4 ms·
Rehash: - Steam has a privileged service, users can start/stop it. - Steam's service resets a bunch of registry subkey ACLs under [HKLM\...\Valve\Steam] at st
by withinrafael 7y ago
Rehash:
- Steam has a privileged service, users can start/stop it.
- Steam's service resets a bunch of registry subkey ACLs under [HKLM\...\Valve\Steam] at startup
- Steam's service gives unprivileged users read/write access to its own keys
- Steam lets unprivileged users write to this area of the registry
- Steam's service follows registry symlinks
This is terrible. Any multi-tenant machine with Steam installed is affected and should be considered compromised.
- shawnz 7y agoIt's actually even worse than that, OP's exploit only scratches the surface of what's wrong with Steam's security model on Windows. The whole program directory is world writable including the Steam service binary which runs with local system permissions, and it's been this way for YEARS. See: https://news.ycombinator.com/item?id=20633929 https://news.ycombinator.com/item?id=20633929
- withinrafael 7y agoYeah, I just saw that today. I don't know what to say.