Razer Laptops Shipped With Massive Firmware Vulnerabilities

Razer Laptops Shipped With Massive Firmware Vulnerabilities

Razer got its start making gaming-oriented peripherals like keyboards and mice, but it expanded into laptops a few years ago. The company’s Blade laptops still have that gamer aesthetic paired with powerful hardware. However, they also have a nasty security vulnerability that could let hackers implant malware on your system.

The vulnerability, known as CVE-2018-4251, is similar to one previously detected and patched in Apple laptops. It relates to the Intel Manufacturing Mode, a part of motherboard firmware for Intel-based systems. Apple spotted the screwup on its own and fixed it before anyone could take advantage, but the vulnerability has just been reported publicly after the discoverer was unable to get through to Razer. See below for an example of Razer just not understanding.

Manufacturing Mode is an undocumented configuration and testing suite that’s never supposed to be included on shipping firmware. It allows manufacturers to configure important platform settings like boot verification and write the settings to one-time programmable memory modules (FUSEs). The system parameters are initially stored in temporary memory for testing purposes and are then burned to FUSEs when closing Manufacturing Mode. If Manufacturing Mode is still active on a system, it could allow an attacker to create their own malicious system configuration options and lock them into the machine.

Hey! Thanks for mentioning us. Our Systems Team would like to check on this. Could you please tell us more about the challenges with your Razer laptop via DM and we'll take it there.

— RΛZΞR Support (@RazerSupport) March 21, 2019

This vulnerability does not on its own allow hackers to take over a computer, but it offers a mighty tempting target if they manage to get in. They could change system settings to hide malware from detection, essentially telling the computer that the malware the hacker just installed is supposed to be there. Someone could even leverage the Intel Meltdown vulnerability to wreak havoc by downgrading to older BIOS versions that don’t protect against the CPU-level vulnerabilities.

Continue reading

AMD Shipped Almost 1M Ryzen 5000 CPUs, Still Couldn’t Meet Demand
AMD Shipped Almost 1M Ryzen 5000 CPUs, Still Couldn’t Meet Demand

Intel gained market share in desktop and mobile last quarter, but AMD hit records of its own, including the fastest new CPU ramp in company history.

Noctua’s Massive, Passive CPU Cooler Is Shipping Soon
Noctua’s Massive, Passive CPU Cooler Is Shipping Soon

If you've wanted a CPU cooler that could double as a warhammer and doesn't need a fan, Noctua is about to have you covered.

Valve Launches Steam Deck, a New PC Gaming Handheld Shipping in December
Valve Launches Steam Deck, a New PC Gaming Handheld Shipping in December

Valve has announced its new Steam Deck, with plans to ship the PC gaming handheld in December.

AMD Shipping Free APUs to Customers to Address Firmware Update Issue
AMD Shipping Free APUs to Customers to Address Firmware Update Issue

It's not unusual for new CPUs to require UEFI/BIOS updates in order to function properly, but AMD's solution to this issue is some next-level-excellent customer service.