Windows backup privilege can read any file, bypassing ACLs, making backup software a privilege-escalation target

·1 views

SeBackupPrivilege lets a process read files and traverse directories regardless of their access control lists, using the documented FILE_FLAG_BACKUP_SEMANTICS mechanism. Its companion, SeRestorePrivilege, allows writing to files the same way, which can enable replacing system binaries. The article notes that Backup Operators is a role-based group, and that membership can expose registry hives, credential material, and directory database contents on domain controllers or member servers. Because these behaviours are documented features rather than vulnerabilities, the author recommends limiting assignments to the smallest set of dedicated, non-interactive accounts and taking extra care with restore rights.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Firebase Studio Adds Figma Import, Image Swaps, and Automated Backend Setup

Google announced new Firebase updates at I/O 2025, focused on helping developers build full-stack AI applications from one place. Firebase Studio, the cloud-based AI workspace previewed at Cloud Next, now lets users import Figma designs via a Builder.io plugin and use Gemini to add screens or connect user flows through chat. The App Prototyping agent can also replace placeholder images with visuals from Unsplash and detect and provision backend services such as databases and authentication. Google says the workspace has already seen over 1.5 million creations in just over a month and is now powered by Gemini 2.5. The article is a developer-focused implementation guide, and it notes that Vertex AI in Firebase has since been renamed Firebase AI Logic.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Firebase Studio Upgrades App Prototyping Agent to Gemini 2.5

Google has upgraded the App Prototyping agent in Firebase Studio to use Gemini 2.5, its most capable AI model, for all preview users. The update targets developers who build web applications from natural language prompts, and users have already created more than 1.5 million workspaces since the preview launched. Gemini 2.5 is described as a reasoning-oriented model that performs strongly on coding benchmarks, which the company says yields more modern UI designs and better handling of complex features such as multi-step AI flows, calculations, and audio or image work. To illustrate, the article describes an interactive music tutor app that was generated in under ten minutes and later refined through prompt adjustments to improve its violin sound.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Lelouvre: A Local AI Assistant to Streamline Internship Applications

The developer built Lelouvre to reduce the repetitive work of finding internships, tailoring résumés, and filling out application forms. The tool combines opportunity discovery, application preparation, and tracking in one workspace, and uses Gemma running locally through Ollama to draft résumé bullets from recorded experience. Each suggested bullet links back to a source entry so the user can verify claims before using them, and code checks catch unsupported numbers or tool names. The project is open source under Apache 2.0, built with Python, SQLite, and a browser interface, and keeps personal evidence on the user's machine during inference. Submissions require reviewed answers and passing checks, and the user remains responsible for final review.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Firebase App Hosting Adds Instant Rollbacks and Automatic SDK Configuration

Google's Firebase team has released its March update for App Hosting, its serverless platform for full-stack web apps. The headline addition is instant rollbacks, which let developers restore a previous build within seconds by reusing its existing container image instead of rebuilding from an old commit. Rollbacks are started from the App Hosting dashboard by selecting a prior build and choosing to roll back to it, which routes new visitors to that version. The update also introduces automatic SDK initialization, allowing Firebase Admin and client JS SDKs to initialize without a manually pasted config object when hosted on App Hosting. This simplifies managing development, staging, and production environments.

0 comments Read more at DEV Community