3 ms·
No, that's what the user 0xDEFC0DE was talking about, not the parent. The parent is describing an attack which does not require the administrative user to do a
by shawnz 7y ago
No, that's what the user 0xDEFC0DE was talking about, not the parent.
The parent is describing an attack which does not require the administrative user to do anything except install Steam. Any other user who can logon to that machine could use this privilege escalation exploit to access the administrative user's files
- AnIdiotOnTheNet 7y agoAs another user pointed out, I've made the assumption that the malicious user who logs into the target user's workstation would also have administrative permissions, in which case they don't need steam to accomplish this attack. However, this is not necessarily the case, so I yield the point.
- shawnz 7y agoI would go as far as saying it's almost guaranteed not to be the case. In what situation would two different users, neither of which being IT staff, both have administrative access to a work pc? As a particular problematic scenario, consider a school: Steam cannot be used in educational settings because of this issue.
- AnIdiotOnTheNet 7y agoAlright, you've convinced me there is legitimate concern here after all.
- shawnz 7y agoThanks for hearing me out, I appreciate it.