Who would have thought … a mouse causing a Serious Windows Security Flaw.
Taken fromengadget.… A rather unusual vulnerability in Razer mice has been identified and the company is currently working on a fix. Over the weekend, security researcher Jon Hat posted on Twitter that after plugging in a Razer mouse or dongle, Windows Update will download the Razer installer executable and run it with SYSTEM privileges. It also lets you access the Windows file explorer and Powershell with “elevated” privileges — which essentially means someone with physical access to the computer could install harmful software.
Since this vulnerability requires direct, physical access to a computer, it’s not nearly as dangerous as a security issue that can be carried out remotely, but it’s still a troubling find. Hat said on Twitter that Razer eventually reached out and told him that the company’s security team was working on a fix.
Need local admin and have physical access?
- 插上剃刀鼠标（或加密狗）
– Windows Update will download and execute RazerInstaller as SYSTEM
- 滥用高架资源管理器，以便打开PowerShell +右键单击试图联系@Razer, but no answers. So here’s a freebiepic.twitter.com/xDkl87RCmz
- jonhat（@ j0nh4t）August 21, 2021
razer为我们提供以下声明：
“We were made aware of a situation in which our software, in a very specific use case, provides a user with broader access to their machine during the installation process.
我们调查了这个问题，目前正在更改安装应用程序来限制此用例，并将发布更新的版本。我们的软件（包括安装应用程序）的使用不提供对机器的未经授权的第三方访问权限。
We are committed to ensuring the digital safety and security of all our systems and services, and should you come across any potential lapses, we encourage you to report them through our bug bounty service, Inspectiv:https://app.inspectiv.com/#/sign-up。”
资源：engadget.
