Hacker News Reader

Comment by AnIdiotOnTheNet | Hacker News Reader

You could do that without steam just by clicking through the UAC prompt.

Only if your account is a member of the local administrators group. This attack allows any domain user to elevate privileges on a machine with Steam installed.

Only if you can convince them to run your malicious binary. That's a much different attack, with this attack no user interaction is required.

They're already choosing to install a game on Steam, on their work computer. That's the scenario we're talking about.

No, that's what the user 0xDEFC0DE was talking about, not the parent.

The parent is describing an attack which does not require the administrative user to do anything except install Steam. Any other user who can logon to that machine could use this privilege escalation exploit to access the administrative user's files

As another user pointed out, I've made the assumption that the malicious user who logs into the target user's workstation would also have administrative permissions, in which case they don't need steam to accomplish this attack.

However, this is not necessarily the case, so I yield the point.

I would go as far as saying it's almost guaranteed not to be the case. In what situation would two different users, neither of which being IT staff, both have administrative access to a work pc?

As a particular problematic scenario, consider a school: Steam cannot be used in educational settings because of this issue.

Alright, you've convinced me there is legitimate concern here after all.

Thanks for hearing me out, I appreciate it.

You can't click through a UAC prompt to elevate if you don't have local administrator rights.

Reply on news.ycombinator.com