 The popular Steam game client for Windows has a zero-day privilege escalation vulnerability that can allow an attacker with limited permissions to run a program as an administrator. Privilege escalation vulnerabilities are bugs that enable a user with limited rights to launch an executable with elevated, or administrative privileges. As Steam has over 100 million registered users and millions of them playing at a time, this is a serious risk that could be abused by malware to perform a variety of unwanted activities. Two researchers publicly disclosed a zero-day vulnerability for the Steam client after Valve determined that the flaw was "Not Applicable." The company chose not to award a bug bounty or give an indication that they would fix it and told the researchers that they were not allowed to disclose it. In a report published yesterday, security researcher Felix was analyzing a Windows service associated with the Steam called "Steam Client Service" that launched its executable with SYSTEM privileges on Windows. The researcher also noticed that the service could be started and stopped by the "User" group, which is pretty much anyone logged on the computer. The registry key for this service, though, was not writable by the "User" group, so it could not be modified to launch a different executable and elevate its privileges to an administrator. The researcher then tried configuring a symlink from one of these subkeys to another key for which he did not have sufficient permissions and saw that it was possible to modify that key as well. Learn more by visiting OUR FORUM.  Huawei has presented its mobile operating system dubbed Harmony as a possible replacement for Google's Android OS amid a crackdown on the Chinese tech giant by the US government. Via sputniknews. The possibility of losing access to Android and other Google services has forced Huawei to speed up the development and launch of its in-house Harmony OS. The US Department of Commerce has issued a 90-day temporary general license to Huawei, allowing US companies to continue doing business with the Chinese firm until the end of August. Elliott Zaagman, a columnist for the China-focused tech news website Technode.com and co-host of the China Tech Investor Podcast, has spoken about the prospects of the new operating system amid Android and iOS dominance. Read more: Huawei's Harmony OS Alternative to Android Reduces Leverage Google Has.  Contractors working for Microsoft are listening to personal conversations of Skype users conducted through the app's translation service, according to a cache of internal documents, screenshots, and audio recordings obtained by Motherboard. Although Skype's website says that the company may analyze audio of phone calls that a user wants to translate in order to improve the chat platform's services, it does not say some of this analysis will be done by humans. The Skype audio obtained by Motherboard includes conversations from people talking intimately to loved ones, some chatting about personal issues such as their weight loss, and others seemingly discussing relationship problems. Other files obtained by Motherboard show that Microsoft contractors are also listening to voice commands that users speak to Cortana, the company's voice assistant. Apple and Google recently suspended their use of human transcribers for their respective Siri and Google Assistant services after a backlash over similar media reporting on the companies' practices. "The fact that I can even share some of this with you shows how lax things are in terms of protecting user data," a Microsoft contractor who provided the cache of files to Motherboard said. Motherboard granted the source anonymity to speak more candidly about internal Microsoft practices, and because the person is under a non-disclosure agreement with the company. The snippets of audio obtained by Motherboard are typically short, lasting between five and ten seconds. The source said other passages can be longer, however. Learn more by visiting OUR FORUM. |
Latest Articles
|