Hacker News Reader

user5454on Cryptographers Urge People to Abandon IOTA After Leaked Emails

Wow! Speaking of trust, unsigned installers [1]?!?

[1] https://github.com/iotaledger/wallet/issues/1084

user5454on Skype can't fix a nasty security bug without a massive code rewrite

You're right. It is possible to write a file but not to list or access any other files. So it is a security bug. You could "fix" it yourself though, by using a privileged account and copy any DLLs loaded by the Skype updater into the directory.. An unprivileged user would not be able to overwrite the files.

user5454on Skype can't fix a nasty security bug without a massive code rewrite

From the disclosure (http://seclists.org/fulldisclosure/2018/Feb/33):

> An unprivileged (local) user who is able to place UXTheme.dll or any of the other DLLs loaded by the vulnerable executable in %SystemRoot%\Temp\ gains escalation of privilege to the SYSTEM account.

On my machine at least an unprivileged user does not have access to %SystemRoot%\Temp\ so it seems to be a case of what Raymond Chen refers to as "on the other side of the airtight hatchway".