you can't be serious

Item: you can't be serious
Rating: 4
Author: PostSingularity Institute

by John Hammond · View the channel on PSI

Formal & Physical Sciences Computing & Cybersecurity UComputing and Information Technology URComputer security

🎙 John Hammond 👥 2.2M 📅 September 15, 2026 ⏱ 19 min 👁 4K 📄 news review 🧭 2026-09-15

Available in: English (current) Français

Keywords

Steam vulnerabilityLPEWindowsPoCIPC

Summary

John Hammond examines a recently discovered local privilege escalation (LPE) vulnerability in Steam on Windows. The vulnerability allows a standard user to escalate to SYSTEM privileges by abusing the Steam client service’s IPC mechanism. He demonstrates the exploit on a Windows 11 VM using a proof-of-concept (PoC) downloaded from GitHub. The PoC includes a C++ executable and various helper scripts, heavily AI-generated, which Hammond analyzes to understand the core exploit logic. He then creates a simplified PowerShell version of the exploit that achieves the same result with fewer components and evades Windows Defender. The underlying issue involves adding a malicious launcher to Steam’s allow list via IPC, which then executes as SYSTEM. Hammond highlights the role of AI in accelerating vulnerability research and exploitation, noting the compressed timelines in cybersecurity. The video concludes by emphasizing that such vulnerabilities are valuable despite requiring initial access, and encourages viewers to explore cybersecurity training resources.

152 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides valuable, hands-on insight into a real LPE vulnerability in a widely used application like Steam. John Hammond demonstrates the exploit in a controlled environment, showing both the original PoC and a streamlined version he developed himself. His reasoning is clear as he dissects the code, identifies the essential IPC interaction, and explains how the malicious VDF file is used to execute a payload as SYSTEM. He also addresses common criticisms about LPE being less severe than RCE, arguing that initial access is often achievable in real-world attacks. The argumentation is solid, backed by live demonstration and code analysis.

Scientific Rigor, Source Quality, Title Accuracy

John Hammond references the PoC repository and credits the researcher (Killa), but does not provide substantial external sources. He uses tools like Sublime Text, Visual Studio, and various scripts. The title is informal but matches the video’s tone and content. The video is technically rigorous in its analysis, though it does not cite official advisories or patches, which would be beneficial. The sponsor segment is clearly separated, and the video’s content is accurate based on the demonstrated results.

194 words

Title / Content Match

The title 'you can't be serious' reflects the surprising nature of the vulnerability and the ease with which it results in SYSTEM privileges, matching the video's content.

Quality & Reliability

8/10

John Hammond provides a hands-on demonstration of a local privilege escalation vulnerability in Steam, analyzing the proof-of-concept code in real time. He shows the exploit working both with the original PoC and with a simplified PowerShell variant, while also discussing the AI-assisted nature of the code. The analysis is technically sound and reproducible, though some claims about AI generation are speculative. Sources are mostly references to the PoC repository and tools used, with no external verifiable citations.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

CodeCrafters — Resource mentioned for learning coding
CyberDefenders — Resource for Blue Team training and SOC certification
InfoSecMap — Resource for cybersecurity events
John Hammond Newsletter — Informational newsletter
OpenVPN Hosting — Resource for setting up your own VPN
Just Hacking Training — Training platform for cybersecurity
Vanta (Sponsor) — Compliance automation platform sponsoring the video

Concurring Sources

GitHub PoC Repository — Mentioned as the source of the proof of concept; exact URL not provided, but the video references a GitHub repo.

Contribution & Novelties

The video provides an up-close analysis of a newly disclosed Steam LPE vulnerability, showing both the original PoC and a simplified PowerShell version. It highlights the increasing role of AI in generating exploit code and the need for defenders to adapt. The practical demonstration serves as a learning resource for understanding Windows IPC and privilege escalation.

Pour aller plus loin :

Windows Local Privilege Escalation — General concept of privilege escalation on Windows.
Steam Client Service Security Vulnerability — Note: Specific CVE not mentioned in video, so use general referencing.
PowerShell NoProfile Bypass — Reference for PowerShell execution policies.

99 words

Radar Profile

The radar profile shows high scores in quantity and quality of information, indicating a dense and substantive video. The technical level is very high, suitable for viewers with cybersecurity background, while global reliability is slightly lower due to lack of external citations and reliance on the presenter's own testing.

Reliability 7/10