You Can Get Administrator Rights on Any Windows Computer by Connecting a Razer Mouse
Not all Windows users are created equal. Without administrator access, you can use the computer, but you are not allowed to install certain applications or execute commands, and generally you are not allowed full control over the machine. But right now, you can grant yourself system privileges on any Windows 10 PC by simply plugging in a Razer keyboard or mouse . It seems … bad.
Usually different “user rights” are good for Windows. It protects your system from people who maliciously or not, abuse these privileges. When you have administrator or SYSTEM rights, you have complete control over Windows, so it can be dangerous to delegate those rights to someone else.
The idea that plugging in the right mouse can give you complete control over your computer sounds more unrealistic than aTV hacker , but it’s true. When you connect one of these Razer peripherals, Windows automatically loads Razer Synapse , the software that controls specific settings for your mouse or keyboard. The specified Razer software has SYSTEM privileges because it runs from a Windows process with SYSTEM privileges.
But the vulnerability is not here. After installing the software, the Windows Setup Wizard will ask you which folder you want to save it to. When you select a new location for the folder, you will see a ” Select folder ” prompt. Press Shift and right click and you can select ” Open PowerShell Window Here ” which will open a new PowerShell window.
Because this PowerShell window was launched from a process with system privileges, the PowerShell window itself now has system privileges. In fact, you’ve become a computer administrator, capable of running any command you can think of in a PowerShell window.
This vulnerability was first discovered on Twitter by user jonhat, who first tried to contact Razer about the issue, to no avail. Razer eventually confirmed that a fix is in the works. However, until this patch is available, the company inadvertently sells tools that make it easy to hack into millions of computers.
How to protect your PC from the Razer vulnerability
While it’s best to wait for Razer to fix this bug for its part, we don’t know how long it will take. If you want to protect your computer from the machinations of potential hackers using Razer peripherals, you can disable your computer’s USB ports right now.
Not everyone should do this. If you need USB ports for a mouse, keyboard, or other important peripheral devices, you should not disable these ports. If your computer supports Bluetooth mice and keyboards, or if you are using a laptop, this method is safer for you.
There are various (and tricky) ways to do this, but the easiest way to get started is through Device Manager. Right-click This PC , then click Manage . Click Device Manager , then click the arrow next to Universal Serial Bus Controllers. Here you will find all the USB controllers for your computer. You can right-click these items and select Disable to disable them.
When you’re ready to re-enable the USB ports, you can follow these same instructions and select Enable instead. Just remember: This exploit requires someone to physically connect a Razer mouse to your computer, so unless you leave your computer outdoors often, there is little risk to your machine.
Update: On Tuesday afternoon, Razer PR reached out to us with the following statement:
We have become aware of a situation where our software, in a very specific use case, gives the user more access to their machine during the installation process.
We have investigated the issue, are currently making changes to the installer application to restrict this use case, and will release an updated version shortly. The use of our software (including the installer application) does not allow unauthorized third parties to access the machine.
We are committed to ensuring that all our systems and services are digitally secure, and if you encounter any potential omissions, we encourage you to report them through our Inspectiv bug bounty service: https://app.inspectiv.com/ # / sign up
This article was edited on August 24 at 10:28 am to add context about disabling USB ports on your PC.