Windows 10: this security flaw is really crude and simple to use – Frandroid

A hacker demonstrated a Windows security flaw with Razer devices. It allows you to become an administrator very easily.

Clearly, the teams in charge of Windows security are having a bad summer. After the PrintNightmare flaw, which continues to affect business customers of Microsoft products, here is a new security flaw that also exploits flaws on the peripheral side. This time, you need a Razer device to take advantage of it.

An installation in admin mode

It is the Jonhat Twitter account which presents this flaw with a short video. He presents himself as a hacker and says he contacted Razer without getting a response before the publication. You will see that the flaw is really easy to exploit.

When detecting the Razer device, Windows Update will fetch the drivers for this device automatically. This will trigger the installation of the Razer maintenance software (Razer Synapse) and Microsoft will run it with administrator rights. Problem, during installation, the software offers to choose an alternative installation path using the file explorer. The latter therefore launches in turn in administrator mode. From the file explorer, a simple right click opens the designated path in a Powershell command prompt, still in admin mode. From there, you have access to a system console in administrator mode. “Binpot! ” That’s it.

An additional flaw

Jonhat also specifies that if the user chooses a particular installation path, that of a customizable folder like the Desktop, an executable binary file is saved and can be hacked to obtain a permanent right. The latter is launched before user authentication when starting the machine.

Razer promises quick fix

Razer’s security teams ended up contacting Jonhat to promise a fix quickly. He specifies that he was offered a reward, as part of Razer’s bug bounty, despite the publication of the flaw.

But the peripheral vendor is not the only one involved here. The driver was offered directly by Microsoft through Windows Update to the user. The company should therefore redouble its efforts to guarantee the safety of the drivers that can be installed in this way. In addition, it would be good to check that the other drivers which install associated software do not do so by allowing the explorer to open in admin mode. A reaction from Microsoft on the subject would therefore be opportune.