You shouldn't be able to get admin rights by plugging in a mouse.

A rather unusual vulnerability in Razer mice has been identified and the company is currently working on a fix. Over the weekend, security researcher Jon Hat posted on Twitter that after plugging in a Razer mouse or dongle, Windows Update will download the Razer installer executable and run it with SYSTEM privileges. It also lets you access the Windows file explorer and Powershell with "elevated" privileges — which essentially means someone with physical access to the computer could install harmful software.

Since this vulnerability requires direct, physical access to a computer, it's not nearly as dangerous as a security issue that can be carried out remotely, but it's still a troubling find. Hat said on Twitter that Razer eventually reached out and told him that the company's security team was working on a fix.

Razer provided us with the following statement:

"We were made aware of a situation in which our software, in a very specific use case, provides a user with broader access to their machine during the installation process.

We have investigated the issue, are currently making changes to the installation application to limit this use case, and will release an updated version shortly. The use of our software (including the installation application) does not provide unauthorized third-party access to the machine.

We are committed to ensuring the digital safety and security of all our systems and services, and should you come across any potential lapses, we encourage you to report them through our bug bounty service, Inspectiv: https://app.inspectiv.com/#/sign-up."

Update, 2PM ET: Added a statement from Razer.

Source:
courtesy of ENGADGET

by Nathan Ingraham

If you have any stories or news that you would like to share with the global online community, please feel free to share it with us by contacting us directly at [email protected]