The security problems just keep coming for Windows. In the latest, a hacker has discovered that by simply using a Razer mouse, someone with bad intent who already has full physical access to your PC can run their own payloads and even abuse and enter the PowerShell command terminal.
A bit like the ongoing PrintNightmare vulnerability issue of injecting bad drivers via Point and Print, this new flaw has to deal with the way that Razer’s gaming software works. Once a Razer mouse is plugged into a PC, Windows Update downloads and runs a “Razer installer” as a system process. This installer then allows hackers to open an elevated version of Windows Explorer to choose where to install drivers, and they can simply then open PowerShell by pressing the Shift and the right-click buttons on the keyboard. You can see this in action below.
Need local admin and have physical access?
– Plug a Razer mouse (or the dongle)
– Windows Update will download and execute RazerInstaller as SYSTEM
– Abuse elevated Explorer to open Powershell with Shift+Right clickTried contacting @Razer, but no answers. So here's a freebie pic.twitter.com/xDkl87RCmz
— ҉j҉o҉n҉h҉a҉t҉ (@j0nh4t) August 21, 2021
Pointing out another issue, the hacker who exposed this flaw said that if the installation process is completed and the files are saved to the desktop, a service binary is saved. This can also be hijacked for persistence and be executed before the user login on boot. Even more alarming is that a real Razer mouse is not needed, as a USB ID can be easily spoofed, according to MSPoweruser.
The hacker involved in this situation says they reached out to Razer and that a fix is coming to correct this issue as soon as possible. It’s highly likely that Microsoft is also involved in the fix. The drivers for Razer mice would be needed to be updated or removed from Windows Update so that it no longer provides system privileges once a mouse is plugged in.
Microsoft has been on top of its game when it comes to these security issues. After hackers raised concerns about issues with the Print Spooler in Windows, the company issued a patch just a few day later. Hackers and security researchers, however, keep digging deeper into Windows to expose more flaws.
The latest came just on August 12, when it was discovered that you don’t need administrative privileges in Windows in cases where you need to connect to a printer or a print server if that printer driver is installed locally.
