

1.7M DiRT 3 keys leaked from AMD promo due to missing .htaccess - waffle_ss
http://amd4u.com/dirt3promo/keys/

======
genbattle
I don't know how they'll resolve this...

Ban all the steam accounts of people who've activated the keys? They'll get a
whole lot of people who legitimately submitted hardware keys at the same time.

Invalidate/revoke the keys from steam? The hardware IDs they were using to run
the promotion are still going to be out there in the wild, so they can't re-
run the promotion, this would just minimize their losses in terms of lost
profit.

As far as the keys being in plain text on the server, this doesn't even make
sense from the perspective of how you design a web app; why not put the data
on a separate remote/secure server? Why not at least encrypt it? Also, how are
they matching the hardware IDs to the keys when people submit the official
promo; are they actually doing a search through each text file to find the
matching hardware key? The .htaccess mis-configuration is bad enough, but it's
not the only issue here.

------
citricsquid
Keys on the left activate on Steam. I'd personally recommend against using
one, although they are supposed to be consumed by the public (they're
available if you enter your details, it's not as if these were supposed to be
charged for) if AMD request it Steam will revoke them and it has the
_potential_ to put your account in bad standing (although v. unlikely)

~~~
Fliko
They've already dealt with similar problems and haven't put any accounts into
bad standing. The good standing/bad standing is more for VAC anyways.

------
klodolph
This is really not the proper way to report a vulnerability.

~~~
citricsquid
It has been _all over the internet_ for most of today, the original list was
leaked and now someone has leaked the directory.

------
nathanhammond
The other piece that everybody seems to be missing is that they've just leaked
the unique IDs for every eligible AMD product. I don't know if those can be
abused in some manner, but those are out there too, now.

------
Culver
Mine worked, thanks I guess? Already own the game for XB360.

