13 ms·

This is more a Windows bug. Bad enough for Razer customers, but it affects all Windows users. Windows should not install random drivers from the Internet when

by andix 5y ago

This is more a Windows bug. Bad enough for Razer customers, but it affects all Windows users. Windows should not install random drivers from the Internet when a non-admin user is logged in.

jnwatson 5y ago
And then you need to call an admin to plug in a mouse. That's not really practical for a lot of organizations.
- andix 5y ago
  There are generic mouse drivers.
- jefft255 5y ago
  All (I hope) gaming mice with fancy drivers will also just work fine without them.
- ThePadawan 5y ago
  That's already the case in more secure environments (company-provided devices plugged into internal USB ports - all other ports filled with sealant).
  - OJFord 5y ago
    Oh that's why they did that! I'd forgotten until your comment, but I remember thinking that was odd on an internship. Didn't occur to me that it was to prevent there being usable ports (and nor did I try to plug in any car park devices, like a good intern!). My work was only confidential (and that only by default) but it was definitely interesting to be an in environment with secret sauce about, and processes for handling it. (Fire procedure not being drop everything and exit the building, for one.)
  - gruez 5y ago
    That's probably more to prevent data exfiltration. If you don't want random drivers being downloaded you can more reliably prevent it using group policy.
nolok 5y ago
> Windows should not install random drivers from the Internet when a non-admin user is logged in. In a perfect world, or at least a tech user world, sure. But there was a compromise to make, either this (and that behavior can be disabled), or user stayed on admin account at all time. Which was the norm for windows since forever. Even on vista people disabled UAC. From that point of view this is still the more secure outcome, at least the admin hatch is only broken through sometimes, instead of always. Not saying this shouldn't be improved, but if you look not only at the end result but also at the path to get there, it does make some sense.
cosmotic 5y ago
In this case, I think it's fair to blame Razer. They are clearly installing way more than a driver.
- andix 5y ago
  Off course. But as a Windows customer I would expect Microsoft to prevent such issues.
  - cosmotic 5y ago
    I agree they should block this sort of stuff, but don't count on it; When I plug in a Microsoft mouse, a Microsoft IntelliMouse install wizard pops up. In the end, the driver is running executable code which could (I believe) just start an EXE install wizard anyway so this seems unpreventable.
    - wvenable 5y ago
      A privileged executable can always launch another executable with less privileges.
- contravariant 5y ago
  If Microsoft lets anyone owning a Razer mouse/keyboard do whatever it wants to anyone's computer then that's on Microsoft as well. If only Razer customers are affected then, sure let's put all of the blame on Razer but this affects everyone using Windows 10. There are some very good reasons why you cannot simply install device drivers without admin rights and if Microsoft chooses to wave those rights for trusted suppliers then they can very much be blamed for this kind of oversight.
Algent 5y ago
Windows Update should behave differently depending on what it's handling. If it's signed by MS sure go on, if it's a simple signed driver file maybe directly load it too. But for anything else always request admin credentials and meanwhile keep using generic drivers if available.
ajross 5y ago
Well, no. It's a Razer bug. Razer wrote the software. They wrote it to run as admin when you plug a new device in. They wrote it to launch a browser (!!!) under user control. Those are all Razer mistakes, Microsoft didn't do that. Now, it's true that MS has a flawed architecture here. But it's not inherently so as I see it. Third party devices do need automatic driver install of some form. Drivers do need elevated privileges. Microsoft's model was that they'd audit and authenticate the software through the WHQL process. And it turns out that let a really glaring hole through. But the problem is just really, really hard. If you want third party driver software to run on your system (and not all vendors want that: iOS has nothing of the sort, obviously, and Linux vendors ship all the drivers themselves) then you need to be prepared to do a ton work ensuring it's safe.
- p_j_w 5y ago
  >Microsoft's model was that they'd audit and authenticate the software through the WHQL process. And it turns out that let a really glaring hole through. Not to let Razer off the hook here, because they're responsible as well, but in doing as you've described here, Microsoft are have willingly placed the onus for security on themselves. >Linux vendors ship all the drivers themselves Not all of them. Nvidia is a famous exception to this. If you want to install their drivers, I don't know of a Linux distro that will allow you to without root privilege.
  - ajross 5y ago
    To be clear: there are obviously lots of third party Linux drivers out there. But they're delivered, installed and supported by that third party. Security of the NVIDIA driver is NVIDIA's job, and no one is surprised. And as a result, you need to run a tool as the root user and elevate the privilege level yourself to get it installed. Now, that user experience broadly sucks vs. plugging the same PCIe card into a Windows box and booting it up to get an automatically installed driver. But it's not subject to the same security problems either, which was my point.
    - chris37879 5y ago
mhh__ 5y ago
Microsoft seem to be fiddling around with eBPF, would be nice to see verified driver bytecode for simple stuff.
schoolornot 5y ago
A 3rd party driver's capabilities should be scoped to whatever type of component it's for and in this case a mouse driver should only be allowed to do mouse things. OAuth for Windows, I rest my case.
madars 5y ago
And the great thing is you don't even need Razer device to exploit this! You can just any Linux device, e.g. a phone running LineageOS as in this PoC https://twitter.com/an0n_r0/status/1429386474902917124 https://twitter.com/an0n_r0/status/1429386474902917124 https://gist.github.com/tothi/3cdec3aca80e08a406afe695d5448936 https://gist.github.com/tothi/3cdec3aca80e08a406afe695d54489...
- cozzyd 5y ago
  Or presumably any USB microcontroller would work!
- IncRnd 5y ago
  I remember a different form of this from years ago. At the login screen, go to the accessibility/help prompts and open cmd.exe just like was done here to open PS>. This has been a standard kiosk breakout method of various effectiveness for a long time. The user rights were not always SYSTEM, though...
chaostheory 5y ago
HP printers have the same bug then during installation, if you do it from USB.

by andix 5y ago

This is more a Windows bug. Bad enough for Razer customers, but it affects all Windows users. Windows should not install random drivers from the Internet when a non-admin user is logged in.

jnwatson 5y ago

And then you need to call an admin to plug in a mouse. That's not really practical for a lot of organizations.

andix 5y ago
There are generic mouse drivers.
jefft255 5y ago
All (I hope) gaming mice with fancy drivers will also just work fine without them.
ThePadawan 5y ago
That's already the case in more secure environments (company-provided devices plugged into internal USB ports - all other ports filled with sealant).
- OJFord 5y ago
  Oh that's why they did that! I'd forgotten until your comment, but I remember thinking that was odd on an internship. Didn't occur to me that it was to prevent there being usable ports (and nor did I try to plug in any car park devices, like a good intern!). My work was only confidential (and that only by default) but it was definitely interesting to be an in environment with secret sauce about, and processes for handling it. (Fire procedure not being drop everything and exit the building, for one.)
- gruez 5y ago
  That's probably more to prevent data exfiltration. If you don't want random drivers being downloaded you can more reliably prevent it using group policy.

nolok 5y ago

> Windows should not install random drivers from the Internet when a non-admin user is logged in. In a perfect world, or at least a tech user world, sure. But there was a compromise to make, either this (and that behavior can be disabled), or user stayed on admin account at all time. Which was the norm for windows since forever. Even on vista people disabled UAC. From that point of view this is still the more secure outcome, at least the admin hatch is only broken through sometimes, instead of always. Not saying this shouldn't be improved, but if you look not only at the end result but also at the path to get there, it does make some sense.

cosmotic 5y ago

In this case, I think it's fair to blame Razer. They are clearly installing way more than a driver.

andix 5y ago
Off course. But as a Windows customer I would expect Microsoft to prevent such issues.
- cosmotic 5y ago
  I agree they should block this sort of stuff, but don't count on it; When I plug in a Microsoft mouse, a Microsoft IntelliMouse install wizard pops up. In the end, the driver is running executable code which could (I believe) just start an EXE install wizard anyway so this seems unpreventable.
  - wvenable 5y ago
    A privileged executable can always launch another executable with less privileges.
contravariant 5y ago
If Microsoft lets anyone owning a Razer mouse/keyboard do whatever it wants to anyone's computer then that's on Microsoft as well. If only Razer customers are affected then, sure let's put all of the blame on Razer but this affects everyone using Windows 10. There are some very good reasons why you cannot simply install device drivers without admin rights and if Microsoft chooses to wave those rights for trusted suppliers then they can very much be blamed for this kind of oversight.

Algent 5y ago

Windows Update should behave differently depending on what it's handling. If it's signed by MS sure go on, if it's a simple signed driver file maybe directly load it too. But for anything else always request admin credentials and meanwhile keep using generic drivers if available.

ajross 5y ago

Well, no. It's a Razer bug. Razer wrote the software. They wrote it to run as admin when you plug a new device in. They wrote it to launch a browser (!!!) under user control. Those are all Razer mistakes, Microsoft didn't do that. Now, it's true that MS has a flawed architecture here. But it's not inherently so as I see it. Third party devices do need automatic driver install of some form. Drivers do need elevated privileges. Microsoft's model was that they'd audit and authenticate the software through the WHQL process. And it turns out that let a really glaring hole through. But the problem is just really, really hard. If you want third party driver software to run on your system (and not all vendors want that: iOS has nothing of the sort, obviously, and Linux vendors ship all the drivers themselves) then you need to be prepared to do a ton work ensuring it's safe.

p_j_w 5y ago
>Microsoft's model was that they'd audit and authenticate the software through the WHQL process. And it turns out that let a really glaring hole through. Not to let Razer off the hook here, because they're responsible as well, but in doing as you've described here, Microsoft are have willingly placed the onus for security on themselves. >Linux vendors ship all the drivers themselves Not all of them. Nvidia is a famous exception to this. If you want to install their drivers, I don't know of a Linux distro that will allow you to without root privilege.
- ajross 5y ago
  To be clear: there are obviously lots of third party Linux drivers out there. But they're delivered, installed and supported by that third party. Security of the NVIDIA driver is NVIDIA's job, and no one is surprised. And as a result, you need to run a tool as the root user and elevate the privilege level yourself to get it installed. Now, that user experience broadly sucks vs. plugging the same PCIe card into a Windows box and booting it up to get an automatically installed driver. But it's not subject to the same security problems either, which was my point.
  - chris37879 5y ago

mhh__ 5y ago

Microsoft seem to be fiddling around with eBPF, would be nice to see verified driver bytecode for simple stuff.

schoolornot 5y ago

A 3rd party driver's capabilities should be scoped to whatever type of component it's for and in this case a mouse driver should only be allowed to do mouse things. OAuth for Windows, I rest my case.

madars 5y ago

And the great thing is you don't even need Razer device to exploit this! You can just any Linux device, e.g. a phone running LineageOS as in this PoC https://twitter.com/an0n_r0/status/1429386474902917124 https://twitter.com/an0n_r0/status/1429386474902917124 https://gist.github.com/tothi/3cdec3aca80e08a406afe695d5448936 https://gist.github.com/tothi/3cdec3aca80e08a406afe695d54489...

cozzyd 5y ago
Or presumably any USB microcontroller would work!
IncRnd 5y ago
I remember a different form of this from years ago. At the login screen, go to the accessibility/help prompts and open cmd.exe just like was done here to open PS>. This has been a standard kiosk breakout method of various effectiveness for a long time. The user rights were not always SYSTEM, though...

chaostheory 5y ago

HP printers have the same bug then during installation, if you do it from USB.