So this vulnerability isn't directly the result of using Steam, or any of the Steam profile customizations, such as avatars and profile page backgrounds. But rather, it is a vulnerability in a third-party application "Wallpaper Engine" which is available on Steam.

I recall when screen savers were a common malware vector on Windows. I suppose everything old is new again.

▲

nottorp 4 hours ago | parent | next [-]

First thing I thought of when I saw the title was "since when does Steam have wallpapers?".

The article is at the least titled misleadingly and an attempt to sell fear.

▲

wnevets 4 hours ago | parent | prev | next [-]

Why do you need an "Engine" for wallpapers in the first place?

▲

jjmarr 3 hours ago | parent | next [-]

So you can have an animated or interactive "wallpaper". The malicious wallpapers in the OP are hentai games.

▲

wincy an hour ago | parent | prev | next [-]

I use them because they look nice and with an OLED I wanted a dynamic wallpaper so I wouldn’t get screen burn in. There is adult stuff but everything I use is just video games and matrix scrolling patterns, that kind of stuff, so I can tell my monitor is on without getting burn in. I’ve got a high end desktop so can take the minor performance hit running it all the time.

Unfortunately seems like I’m going to be uninstalling it.

▲

_--__--__ 3 hours ago | parent | prev | next [-]

The 'wallpapers' in question are pirated games made in renpy (python game engine) or rpgmaker (js based), which makes them a really good vector for malware. As another commenter noted this is a bizarrely common way for Chinese people to get porn through the great firewall.

	▲	tsol 3 hours ago \| parent [-]
		Why would that be the only way to get porn that they don't crack down on?

▲

nosioptar 3 hours ago | parent | prev | next [-]

Opensuse (pre 11 iirc) used to have a really cool background where the lighting changed throughout the day, that probably used an engine of some sort.

▲

wongarsu 3 hours ago | parent | prev | next [-]

Because they are not static images. That's the whole gimmick

▲

some_random 3 hours ago | parent | prev [-]

Because it's one of the only ways to get porn in China

▲

raincole 3 hours ago | parent | prev | next [-]

It's not completely unrelated to Steam though. The malicious code is delivered by Steam Workshops. It might or might not be justified to put 'Steam' on the title, but it's par on HN standards (people always put 'npm' on the titles when there is a supply chain issue.)

▲

ASalazarMX 3 hours ago | parent | prev | next [-]

I'm still waiting for the new generations to rediscover screen savers.

▲

fckgw 4 hours ago | parent | prev [-]

The malicious wallpapers, which use "Wallpaper Engine" are also published through Steam Workshop. It's still a Steam problem.

▲

gchamonlive 3 hours ago | parent [-]

Irrelevant comment, op said "this vulnerability isn't directly the result of using Steam", not that steam doesn't share responsibility

	▲	wccrawford 3 hours ago \| parent [-]
		It said they are "on Steam" which is true. They are distributed through the Steam Workshop, which Valve runs and attempts to protect from abuse. While it's not as high-profile as the official profile backgrounds and avatars, it's still in an area that most gamers would think was safe by default, since Valve moderates it.