Razer Synapse Bug Gives Windows Admin Access to Anyone Who Can Plug in a Mouse
You might want to keep an eye on your USB ports for the next few days. A security researcher has disclosed a disturbingly easy way to gain admin privileges in Windows 10 without a password, and for once, it’s not Microsoft’s fault. This time, it’s all thanks to Razer and its Synapse software. A fix is in the works, but Razer missed the opportunity to head this one off before it was a problem.
The story starts with security researcher Jonhat (@j0nh4t on Twitter), who noticed that Razer’s Synapse software would deploy automatically whenever a Razer mouse or wireless receiver was plugged in. Like many feature-rich gaming peripherals, Razer requires the use of its desktop software to control lights, button mapping, and other features.
This part isn’t unusual — Windows Update automatically loads plenty of software for you based on attached hardware. It does this as System, but the current Razer Synapse installer retains System permissions, which turns out to be an issue.
According to Jonhat, it is possible to hijack the elevated Explorer process from the installation to open Powershell. From there, you can install anything you want because the System has the highest user rights available in Windows. In addition, as if that wasn’t bad enough, you can manually select a controllable installation path like Desktop. The installer creates a binary file that can be further leveraged to make any system changes persistent (the binary is executed even before login).
Need local admin and have physical access?– Plug a Razer mouse (or the dongle)– Windows Update will download and execute RazerInstaller as SYSTEM– Abuse elevated Explorer to open Powershell with Shift+Right click
Tried contacting @Razer, but no answers. So here's a freebie pic.twitter.com/xDkl87RCmz
— jonhat (@j0nh4t) August 21, 2021
With vulnerabilities of this severity, it’s expected that the discoverer will responsibly disclose by going through the company. However, Jonhat says Razer ignored his correspondence. So, he’s disclosed the zero-day bug publicly. Several others have since confirmed that a Razer mouse can help take over a Windows 10 PC in as little as a few minutes. Using this method, the attacker can install anything they want without logging in as an administrator.
So, that’s not a great situation, and the only saving grace is that someone needs physical access to your computer (and a Razer peripheral). Following the disclosure, Razer confirmed that it was working on a patch to be delivered soon. In the meantime, keep an eye out for lurkers with glowing mice.
Continue reading
NASA Gives Up on InSight’s Burrowing Mars Heat Probe
NASA's InSight lander has been studying the red planet for more than two years now. During that time, InSIght has beamed back data on the planet's seismic activity, weather, and even the sound of blowing wind. It was also supposed to relay data on the planet's internal temperature, but NASA has announced that it's giving up on that endeavor after being unable to get the heat probe to burrow into the fine Martian soil.
Steam Gives Storage Manager and Download Page a Much-Needed Refresh
Steam has released new-and-improved versions of its downloads page and storage manager. For those with extensive game libraries, the update is long overdue.
Oculus Gives Discontinued Oculus Go a New Lease on Life with Unlocked Software
The release of the Oculus Go in 2018 was an important step for Facebook's Virtual Reality division, but the product was short-lived. After being made obsolete by the Oculus Quest, the company discontinued the Go in 2020. Still, Facebook sold millions of the standalone headsets, and now they're more capable thanks to an unlocked software update.
Humble Bundle Drops Linux and macOS, Gives Customers Mere Weeks to Save Their Games
Humble Bundle has announced a change to the subscription that some gamers won't like. It's simplifying its subscription offerings and rolling out a new launcher, but that launcher is Windows-only.