protonscr

Security Flaw: In-home streaming may allow access to entire remote desktop

steamclosed reviewed
ValveSoftware/steam-for-linux#3990 · opened 2015-08-27 by Mecha-Weasel · updated 2015-08-28 · 3 comments · github
MMecha-Weasel 2015-08-27 github

I am not certain if this occurs just on Linux steam clients/servers, or if it also occurs cross-platform. I have only tested it Linux-to-Linux (specifically Ubuntu 14.04 LTS 32-bit to Ubuntu 14.04 LTS 64-bit).

Sometimes, the in-home streaming will allow my streaming client machine full access to the streaming server machine's full desktop. By "full access" I mean I can click around, open other applications, etc. By "full desktop" I mean just that - even across multiple remote monitors.

I have uploaded a sample picture captured on my steam client machine while remotely accessing the streaming "server" machine (for lack of a better word) via Steam:

http://steamcommunity.com/id/Weasel/screenshot/695032538996603561

I believe what I did to accomplish this was just:

  1. Start steaming a game, in this case I was using TF2, but might work with other games.
  2. ALT+TAB out of the game, leaving it running but switching out of that window.
  3. Bingo! Access the remote desktop.

Update: Updated this post to fix some typo's, etc.

MMecha-Weasel 2015-08-28 github

PS: For clarification, that screen-shot was captured on the client using the client OS's built-in screen-capture feature - not Steam's or TF2's screen-capture feature.

Bbjwest 2015-08-28 github

I've noticed this for a long time in Civ 5. I stream to my laptop from my duel monitor desktop. When I scroll to the right (the left monitor is primary) while playing on my desktop, Civ5 will minimize and I'll need to click the icon in the taskbar to bring it back up. This carries over to the laptop, and if I scroll to the right too far, Civ5 minimizes and I get an image of both desktops on the single monitor of my laptop. Again, I'll have to click the icon on the taskbar to maximize the game again.

Sslouken 2015-08-28 github

This is by design. In addition to streaming games, you also have full remote desktop access to the remote computer. If this is an issue, you can disable the streaming feature in the In-Home Streaming settings.

Nothing extracted yet.