Razer mice software has a strange security flaw

[mylesillidge]

Razer mice have an odd but serious security flaw

Razer's installation software for wired and wireless mice has a serious security flaw that provides an unusually high level of system access, potentially allowing malicious attackers to install harmful software on a user's computer.

Well-known security researcher Jon Hat shared the vulnerability on Twitter over the weekend.

 

[Thor]

If someone shows up at your house with a razer mouse, kindly instruct them away.

 

[Fulcrum29]

The problem is not unique to Razer, this is more an MS vulnerability than anything else. Razer should patch their installer, but this exploit can be used in another 'illicit' payload.

 

[Swa]

The problem is not unique to Razer, this is more an MS vulnerability than anything else. Razer should patch their installer, but this exploit can be used in another 'illicit' payload.

What I was thinking as well. It would only be an issue if the installer itself contained malware. The bigger issue is how an installer could be allowed to have such implicit privileges.

 

[Fulcrum29]

What I was thinking as well. It would only be an issue if the installer itself contained malware. The bigger issue is how an installer could be allowed to have such implicit privileges.

Having a look at the Tweet,

https://twitter.com/x/status/1429049506021138437

Need local admin and have physical access? - Plug a Razer mouse (or the dongle) - Windows Update will download and execute RazerInstaller as SYSTEM - Abuse elevated Explorer to open Powershell with Shift+Right click Tried contacting
@Razer
, but no answers. So here's a freebie

once a Razer device is plugged into the system, the driver is autodetected and installed which isn't unusual as that is how an OS behave, should the drivers be available, but the driver installation prompts the "RazerInstaller" hence the application is autoinstalled should it not be detected on the system. Forced installation, but Windows allows this elevated privilege. This is nothing new and is popularly known as nagware some even label this the same as malware, because it is malicious pending on your perspective.

Every time a device is plugged in which is dependent on Razer Synapse or whatever it is called it creates and registry node and creates, “<drive>:\Windows\Installer\Razer”, where the nagware is dumped and executed. Sounds like Windows old media AutoPlay…

Anyway, the exploit is allowed through a WHQL approved driver installation. Now this is hackable, so a similar, but malicious, payload can be loaded on a normal USB hard/memory disk.

Yes, it is good to point out that Razer dabbles in nagware, but this is a Windows issue which is known, Razer use it to install their Synapse app.