Hacker News Reader

Comment by ryanjshaw | Hacker News Reader

> and they are almost certainly the only user of that workstation

If the machine is on a Windows domain, usually anybody on that domain can log on to it. Which means I can walk up to your machine while you grab a coffee and use this attack to gain full control over everything on your machine. If you do anything personal on that machine, eg email, I just got access to it.

View on HN

You could do that without steam just by clicking through the UAC prompt.

Only if your account is a member of the local administrators group. This attack allows any domain user to elevate privileges on a machine with Steam installed.

You can't click through a UAC prompt to elevate if you don't have local administrator rights.

Only if you can convince them to run your malicious binary. That's a much different attack, with this attack no user interaction is required.

They're already choosing to install a game on Steam, on their work computer. That's the scenario we're talking about.

No, that's what the user 0xDEFC0DE was talking about, not the parent.

The parent is describing an attack which does not require the administrative user to do anything except install Steam. Any other user who can logon to that machine could use this privilege escalation exploit to access the administrative user's files

As another user pointed out, I've made the assumption that the malicious user who logs into the target user's workstation would also have administrative permissions, in which case they don't need steam to accomplish this attack.

However, this is not necessarily the case, so I yield the point.

I would go as far as saying it's almost guaranteed not to be the case. In what situation would two different users, neither of which being IT staff, both have administrative access to a work pc?

As a particular problematic scenario, consider a school: Steam cannot be used in educational settings because of this issue.

Alright, you've convinced me there is legitimate concern here after all.

Thanks for hearing me out, I appreciate it.

Reply on news.ycombinator.com