Exploration Through Example

Example-driven development, Agile testing, context-driven testing, Agile programming, Ruby, and other things of interest to Brian Marick

191.8

⇒

167.2

⇒

186.2

183.6

184.0

183.2

184.6

Fri, 09 Feb 2007

A really nice example of an interaction bug

From Joe Loughry in Risks Digest (via Paul Czyzewski):

1. Microsoft Windows Vista comes with voice recognition installed and active by default.

2. Voice services has tons of security privileges, since it is a "local" service and therefore safe, right?

3. Playing a sound through the speakers on Vista requires almost no security privileges, since that's a harmless operation, right?

4. By playing a prerecorded file of spoken commands, an unprivileged process can execute arbitrary processes that get executed with elevated security privileges.

http://isc.sans.org/diary.html?storyid=2148

I'm also fond of being able to guess passwords using virtual memory.

## Posted at 14:21 in category /misc [permalink] [top]