Razer Laptops Shipped With Massive Firmware Vulnerabilities
Razer got its start making gaming-oriented peripherals like keyboards and mice, but it expanded into laptops a few years ago. The company’s Blade laptops still have that gamer aesthetic paired with powerful hardware. However, they also have a nasty security vulnerability that could let hackers implant malware on your system.
The vulnerability, known as CVE-2018-4251, is similar to one previously detected and patched in Apple laptops. It relates to the Intel Manufacturing Mode, a part of motherboard firmware for Intel-based systems. Apple spotted the screwup on its own and fixed it before anyone could take advantage, but the vulnerability has just been reported publicly after the discoverer was unable to get through to Razer. See below for an example of Razer just not understanding.
Manufacturing Mode is an undocumented configuration and testing suite that’s never supposed to be included on shipping firmware. It allows manufacturers to configure important platform settings like boot verification and write the settings to one-time programmable memory modules (FUSEs). The system parameters are initially stored in temporary memory for testing purposes and are then burned to FUSEs when closing Manufacturing Mode. If Manufacturing Mode is still active on a system, it could allow an attacker to create their own malicious system configuration options and lock them into the machine.
Hey! Thanks for mentioning us. Our Systems Team would like to check on this. Could you please tell us more about the challenges with your Razer laptop via DM and we'll take it there.
— RΛZΞR Support (@RazerSupport) March 21, 2019
This vulnerability does not on its own allow hackers to take over a computer, but it offers a mighty tempting target if they manage to get in. They could change system settings to hide malware from detection, essentially telling the computer that the malware the hacker just installed is supposed to be there. Someone could even leverage the Intel Meltdown vulnerability to wreak havoc by downgrading to older BIOS versions that don’t protect against the CPU-level vulnerabilities.
Continue reading
Some Ryzen Motherboards With Older Firmware Won’t Boot With Ryzen APUs
AMD's new Ryzen 5 2400G is a great chip, but if you're looking at buying one, check to make sure the motherboard you buy will be compatible first.
AMD Shipping Free APUs to Customers to Address Firmware Update Issue
It's not unusual for new CPUs to require UEFI/BIOS updates in order to function properly, but AMD's solution to this issue is some next-level-excellent customer service.
Third-Party Docks Are Bricking Nintendo Switch Consoles After Firmware Update
If you use a third-party dock, be very wary of Nintendo's 5.0 firmware update. There are widespread reports it's bricking Switch consoles.
Elon Musk: Model 3 Braking Can Be Fixed in Firmware. What?
Elon Musk is promising a firmware update to fix brake issues with the Model 3, surprising those of us who didn't know brakes were controlled by firmware.