Over the past few weeks a brand new type of security vulnerability has been causing headaches for users of Razer laptops. The latest update to Razer’s Synapse software introduced a new memory corruption bug that has been causing some users to lose control of their machine.
It seems that Razer laptops have a unique driver bug that allows any user to gain root privileges on any of their laptops. There have been some reports showing the code is in the Cortex-A5 processor on the Razer laptops, rather than the Cortex-A35 processor in the latest Apple laptops. This means that the bug is unlikely to have been fixed in the Cortex-A35 hardware, which is found in the latest Macbook and new iPhone.
This week, Razer released a driver update for the Razer Abyssus 2000 Chroma. This update contained a logic bug that allowed the Razer Abyssus 2000 Chroma to be installed and used on a Windows system. However, once installed, the Razer Abyssus 2000 Chroma would grant the user system administrator (S administrator) privileges, regardless of whether the user was an administrator on their Windows system.
Alexandru Poloboc is an author.
Editor of the News
Alex spent the most of his time working as a news reporter, anchor, and on TV and radio, with an overwhelming urge to always get to the bottom of things and discover the truth… Continue reading
- It was time for a fresh vulnerability now that the PrintNightmare flaw had been fixed.
- On every Windows system, a researcher found a fast and easy method to acquire admin rights.
- All you need is a Razer mouse, which you can connect in and start using right away.
- The business has been notified of the security problem and is trying to resolve it as soon as possible.
When it comes to our internet-connected gadgets, we’ve been talking a lot about security and the measures we should take to keep ourselves secure from outside influence.
But what happens when the danger is closer than we realize? No, this isn’t a James Bond film; rather, it’s the sad yet amusing reality of software problems.
The PrintNightmare incident has drawn the attention of the hacking community to the vulnerabilities that may be exposed when third-party drivers are installed.
We knew it wouldn’t be long until additional methods to break in were revealed, and sure enough, someone has already discovered that by just putting in a Razer wireless dongle, you can walk through a wide-open door in Windows 10.
Table of Contents
This flaw grants you administrative privileges.
Yes, you heard it right. When you connect a Razer device onto a computer running Windows 10 or Windows 11, the operating system will immediately download and install the Razer Synapse software.
Users may use this program to setup their hardware devices, create macros, and map buttons.
A zero-day vulnerability in the plug-and-play Razer Synapse installation was found by a researcher, allowing users to quickly acquire system rights on a Windows device.
In this instance, the fact that Razer says the Synapse software is utilized by over 100 million people across the globe adds fuel to the fire.
Do you need local administration and physical access? – Connect a Razer mouse (or the dongle) – Windows Update will download RazerInstaller and run it as SYSTEM. – Use Shift+Right click to launch Powershell in elevated Explorer.
I attempted to contact @Razer, but received no response. So here’s a picture that you may use for free. twitter.com/xDkl87RCmz
August 21, 2021 — jonhat (@j0nh4t)
System privileges, as you may know, are the highest user rights available in Windows, allowing you to run any command you want on the operating system.
As a result, anybody with these high-level capabilities in Windows has full control over the machine and may install whatever they want, including viruses.
The major problem is that Windows Update downloads and runs RazerInstaller as system, and that the Installer allows users to select where to install the drivers by opening an Explorer window.
After that, all the hacker has to do is hit shift-right-click to launch a Powershell terminal with system rights, and he can do anything he wants.
Furthermore, if the intruder completes the installation process and specifies a user-controllable save location, such as Desktop, the Installer stores a service binary there that may be hijacked for persistence and is run before the user logs in on boot.
Another significant consideration is that the attackers do not need a genuine Razer mouse to carry out their assault since the USB ID can be readily duplicated.
Razer has said that it is trying to resolve the problem.
After the researcher who found the flaw said that he had contacted Razer but had not received a response, the massive hardware maker contacted him and addressed the issue further.
Even though the vulnerability was widely reported, Razer informed him that he would be eligible for a bug bounty.
I’d like to inform you that @Razer has contacted me and assured me that their security team is working on a patch as soon as possible.
Even though I was publicly reporting this problem, their response was professional, and I was even given a reward.
August 22, 2021 — jonhat (@j0nh4t)
We’re all hopeful that this issue will be solved quickly since none of us wants to be a victim of such a simple technique.
However, by the end of next week, both Razer and Microsoft will have released updates to address this flaw.
Have you ever been the victim of data theft or hostile interference? Please share your thoughts in the comments area below.
Was this page of assistance to you?
Thank you very much!
There are insufficient details It’s difficult to comprehend Other Speak with a Professional
Start a discussion.
Related Tags
This article broadly covered the following related topics:
- razer synapse
- razer synapse 3
- razer support
- razer marauder driver
- razer imperator sensor not working
