Steam Workshop/Game Safety

Question

Alright, so this is my first post so I apologize for any errors. I'm not sure if I should post this here, or on the security thread.

Basically, I'm wondering how safe the steam workshop actually is. Don't get me wrong, I've been on steam for a long time and have gained several thousand hours on some games, but I'm still curious if there is any chance of getting a virus from steam workshop mods. I've researched this question a bit before, and I have seen answers saying "Steam scans the stuff on the workshop" (which i kinda doubt) or answers such as "The game is running the file, and therefore can't make any changes to the system its self, the worst the mod can do is crash your game or delete game data"

I kinda wish this was easy to believe, but I've read you can get a virus or malware from the meta data of a picture (hasn't happened to me personally). The picture is opened in a program that I don't see any reason should be able to change anything on the system, yet it can give you a virus. Therefore, I don't really see how the game will not be able to infect the computer.

Also, I wonder the same thing about joining servers in games such as tf2.

Please tell me if I'm wrong on anything, or did anything wrong. The more detailed answers the better, and thanks ahead of time.

Answer 1

I don't think you're going to like the answer, but...

...it depends entirely on the game. Or more specifically, on how the game developer integrated workshop features.

The more a game allows workshop items to do, the more likely it is that someone could slip something hostile into it.

Answer 2

For games that use a submission-based workshop (like TF2, DOTA2, and CS:GO), there is no chance to contract a virus, as there is no way to download the workshop item in question. Submissions are only selected and included into the game by Valve. You can only ogle and vote on them.

Pertaining to servers and getting viruses in these games, there have been several exploits exposed over the past years, but have been patched very quickly. I'm not aware of any active vulnerabilities in joining servers for these games, but that doesn't necessarily mean they don't exist.

For other games with workshop mods you can subscribe to, I'm not aware of any game that allows executables or other files that could potentially be infected. They only allow in-game assets, such as models, textures, or maps.

As with anything on the internet, nothing is 100% safe, but all things being taken into consideration:

• The effort it would take to inject a virus into a workshop submission, including the ability to somehow execute the malignant code
• The number of people it would infect against going through all that hassle of creating the virus workshop submission
• Anecdotal evidence in that I've never heard of anyone ever getting a virus from any Steam Workshop submission

I would say that the Steam workshop as a whole is pretty safe. Just don't go clicking on unknown links in the comments, those are a different story.