This 16-Year-Old Hacked Into Steam & Released a Ridiculous Game

A 16-year-old has got his 45-second-long ‘game’ onto Steam without a single person at Valve setting eyes on it.

Watch Paint Dry is a game about watching paint dry. It made its way onto Steam without going through Greenlight or acquiring an elusive Valve stamp-of-approval, in an effort from creator Ruby Nealon to highlight a vulnerability in the service.

Although the vulnerability has since been fixed (thanks to Nealon), Nealon chronicled his incredible exploit on Medium. Beginning with acquiring a Steamworks account (through unspecified means), Nealon found that he could fool it into thinking his trading cards – which he describes as a ‘basic joke set’ – had been approved by somebody at Valve. He then requested non-existent information that gave him a list of options, one of which could trick the system into thinking the game was ‘released’.

To get Watch Paint Dry to show up on the store, Nealon manipulated a javascript function by adding his app ID and session ID – info from his trading cards – and voila, ‘Watch Paint Dry’ was in Steam’s New Release Section.

“I have been in contact with Valve who have now fixed the vulnerability”, wrote Nealon at the end of his post. “TL;DR — I was responsible for Watch paint dry. Getting caught was part of my plan. It’s just a prank, bro!”

Lucy O’Brien is Entertainment Editor at IGN’s AU office. Follow her ramblings on Twitter.