Hacker News Reader

Comment by bogwog | Hacker News Reader

From what I've read, the original bug involved malware already installed on the PC using the Steam client to run other code. While I'm not a security expert in any way, that doesn't seem to me like a huge exploit. If the attack requires installing malware on the victim's computer, why not just do the evil stuff directly with that malware? If that's the case and I'm not just remembering it wrong, then I could see why Valve wouldn't want to pay up and could see why this guy would go on a social media rant to slander Valve either hoping they'll pay up or just to get petty revenge.

View on HN

Lets say you and your brother share a PC, but you're the admin. You both play Steam. His account has no password. I steal the laptop. I log in as him. I pop a SYSTEM shell using Steam. I reset your admin password.

"Damn, you watch some weird porn."

Wouldn't you be able to do the same simply by looking at the file system without any access to admin privileges?

I'm not arguing that this vulnerability isn't one, it's a privilege escalation vulnerability, however in your situation you got physical access which is as far as I know, pretty much game over for your system.

Not if they haven't granted access to the files to you. In fact by default the files in a user's home folder (including Documents, Videos etc.) are inaccessible to other (non-privileged) users on Windows.

If they have physical access, then they don't need to boot into Windows. They could boot from a flashdrive and access any files they want.

This is true, and also why I lock down my BIOSs and set the OS as the only boot device. TRK is a bootable portable linux specifically for resetting and unlocking local admin accounts.

Encryption, however, cannot be broken without your credentials. These can be obtained from default running instance of Windows with Mimikatz if the admin credentials are still in memory from an earlier session.

Yeah, there are definitely ways of securing versus someone with physical access, but I expect most machines with a non-sandboxed steam installed probably don't have them.

This privilege escalation attack is probably never going to be used if the attacker has physical access.

> In fact by default the files in a user's home folder (including Documents, Videos etc.) are inaccessible to other (non-privileged) users on Windows.

Sure that's certainly right but physical access doesn't force you to be "on Windows".

> This is true, and also why I lock down my BIOSs and set the OS as the only boot device.

I never talked about you specifically, you are a tiny tiny minority. Even then, that just block your computer. If you can't bypass that BIOS (seriously doubtful), the hard drive is still accessible.

> Encryption, however, cannot be broken without your credentials.

Is there an encryption on by default? That must be new because I'm pretty sure I never had trouble to access my user folders on some of my old Windows 7 installation (that's would be a good 20% of Steams users).

I can't find anything about this, if I have time tonight I'll try to see if I can access my user folder through another OS.

That won't help in the case of full-disk encryption.

And Windows has useful account-based file encryption too.

> And Windows has useful account-based file encryption too.

Is this on by default on Windows? I haven't needed to access my files from another Windows installation for a long time, but I'm pretty sure the last time I tried on my good old hard drive with Windows 7, they weren't encrypted and I had no trouble to access them.

No, but it only takes a minute to turn on if you're going to be sharing unsupervised access to a computer.

> No, but it only takes a minute to turn on if you're going to be sharing unsupervised access to a computer.

This is not something that 99.99% of Steam users would do though...

It would still be possible to retrieve the encryption keys too if the PC is still running (which is also the only ways to make Steam vulnerability viable) using a can of compressed air [1].

As I said, physical access to a computer is pretty much already game over... The Steam vulnerability is quite useful while being connected remotely though (which is really the most likely scenario either way).

[1] https://www.zdnet.com/article/cryogenically-frozen-ram-bypas...

> Kravets did eventually publish details about the Steam zero-day, which was an elevation of privilege (also known as a local privilege escalation) bug that allowed other apps or malware on a user's computer to abuse the Steam client to run code with admin rights.

No, using this 0-day malware, with lower privilege level, could do stuff it could not do.

> could do stuff it could not do

I have trouble parsing this. Did you mean "could do stuff it couldn't have done" perhaps?

It gets to do fancy admin stuff that regular malware without permissions can't.

From Microsoft's perspective, they consider local privilege elevation on a client computer an "important" vulnerability that requires patching and paying a bug bounty:

https://msrc-blog.microsoft.com/2018/09/10/microsoft-securit...

So some companies consider LPE to be serious.

If Microsoft considered privilege escalation to be serious, they wouldn't have Windows setup a single privileged account on a fresh install. Or at the very least, they wouldn't make it necessary to jump through two hidden hoops to make a separate admin account without (a) a Microsoft profile and (b) without "secure questions" misfeature.

It was a priviledge escalation. An attacker could go from running as a compromised user to running with system priviledges.

Using the Steam client to run other code at an escalated privilege level.

Reply on news.ycombinator.com