Possible Spyware on games from Steam using Steamworks.net

[Lisias]

Guys.

Just came to my attention that Steams users, apparently, are susceptible to an attack to their privacy by Steam's games using Steamworks.net .

As it appears, Steamworks.net is sending information to survey-smiles.com , currently under the IP 199.59.243.222 .

I can't confirm this yet because, besides had bought KSP on Steam, I download my games using download_depot on the Steam Client's Console and install them manually.

In the mean time, the best defense is to block the offending site (or its IP) on your firewall. Steamworks.net is open source, so it's possible to recompile it ripping of the offending code - but Steam will happily overwrite your changes as soon as you update the game or verify the installation - but if you are like me and install everything by hand, an alternative Steamworks.net binary without spyware could be a nice side project to someone with some time to burn!

— EDIT —

It came to my attention that, perhaps, Steamworks.net could be being compromised on the user's machine, perhaps by virii, perhaps by code injection!
— — — — 

Cheers.

Edited January 16, 2023 by Lisias
EDIT

[Mahnarch]

I manually install my games with some good ol' fashioned duct tape and staples.

 

Thanks for the heads up, though! 

[Nazalassa]

Good thing I don't use Steam.

Spoiler

I'll say it again: never trust big companies like that. Never trust Microsoft, Apple, Google, Meta, all that sort of things. They would do anything for money -- including spying of course.

[Deddly]

6 hours ago, Lisias said:

can't confirm this yet

Where did you get the information from? 

[Lisias]

50 minutes ago, Deddly said:

Where did you get the information from? 

From the Steam Forums. Many players from many games are complaining about this in the last weeks, and I found this post about a guy saying it zeroed it on the Steamworks.NET.

I don't know if this stunt is being pulled by someone at Steam, or if 3rd parties managed to inject malicious code on the Steamworks.NET on the user's machine (virii?) to do that - and I don't even know if this affects only Windows users or also Linux and MacOS.

I decided to post this here because KSP is listed as one of the games using Steamworks.NET and people here is usually way savvier on this field than the community of most games I'm aware - so the chances of getting this settled/confirmed/whatever here is IMHO way higher than on Steam Forums.

I did a quick search on the github repo for "survey" and "survey-smiles" but, obviously, didn't found anything. At least, yet.

Edited January 16, 2023 by Lisias
Clicked "Save" too soon.

[Rutabaga22]

Good thing I pull ksp out of my steam directory