Researcher banned on Valve's bug bounty program publishes second Steam 0-day (zdnet.com)

Article summary

A security researcher has published a second zero-day vulnerability in the Steam gaming client after being banned from Valve's bug bounty program on HackerOne. The researcher had previously reported a similar vulnerability, which Valve initially refused to acknowledge as a security flaw, but eventually patched after public disclosure. The incident has sparked criticism of Valve's handling of bug reports and its decision to exclude elevation of privilege vulnerabilities from its bug bounty program. This has led to concerns about the security of the Steam client and the potential risks to its users.

Main themes

• bug bounty programs
• vulnerability disclosure
• security research ethics
• Valve's security practices
• HackerOne policies

What commenters say

• Companies that refuse to fix reported vulnerabilities have no right to prevent public disclosure, as responsible disclosure expects delaying public disclosure only to protect users while a fix is prepared.
• Bug bounty programs should require companies to pay researchers for duplicate reports to incentivize timely fixes and prevent gaming of the system.
• HackerOne's policies and practices are flawed, as they allow companies to mark vulnerabilities as duplicates or out-of-scope, and then ban researchers who disclose them, creating perverse incentives.
• Researchers retain the right to publish their findings, even if rejected by a bug bounty program, and companies cannot retroactively revoke authorized access or threaten legal action for disclosure.
• Mandatory public disclosure of rejected vulnerability reports could be a viable solution, but it may also lead to a loss of customers for bug bounty platforms.
• The current system creates an uneven playing field, where researchers may face legal risks for disclosure, while companies face little to no consequences for refusing to fix vulnerabilities.
• Some argue that bug bounty programs should prioritize transparency and fairness, ensuring that researchers are incentivized to report vulnerabilities and that companies are held accountable for fixing them.