A really nice example of an interaction bug
A really nice example of an interaction bug
Submitted by Brian Marick's blog on Sat, 10/02/2007 - 19:00.From Joe Loughry in Risks Digest (via Paul Czyzewski):
1. Microsoft Windows Vista comes with voice recognition installed andactive by default.
2. Voice services has tons of security privileges, since it is a"local" service and therefore safe, right?
3. Playing a sound through the speakers on Vista requires almost nosecurity privileges, since that's a harmless operation, right?
4. By playing a prerecorded file of spoken commands, an unprivilegedprocess can execute arbitrary processes that get executed withelevated security privileges.
http://isc.sans.org/diary.html?storyid=2148
I'm also fond of being able to guess passwords using virtual memory.
