

  • There may be 0-day vulnerabilities in steam that are not yet released to the public.

  • A hacker may be able to get into the Steam code and make some modifications that will allow a backdoor with all updated Steam client.

With this in mind, not having Steam installed will prevent any of those vulnerabilities.

Furthermore, good system administrators will remove any unnecessary programs or services for servers or workstations.

Go though a thought process like the following:

  • Does my windows 7 machine need Bluetooth?
  • Is it enable or enabled by default?
  • If my system is compromised, is my data still safe?
  • How much money should I invest in preventing an intrusion?

Of course if you develop the steam software or develop software that uses steam, you probably should have it.

share|improve this answer
add comment

Steam records game usage, time and other game characteristics. In addition, Steam reports configuration details and all installed applications. So, Steam can be considered as a spyware itself when the configuration or the installed applications are an important strategy key of the company.

share|improve this answer
add comment

Anytime you install an application, you increase the attack surface for that box. This is true even in the case of antivirus. Obviously there are times when this is absolutely necessary and proper risk analysis should be completed to determine whether or not an application should become a standard for the environment.

On the other hand, we security professionals have a nasty habit of spreading FUD (Fear, Uncertainty and doubt). That is to say we make policy, rules or decisions without applying any validation to the root cause.

share|improve this answer
add comment

Stream itself may or may not be a risk, but let's not forget that it installs other programs (games), and those will very likely have security vulnerabilities.

share|improve this answer
add comment

From what I can tell, there have only been two serious public vulnerabilities in Steam.

Neither are current. I can't see any real risk. However, since Steam is completely unnecessary at work, it's a minor potential risk that could be avoided.

Most likely, he's nit-picking because he doesn't think having Steam installed is appropriate at work, but he doesn't want to be the bad guy.

share|improve this answer
5  
+1 for not wanting to be a bad guy - if he wanted to be a jerk, he could just say "You shouldn't be playing video games at work!" really loudly, in front of your boss –  BlueRaja - Danny Pflughoeft Jul 27 '12 at 3:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.