Skip to main content

Razer mice could give hackers wide-open local access to your Windows PC

The security problems just keep coming for Windows. In the latest, a hacker has discovered that by simply using a Razer mouse, someone with bad intent who already has full physical access to your PC can run their own payloads and even abuse and enter the PowerShell command terminal.

A bit like the ongoing PrintNightmare vulnerability issue of injecting bad drivers via Point and Print, this new flaw has to deal with the way that Razer’s gaming software works. Once a Razer mouse is plugged into a PC, Windows Update downloads and runs a “Razer installer” as a system process. This installer then allows hackers to open an elevated version of Windows Explorer to choose where to install drivers, and they can simply then open PowerShell by pressing the Shift and the right-click buttons on the keyboard. You can see this in action below.

Related Videos

Need local admin and have physical access?
– Plug a Razer mouse (or the dongle)
– Windows Update will download and execute RazerInstaller as SYSTEM
– Abuse elevated Explorer to open Powershell with Shift+Right click

Tried contacting @Razer, but no answers. So here's a freebie

— jonhat (@j0nh4t) August 21, 2021

Pointing out another issue, the hacker who exposed this flaw said that if the installation process is completed and the files are saved to the desktop, a service binary is saved. This can also be hijacked for persistence and be executed before the user login on boot. Even more alarming is that a real Razer mouse is not needed, as a USB ID can be easily spoofed, according to MSPoweruser.

The hacker involved in this situation says they reached out to Razer and that a fix is coming to correct this issue as soon as possible. It’s highly likely that Microsoft is also involved in the fix. The drivers for Razer mice would be needed to be updated or removed from Windows Update so that it no longer provides system privileges once a mouse is plugged in.

Microsoft has been on top of its game when it comes to these security issues. After hackers raised concerns about issues with the Print Spooler in Windows, the company issued a patch just a few day later. Hackers and security researchers, however, keep digging deeper into Windows to expose more flaws.

The latest came just on August 12, when it was discovered that you don’t need administrative privileges in Windows in cases where you need to connect to a printer or a print server if that printer driver is installed locally.

Editors' Recommendations

If your PC is running slowly, the latest Windows 11 update may be to blame
A laptop running Windows 11.

Microsoft may have a problem on its hands -- the latest Windows 11 update doesn't seem to be working as intended. According to various user reports, the update drastically slows SSD speeds, in some cases even cutting them in half.

If you've noticed that your PC is loading slowly or programs aren't running as quickly as you'd hoped, you might be affected by this problem. Here's how to fix it.

Read more
Firefox just got a great new way to protect your privacy
Canva in Firefox on a MacBook.

If you’re fed up with signing up for new accounts online and then being perpetually spammed in the days and weeks after, Mozilla has an idea that could help. The company has just announced its Firefox Relay feature is being directly integrated into its Firefox web browser, and it could help guarantee your privacy without any extra hassle.

Firefox Relay works by letting you create email “masks” when you sign up for new accounts. Instead of entering your real credentials into the sign-up field, Firefox Relay provides you with a throwaway address and phone number to use. Any messages from the website -- such as purchase receipts -- are then forwarded to your real email address, with all the sender’s tracking information stripped out to protect your privacy.

Read more
Windows 11 could be hurting your gaming performance
Overwatch 2 running on the LG OLED 27 gaming monitor.

If you’ve been wondering why your beefy graphics card hasn’t been performing as well as it should in Windows 11 or Windows 10, the answer could be Microsoft’s Virtualization Based Security (VBS). According to testing done by Tom’s Hardware, VBS could cause gaming performance to drop by as much as 10%.

In a suite of fresh benchmarks, Tom’s Hardware tested 15 different games, from Cyberpunk 2077 to Red Dead Redemption 2, both with VBS enabled and with the feature turned off. In some games, the results could be cause for concern.

Read more