If you were watching Steam over the weekend, you may have been among those to notice an odd game called "Watch paint dry" go up on the popular digital storefront. The "sports-puzzle game that evolves around one mysterious cutscene" wasn't a new low-point in Steam's increasingly permissive attitude toward letting games onto the service. Instead, it was the result of a now-patched exploit that let developers sneak games onto Steam without Valve's approval.

A teenage British Web developer going by the handle Ruby outlined the hacking process in a post on Medium earlier this week. Even before being fixed, this exploit wasn't available to any random Internet user, though, since it relied on access to the Steamworks Developer Program.

With that access secured (through unstated means), Ruby dove into the HTML for the Steamworks backend to look for weak points. By forcing an "editor ID" variable passed through the page to "1" (which Ruby assumed would be "someone who might work at Valve"), Ruby was able to access a new form that revealed the form data he needed to get an "approved" value for Steam Trading Cards, a first step in making his game look legitimate.

From there, actually getting around the usual review queue Valve uses to approve potential Steam games was relatively easy. By passing his browser's now faux-authentic sessionID variable to SteamWorks' well-documented "ReleaseGame" function, Ruby got the service to accept "Watch paint dry" without the knowledge or approval of anyone at Valve. The security lesson, as Ruby puts it succinctly: "Take an approach where the review of the item has an audit trail by giving each piece of content a 'review ticket' or something similar and not allowing the content to switch to the Released state until there is a review ticket for the content. Or just don’t allow users to set the item to 'Released.'"

Though the vulnerability has now been fixed, this is far from the first time Steam has proven vulnerable to attacks and data breaches through similar exploits. Back in 2013, Ars discovered a simple method to reveal personal information about Steam accounts that had been set to "private," leading Valve to patch the security hole. Before that, security researchers at ReVuln detailed an attack that let hackers potentially insert malicious code onto a PC through Steam's browser protocol. More recently, Steam has seen account takeover exploits and DDoS caching issues that revealed personal user pages to strangers.