Skip navigation.

A really nice example of an interaction bug

A really nice example of an interaction bug

From Joe Loughry in Risks Digest (via Paul Czyzewski):

1. Microsoft Windows Vista comes with voice recognition installed andactive by default.

2. Voice services has tons of security privileges, since it is a"local" service and therefore safe, right?

3. Playing a sound through the speakers on Vista requires almost nosecurity privileges, since that's a harmless operation, right?

4. By playing a prerecorded file of spoken commands, an unprivilegedprocess can execute arbitrary processes that get executed withelevated security privileges.

http://isc.sans.org/diary.html?storyid=2148

I'm also fond of being able to guess passwords using virtual memory.