5 ms·
From what I've read, the original bug involved malware already installed on the PC using the Steam client to run other code. While I'm not a security expert in
by bogwog 7y ago
From what I've read, the original bug involved malware already installed on the PC using the Steam client to run other code. While I'm not a security expert in any way, that doesn't seem to me like a huge exploit. If the attack requires installing malware on the victim's computer, why not just do the evil stuff directly with that malware? If that's the case and I'm not just remembering it wrong, then I could see why Valve wouldn't want to pay up and could see why this guy would go on a social media rant to slander Valve either hoping they'll pay up or just to get petty revenge.
- rileymat2 7y ago> Kravets did eventually publish details about the Steam zero-day, which was an elevation of privilege (also known as a local privilege escalation) bug that allowed other apps or malware on a user's computer to abuse the Steam client to run code with admin rights. No, using this 0-day malware, with lower privilege level, could do stuff it could not do.
- dx87 7y agoIt was a priviledge escalation. An attacker could go from running as a compromised user to running with system priviledges.
- Rotten194 7y agoUsing the Steam client to run other code at an escalated privilege level.
- zelon88 7y agoLets say you and your brother share a PC, but you're the admin. You both play Steam. His account has no password. I steal the laptop. I log in as him. I pop a SYSTEM shell using Steam. I reset your admin password. "Damn, you watch some weird porn."
- dwild 7y agoWouldn't you be able to do the same simply by looking at the file system without any access to admin privileges? I'm not arguing that this vulnerability isn't one, it's a privilege escalation vulnerability, however in your situation you got physical access which is as far as I know, pretty much game over for your system.
- poizan42 7y agoNot if they haven't granted access to the files to you. In fact by default the files in a user's home folder (including Documents, Videos etc.) are inaccessible to other (non-privileged) users on Windows.
- thethirdone 7y agoIf they have physical access, then they don't need to boot into Windows. They could boot from a flashdrive and access any files they want.
- zelon88 7y agoThis is true, and also why I lock down my BIOSs and set the OS as the only boot device. TRK is a bootable portable linux specifically for resetting and unlocking local admin accounts. Encryption, however, cannot be broken without your credentials. These can be obtained from default running instance of Windows with Mimikatz if the admin credentials are still in memory from an earlier session.
- thethirdone 7y ago
- MarkSweep 7y agoFrom Microsoft's perspective, they consider local privilege elevation on a client computer an "important" vulnerability that requires patching and paying a bug bounty: https://msrc-blog.microsoft.com/2018/09/10/microsoft-security-servicing-criteria-for-windows/ https://msrc-blog.microsoft.com/2018/09/10/microsoft-securit... So some companies consider LPE to be serious.
- antisemiotic 7y agoIf Microsoft considered privilege escalation to be serious, they wouldn't have Windows setup a single privileged account on a fresh install. Or at the very least, they wouldn't make it necessary to jump through two hidden hoops to make a separate admin account without (a) a Microsoft profile and (b) without "secure questions" misfeature.