6 ms·

>The whole idea that gaining administrator privileges through local escalation on a personal desktop is A Big Deal(TM) is silly. I’ve seen steam on work comput

>The whole idea that gaining administrator privileges through local escalation on a personal desktop is A Big Deal(TM) is silly. I’ve seen steam on work computers. This isn’t limited to home desktop users by any stretch. People install steam because they don’t know it puts their work computers at risk. You could argue that they shouldn’t have games on a work PC (some companies are a bit more lax and even play together) and an easy way to convince them to not do that is if you point out that Steam makes your system less secure by design.

AnIdiotOnTheNet 7y ago
> People install steam because they don’t know it puts their work computers at risk. Tell me, what precisely does having administrator privileges on a workstation provide that having the user account's privileges does not? With the user account you still have access to the user's files (and they are almost certainly the only user of that workstation) and all network resources they have access to.
- 0xDEFC0DE 7y ago
  Install persistence, stealth like clearing logs, gather more information from AD, run code that wouldn’t otherwise be possible. But no let’s just forget all of the reasons we use group policy and principles of least privileges. Imagine if your initial foothold is user with Steam installed. You just got SYSTEM for free.
  - AnIdiotOnTheNet 7y ago
    > gather more information from AD What good is the computer account for this when you already have the user account? > But no let’s just forget all of the reasons we use group policy and principles of least privileges. By that rationale, computer accounts should have far fewer privileges than the actual user account anyway, so again having local admin isn't worth much. > run code that wouldn’t otherwise be possible Namely? > Imagine if your initial foothold is user with Steam installed. You just got SYSTEM for free. And I'm struggling to see how that adds much to my problem of someone having a foothold on a user workstation already. And that's ignoring the circumstances of Steam being installed on the workstation in the first place AND the user having installed some untrustworthy game with it in the window since the game's appearance on Steam and its detection and removal. Which is also not to mention that this means the user has the ability to install software and is therefore infinitely more likely to just download some malicious installer from the nefarious portions of the internet that they can access with a web browser.
    - 0xDEFC0DE 7y ago
      >Namely? Powershell, friend. Changing execution policy requires privileges. Guess what SYSTEM gives you? Plus you can disable windows defender and install any nasty things you want! Pretty sure you’d need system to snoop/inject traffic too. If you have other services or applications installed (like IT setting up your workstation), those things can now be read/changed where they otherwise wouldn’t be with just user access. This can lead to other information leakage about other parts of the network or services. >And I'm struggling to see how that adds much to my problem of someone having a foothold on a user workstation already. No fucking shit, but you don’t let them walk into system just because they got user. You’re taking the stance that any compromise means death and that’s directly opposite of defense in depth, so you clearly don’t believe in that. That’s just being lazy mate. Why not just chmod 777 everything and call it a day? >Which is also not to mention that this means the user has the ability to install software and is therefore infinitely more likely to just download some malicious installer from the nefarious portions of the internet that they can access with a web browser. Because they don’t know Steam is insecure by design! They trust Steam! That’s the problem! This isn’t common knowledge and since Steam won’t fix it, it needs to become common knowledge.
      - AnIdiotOnTheNet 7y ago
        > Powershell, friend. Changing execution policy requires privileges. Guess what SYSTEM gives you? PowerShell execution policy is stupid easy to bypass. You simply pass the '–ExecutionPolicy Bypass' parameter when launching the script. Of course, since you already have complete control of the user account, being able to run PowerShell isn't nearly as big a deal as the fact that you can run anything at all. > Plus you can disable windows defender and install any nasty things you want! Windows defender, like pretty much all AV software, is crap anyways and won't detect most of the things you'd be interested in doing. It's a low-effort screen for well known malware. Case in point: it didn't catch your malicious installer when Steam downloaded and ran it in this scenario did it? > Pretty sure you’d need system to snoop/inject traffic too. That may well be true, but considering I pretty much already have full control of the user account and can therefore do everything it can do on the network without injecting anything, I'm not sure what is gained. > No fucking shit, but you don’t let them walk into system just because they got user. Eh, it isn't really worth my effort to try and prevent it when all they'll have to do is fire a UAC prompt the user will almost certainly just click through anyway. Especially considering what little (basically nothing) it gets the attacker. > Because they don’t know Steam is insecure by design! They trust Steam! That’s the problem! This isn’t common knowledge and since Steam won’t fix it, it needs to become common knowledge. So here's the scenario you're talking about: A user has installed Steam on their work computer. They use Steam to download an installer that is actually malicious and this fact has not been caught by Valve yet. Steam, who's entire purpose is to install games, runs the installer. Consequently, the user account is now owned by an attacker. ...And even if this vulnerability were patched ALL OF THE ABOVE WOULD STILL BE TRUE!
- ryanjshaw 7y ago
  > and they are almost certainly the only user of that workstation If the machine is on a Windows domain, usually anybody on that domain can log on to it. Which means I can walk up to your machine while you grab a coffee and use this attack to gain full control over everything on your machine. If you do anything personal on that machine, eg email, I just got access to it.
  - AnIdiotOnTheNet 7y ago
    You could do that without steam just by clicking through the UAC prompt.
    - ryanjshaw 7y ago
      Only if your account is a member of the local administrators group. This attack allows any domain user to elevate privileges on a machine with Steam installed.
    - Sahhaese 7y ago
      You can't click through a UAC prompt to elevate if you don't have local administrator rights.
    - shawnz 7y ago
      Only if you can convince them to run your malicious binary. That's a much different attack, with this attack no user interaction is required.
      - AnIdiotOnTheNet 7y ago
        They're already choosing to install a game on Steam, on their work computer. That's the scenario we're talking about.
        shawnz 7y ago
        No, that's what the user 0xDEFC0DE was talking about, not the parent. The parent is describing an attack which does not require the administrative user to do anything except install Steam. Any other user who can logon to that machine could use this privilege escalation exploit to access the administrative user's files
wruza 7y ago
>shouldn’t have games on a work PC Steam also sells design tools and complete sdks. Idk if it is a common way to install them though.
- 0xDEFC0DE 7y ago
  And for a game dev company, you really might have Steam installed for legit business purposes Security is still important for those companies Edit: downvoters, I would really like to know why this post deserved downvotes
- AnIdiotOnTheNet 7y ago
  This attack would require that you are A) Installing something you don't actually need for work, or B) Whatever you need for work is infected anyway.
  - shawnz 7y ago
    No it doesn't. The attack does not require you to install a compromised game like 0xDEFC0DE was suggesting in the other thread. Obviously if you install a compromised game then no other attack is necessary.
    - AnIdiotOnTheNet 7y ago
      You're right, I've conflated the issues.
    - 0xDEFC0DE 7y ago
      FTR the problem is steam and the game doesn’t matter. I wasn’t suggesting individual games needed to be installed and steam alone is enough for this compromise

AnIdiotOnTheNet 7y ago

> People install steam because they don’t know it puts their work computers at risk. Tell me, what precisely does having administrator privileges on a workstation provide that having the user account's privileges does not? With the user account you still have access to the user's files (and they are almost certainly the only user of that workstation) and all network resources they have access to.

0xDEFC0DE 7y ago
Install persistence, stealth like clearing logs, gather more information from AD, run code that wouldn’t otherwise be possible. But no let’s just forget all of the reasons we use group policy and principles of least privileges. Imagine if your initial foothold is user with Steam installed. You just got SYSTEM for free.
- AnIdiotOnTheNet 7y ago
  > gather more information from AD What good is the computer account for this when you already have the user account? > But no let’s just forget all of the reasons we use group policy and principles of least privileges. By that rationale, computer accounts should have far fewer privileges than the actual user account anyway, so again having local admin isn't worth much. > run code that wouldn’t otherwise be possible Namely? > Imagine if your initial foothold is user with Steam installed. You just got SYSTEM for free. And I'm struggling to see how that adds much to my problem of someone having a foothold on a user workstation already. And that's ignoring the circumstances of Steam being installed on the workstation in the first place AND the user having installed some untrustworthy game with it in the window since the game's appearance on Steam and its detection and removal. Which is also not to mention that this means the user has the ability to install software and is therefore infinitely more likely to just download some malicious installer from the nefarious portions of the internet that they can access with a web browser.
  - 0xDEFC0DE 7y ago
    >Namely? Powershell, friend. Changing execution policy requires privileges. Guess what SYSTEM gives you? Plus you can disable windows defender and install any nasty things you want! Pretty sure you’d need system to snoop/inject traffic too. If you have other services or applications installed (like IT setting up your workstation), those things can now be read/changed where they otherwise wouldn’t be with just user access. This can lead to other information leakage about other parts of the network or services. >And I'm struggling to see how that adds much to my problem of someone having a foothold on a user workstation already. No fucking shit, but you don’t let them walk into system just because they got user. You’re taking the stance that any compromise means death and that’s directly opposite of defense in depth, so you clearly don’t believe in that. That’s just being lazy mate. Why not just chmod 777 everything and call it a day? >Which is also not to mention that this means the user has the ability to install software and is therefore infinitely more likely to just download some malicious installer from the nefarious portions of the internet that they can access with a web browser. Because they don’t know Steam is insecure by design! They trust Steam! That’s the problem! This isn’t common knowledge and since Steam won’t fix it, it needs to become common knowledge.
    - AnIdiotOnTheNet 7y ago
      > Powershell, friend. Changing execution policy requires privileges. Guess what SYSTEM gives you? PowerShell execution policy is stupid easy to bypass. You simply pass the '–ExecutionPolicy Bypass' parameter when launching the script. Of course, since you already have complete control of the user account, being able to run PowerShell isn't nearly as big a deal as the fact that you can run anything at all. > Plus you can disable windows defender and install any nasty things you want! Windows defender, like pretty much all AV software, is crap anyways and won't detect most of the things you'd be interested in doing. It's a low-effort screen for well known malware. Case in point: it didn't catch your malicious installer when Steam downloaded and ran it in this scenario did it? > Pretty sure you’d need system to snoop/inject traffic too. That may well be true, but considering I pretty much already have full control of the user account and can therefore do everything it can do on the network without injecting anything, I'm not sure what is gained. > No fucking shit, but you don’t let them walk into system just because they got user. Eh, it isn't really worth my effort to try and prevent it when all they'll have to do is fire a UAC prompt the user will almost certainly just click through anyway. Especially considering what little (basically nothing) it gets the attacker. > Because they don’t know Steam is insecure by design! They trust Steam! That’s the problem! This isn’t common knowledge and since Steam won’t fix it, it needs to become common knowledge. So here's the scenario you're talking about: A user has installed Steam on their work computer. They use Steam to download an installer that is actually malicious and this fact has not been caught by Valve yet. Steam, who's entire purpose is to install games, runs the installer. Consequently, the user account is now owned by an attacker. ...And even if this vulnerability were patched ALL OF THE ABOVE WOULD STILL BE TRUE!
ryanjshaw 7y ago
> and they are almost certainly the only user of that workstation If the machine is on a Windows domain, usually anybody on that domain can log on to it. Which means I can walk up to your machine while you grab a coffee and use this attack to gain full control over everything on your machine. If you do anything personal on that machine, eg email, I just got access to it.
- AnIdiotOnTheNet 7y ago
  You could do that without steam just by clicking through the UAC prompt.
  - ryanjshaw 7y ago
    Only if your account is a member of the local administrators group. This attack allows any domain user to elevate privileges on a machine with Steam installed.
  - Sahhaese 7y ago
    You can't click through a UAC prompt to elevate if you don't have local administrator rights.
  - shawnz 7y ago
    Only if you can convince them to run your malicious binary. That's a much different attack, with this attack no user interaction is required.
    - AnIdiotOnTheNet 7y ago
      They're already choosing to install a game on Steam, on their work computer. That's the scenario we're talking about.
      - shawnz 7y ago
        No, that's what the user 0xDEFC0DE was talking about, not the parent. The parent is describing an attack which does not require the administrative user to do anything except install Steam. Any other user who can logon to that machine could use this privilege escalation exploit to access the administrative user's files

wruza 7y ago

>shouldn’t have games on a work PC Steam also sells design tools and complete sdks. Idk if it is a common way to install them though.

0xDEFC0DE 7y ago
And for a game dev company, you really might have Steam installed for legit business purposes Security is still important for those companies Edit: downvoters, I would really like to know why this post deserved downvotes
AnIdiotOnTheNet 7y ago
This attack would require that you are A) Installing something you don't actually need for work, or B) Whatever you need for work is infected anyway.
- shawnz 7y ago
  No it doesn't. The attack does not require you to install a compromised game like 0xDEFC0DE was suggesting in the other thread. Obviously if you install a compromised game then no other attack is necessary.
  - AnIdiotOnTheNet 7y ago
    You're right, I've conflated the issues.
  - 0xDEFC0DE 7y ago
    FTR the problem is steam and the game doesn’t matter. I wasn’t suggesting individual games needed to be installed and steam alone is enough for this compromise