Security and gaming

Just how big is the video gaming industry?  Big enough that security researchers are looking into things like the security of the protocols used in Steam:

One proof-of-concept demonstrated in the paper is the use of the Steam reinstall feature, an undocumented feature for installing backups from a local directory. This has a splash image processor which, the paper says, has an integer overflow vulnerability that "may allow executing malicious code on the Steam process."

Other undocumented features in Steam include command-line parameters in the Source engine (used by games such as Half-Life and CounterStrike), callable from a URL and also vulnerable; and integer overflow vulnerabilities in the Unreal engine.

Rather a lot of the network traffic at Camp Borepatch is Steam or gaming, so this is of more than academic interest to us.  At Internet Security Startup there was a rule that the engineers weren't supposed to play Quake before 6:00* and we used to joke that we should write Intrusion Detection signatures for Game vulnerabilities.  Little did we know ...

And it reminds me of a friend (a crypto mathemetician) who was studying for her Master's degree (in Mathematics).  She had a bit of trouble at Three Letter Intelligence Agency when she tried to get reimbursed for the Game Theory class she had taken.  The faceless bureaucrat in Personnel thought that she was playing games, rather than trying to solve the Prisoner's Dilemma.