22 ms·

I was asking, "How can a Razer bug let you break into Windows? Is it a Razer device driver?" Yes. I'll just quote jonhat's tweet from the article: Need lo

I was asking, "How can a Razer bug let you break into Windows? Is it a Razer device driver?" Yes. I'll just quote jonhat's tweet from the article: Need local admin and have physical access? - Plug a Razer mouse (or the dongle) - Windows Update will download and execute RazerInstaller as SYSTEM - Abuse elevated Explorer to open Powershell with Shift+Right click

azalemeth 5y ago
Wow. That's a Windows 98 level of "school kid" privilege escalation bug...
- ronsor 5y ago
  For reference: https://imgur.com/r/hacking/rG0p0b2 https://imgur.com/r/hacking/rG0p0b2
  - azalemeth 5y ago
    Hah, I like that one. The other classic is Right Click -> New -> Shortcut -> cmd.exe in an explorer "open" window, typically one in an otherwise very locked-down environment. This has recently got me service access on an old (but new in 2009!) ultrasound machine, for example, for getting raw data and dicom images off in a hurry when the proper authentication details were lost...
    - jmiserez 5y ago
      Ophcrack works too, at least if the underlying machine still runs Windows XP: https://en.wikipedia.org/wiki/Ophcrack https://en.wikipedia.org/wiki/Ophcrack
    - lostlogin 5y ago
      > ultrasound machine The real boss move was navigating a machine with a UI that involved a trackball, keyboard, touch screen(s), touch pad, weird array of custom buttons and a truely stupid menu system. Configuring US machines is horrible. But my major US machine rant is them burning metadata into the images (rather than displaying DICOM tags as an overlay). It’s is beyond ridiculous.
      - azalemeth 5y ago
        Exactly! MR ("my" modality) has it right -- raw data and reconned images are very, very different and although most raw data never ends up in a dicom the mere fact that you genuinely could reconstruct dramatically different bits of info (e.g. magnitude vs phase images) means that the vast expanse of the dicom spec is wide enough to encompass all possible metadata requirements. US machines do a lot of fun physics on proprietary FPGAs. For inexplicable reasons, every one I've ever worked with or done echo with saves the images as some variation on a theme of screenshots, shoehorned badly into a dicom wrapper, with the metadata burned at 640x480 px (or similar) on top. Even for clever derived modes like doppler -- even for annotations showing things like cardiac E/E' or E/A. They are laptops with a custom pcmcia / pcie card and a 100k-UNIT_OF_CURRENCY price tag, inevitably running a shitty OS with a shittier custom UI...
        lostlogin 5y ago
        MRI is my modality of choice too. I’m currently loving most of what Siemens is up to (with some notable exceptions). The hell of US knows no bounds. Most modalities calibrate a display and then display images (with varying degrees of post processing). US calibrates the screen, sometimes with each boot or even each probe change. Their black levels are abysmal. > saves the images as some variation on a theme of screenshots GE has a habit of making DICOMs from screen grabs. I’ve seen it on their PET, CT and MR systems. It causes irritating problems - like reference lines won’t work so you can’t cross reference.
  - VelkaMorava 5y ago
    That's impressive
  - riversflow 5y ago
    Wow! What a trip down memory lane, I actually remember figuring this one out when I was.. dating myself here[1], about 7 years old, I really wanted to play my Thinking Things Collection 3.[2] When I inevitably got caught I remember my dad let me have my own user, but put some sort of further time-restriction software on the PC, no idea what it was, but I figured out that if I timed Ctrl-Alt-Delete at just the right time during the start cycle, I could, if I worked fast enough, end the process before it locked me out of login. XD Oh to be a 90s kid. [1] to be fair though we didn't update Windows immediately on release and never had '98. [2]https://www.myabandonware.com/game/thinkin-things-collection-3-3rd https://www.myabandonware.com/game/thinkin-things-collection...
    - ateng 5y ago
      My mother just unplug the keyboard and take it away. She underestimated my ability to navigate Windows 98 and play AoE I using only mouse...
    - Agentlien 5y ago
      I remember our school administrator used to delete all our silly images we'd made with paint on the school PCs. We asked why but never got a good answer. I figured out that putting a certain character in front of a file name made it not show up in explorer. So I did that to a folder in my home directory and put all my stuff there, accessing them from the command line instead. Never had them deleted, again.
guitarbill 5y ago
Apart from the security issue, it's really annoying, too. Say you refuse to install the Razer device driver - after all the mouse will largely work fine without it thanks to HID. Every time you plug the mouse in, Windows re-runs the driver installer.
- maccard 5y ago
  How often do you re plug in your mouse?
  - garblegarble 5y ago
    Possibly multiple times a day if they're using a laptop dock
  - deleted 5y ago
    [deleted]
  - chris37879 5y ago
    Physically? Basically never. Practically? Dozens of times a day as I machine hop using my USB hub in my monitor.
- ByteWelder 5y ago
  Corsair has something similar called "iCue". Even if you don't bother installing it, the default Windows driver pops up an advertisement for it: https://imgur.com/0fKRYLT https://imgur.com/0fKRYLT (as discussed at https://old.reddit.com/r/pcmasterrace/comments/9ws0qi/corsair_now_forcing_desktop_popups_on_hardware/ https://old.reddit.com/r/pcmasterrace/comments/9ws0qi/corsai...) Similarly, I've had Windows 10 spam me about a paid subscription for Dolby Atmos. This is just one of several reasons that I don't use Windows anymore.
- jareklupinski 5y ago
  I just got a Razer Kiyo webcam, excellent stuff, but I had to open regedit to get it to stop asking me if I want to install additional software every time I plugged it in or rebooted. It works fine without it, but whoever programmed this thing has never heard of a "No, and Don't Ask Me Again" Button. In regedit, F3 for razerinstaller and add a DWORD key "Start" with value "4" . Yea that's how far they went XD
srcmap 5y ago
Is this issue equivalent of setuid 4701 on executable owned by root in Linux? What's the easiest way to scan whole windows file system for directories with this issue?
- hjek 5y ago
  > What's the easiest way to scan whole windows file system for directories with this issue? tree c:\ /f prn Source: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/tree https://docs.microsoft.com/en-us/windows-server/administrati...
- cjbprime 5y ago
  (It wouldn't help to scan the filesystem, since the way the vulnerability works is that the driver will be automatically downloaded and run when a peripheral's plugged in.)
tomc1985 5y ago
This was exactly how I was able to break out of an unprivileged user account in Windows XP, except it involved setting a timer with `at`

azalemeth 5y ago

Wow. That's a Windows 98 level of "school kid" privilege escalation bug...

ronsor 5y ago
For reference: https://imgur.com/r/hacking/rG0p0b2 https://imgur.com/r/hacking/rG0p0b2
- azalemeth 5y ago
  Hah, I like that one. The other classic is Right Click -> New -> Shortcut -> cmd.exe in an explorer "open" window, typically one in an otherwise very locked-down environment. This has recently got me service access on an old (but new in 2009!) ultrasound machine, for example, for getting raw data and dicom images off in a hurry when the proper authentication details were lost...
  - jmiserez 5y ago
    Ophcrack works too, at least if the underlying machine still runs Windows XP: https://en.wikipedia.org/wiki/Ophcrack https://en.wikipedia.org/wiki/Ophcrack
  - lostlogin 5y ago
    > ultrasound machine The real boss move was navigating a machine with a UI that involved a trackball, keyboard, touch screen(s), touch pad, weird array of custom buttons and a truely stupid menu system. Configuring US machines is horrible. But my major US machine rant is them burning metadata into the images (rather than displaying DICOM tags as an overlay). It’s is beyond ridiculous.
    - azalemeth 5y ago
      Exactly! MR ("my" modality) has it right -- raw data and reconned images are very, very different and although most raw data never ends up in a dicom the mere fact that you genuinely could reconstruct dramatically different bits of info (e.g. magnitude vs phase images) means that the vast expanse of the dicom spec is wide enough to encompass all possible metadata requirements. US machines do a lot of fun physics on proprietary FPGAs. For inexplicable reasons, every one I've ever worked with or done echo with saves the images as some variation on a theme of screenshots, shoehorned badly into a dicom wrapper, with the metadata burned at 640x480 px (or similar) on top. Even for clever derived modes like doppler -- even for annotations showing things like cardiac E/E' or E/A. They are laptops with a custom pcmcia / pcie card and a 100k-UNIT_OF_CURRENCY price tag, inevitably running a shitty OS with a shittier custom UI...
      - lostlogin 5y ago
        MRI is my modality of choice too. I’m currently loving most of what Siemens is up to (with some notable exceptions). The hell of US knows no bounds. Most modalities calibrate a display and then display images (with varying degrees of post processing). US calibrates the screen, sometimes with each boot or even each probe change. Their black levels are abysmal. > saves the images as some variation on a theme of screenshots GE has a habit of making DICOMs from screen grabs. I’ve seen it on their PET, CT and MR systems. It causes irritating problems - like reference lines won’t work so you can’t cross reference.
- VelkaMorava 5y ago
  That's impressive
- riversflow 5y ago
  Wow! What a trip down memory lane, I actually remember figuring this one out when I was.. dating myself here[1], about 7 years old, I really wanted to play my Thinking Things Collection 3.[2] When I inevitably got caught I remember my dad let me have my own user, but put some sort of further time-restriction software on the PC, no idea what it was, but I figured out that if I timed Ctrl-Alt-Delete at just the right time during the start cycle, I could, if I worked fast enough, end the process before it locked me out of login. XD Oh to be a 90s kid. [1] to be fair though we didn't update Windows immediately on release and never had '98. [2]https://www.myabandonware.com/game/thinkin-things-collection-3-3rd https://www.myabandonware.com/game/thinkin-things-collection...
  - ateng 5y ago
    My mother just unplug the keyboard and take it away. She underestimated my ability to navigate Windows 98 and play AoE I using only mouse...
  - Agentlien 5y ago
    I remember our school administrator used to delete all our silly images we'd made with paint on the school PCs. We asked why but never got a good answer. I figured out that putting a certain character in front of a file name made it not show up in explorer. So I did that to a folder in my home directory and put all my stuff there, accessing them from the command line instead. Never had them deleted, again.

guitarbill 5y ago

Apart from the security issue, it's really annoying, too. Say you refuse to install the Razer device driver - after all the mouse will largely work fine without it thanks to HID. Every time you plug the mouse in, Windows re-runs the driver installer.

maccard 5y ago
How often do you re plug in your mouse?
- garblegarble 5y ago
  Possibly multiple times a day if they're using a laptop dock
- deleted 5y ago
  [deleted]
- chris37879 5y ago
  Physically? Basically never. Practically? Dozens of times a day as I machine hop using my USB hub in my monitor.
ByteWelder 5y ago
Corsair has something similar called "iCue". Even if you don't bother installing it, the default Windows driver pops up an advertisement for it: https://imgur.com/0fKRYLT https://imgur.com/0fKRYLT (as discussed at https://old.reddit.com/r/pcmasterrace/comments/9ws0qi/corsair_now_forcing_desktop_popups_on_hardware/ https://old.reddit.com/r/pcmasterrace/comments/9ws0qi/corsai...) Similarly, I've had Windows 10 spam me about a paid subscription for Dolby Atmos. This is just one of several reasons that I don't use Windows anymore.
jareklupinski 5y ago
I just got a Razer Kiyo webcam, excellent stuff, but I had to open regedit to get it to stop asking me if I want to install additional software every time I plugged it in or rebooted. It works fine without it, but whoever programmed this thing has never heard of a "No, and Don't Ask Me Again" Button. In regedit, F3 for razerinstaller and add a DWORD key "Start" with value "4" . Yea that's how far they went XD

srcmap 5y ago

Is this issue equivalent of setuid 4701 on executable owned by root in Linux? What's the easiest way to scan whole windows file system for directories with this issue?

hjek 5y ago
> What's the easiest way to scan whole windows file system for directories with this issue? tree c:\ /f prn Source: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/tree https://docs.microsoft.com/en-us/windows-server/administrati...
cjbprime 5y ago
(It wouldn't help to scan the filesystem, since the way the vulnerability works is that the driver will be automatically downloaded and run when a peripheral's plugged in.)

tomc1985 5y ago

This was exactly how I was able to break out of an unprivileged user account in Windows XP, except it involved setting a timer with `at`