Tuesday, August 24th 2021
Hack a PC? Plug in a Razer Mouse with Automatic Synapse Installation
Over the past few generations, Razer has automated the download and installation of the Razer Synapse software by having it start the first time to plug in a Razer peripheral on your computer (mouse, keyboard, USB headset, etc.). This may be well-intentioned, but comes with a glaring security flaw, according to a LifeHacker report citing a security discovery by @j0nh4t on Twitter. Apparently, plugging in a Razer peripheral causes the Razer Synapse installer to prompt download and installation using a privileged Windows process (using Windows Update).
Once you download and run the installer, you can choose a custom installation folder for the application. This spawns a Windows Explorer dialog that is privileged and can access folders regular users probably don't have access to, as per an organization's group policy. Once in this dialog, you can simply shift+right-click on a folder, and click on "open PowerShell window here," to spawn a privileged PowerShell at that location, and knock yourself out with whatever it is you want to do to the machine. Visit the source link below for a video demo on how this hack works.
Sources:
j0nh4t (Twitter), LifeHacker
Once you download and run the installer, you can choose a custom installation folder for the application. This spawns a Windows Explorer dialog that is privileged and can access folders regular users probably don't have access to, as per an organization's group policy. Once in this dialog, you can simply shift+right-click on a folder, and click on "open PowerShell window here," to spawn a privileged PowerShell at that location, and knock yourself out with whatever it is you want to do to the machine. Visit the source link below for a video demo on how this hack works.
61 Comments on Hack a PC? Plug in a Razer Mouse with Automatic Synapse Installation
Then to top it all off, the mouse mechanically failed 3 days after the warranty ended. Complete failure on the mouse wheel - wouldn't click or roll and with the tracking issues being a constant problem I just through the damn thing away. I haven't touched Razer items since and this just helps reinforce my decision of never using them again.
Agreed, though. I feel it's all really moronic. You want to offer RGB in your devices and also offer a way to control the color and lighting? Fine, push for a standard way of doing that with every RGB [insert device class here] ever with a single unified driver or shove it where the sun doesn't shine and go to hell.
Yeah I'd add microsoft to that as well since they seek and auto install it lol
*Nervously inspects own Razer devices for problems*
6-month-old Kraken X headset already developing fatigue cracks:
Me:
Really hate those flashy big ass program tbh.
He was so excited to tell me about his new headset a couple weeks back. He had plugged them in and started using it - he got a Razer Kraken....I laughed and laughed once he told me what he got, but I said to give them a chance, maybe he'd like them
He plugged in his new headset and started chatting and he sounded like a little 12 year old girl with his new headset. No bass, high pitched and whiny sounding. I just laughed and laughed at him. He was upset and found he needed to install Synapse software so he could mess with some of the mic settings. He found a lot of settings and thought it was a joke and it took him a lot of screwing around with settings and also he used a few walkthrough forum postings we found online to help and try to correct the whiny 12 year old girl sound his mic made him sound like when he talked. Eventually, after a few hours of dinking around with settings he sounds mostly normal. He's pretty pissed for spending $70-80 on the headset and it sounds like crap with the mic. He said at least the headset is comfortable to wear and doesn't hurt his ears.
The unflushable turdThe gift that keeps on giving...As for Synapse, I can agree with him that it is sometimes a nightmare to use. However, I have also used Corsair iCue, Gigabyte RGB Fusion, etc., which are all unnecessarily annoying to use. The thing is, if you want software RGB, fan, pump, or macro controls, you are pretty much stuck with these clunky programs.
The issue outlined in the OP, however, is definitely a Razer-only problem that Razer should fix immediately.
Nope ms could just do what it should do and install a ms generic driver
Mouse/ keyboard manufactures need to include drive disks with their products or simple link to it for download and install.
I mean sure razer should not do what they are doing, but also windows update should never enable them to have such possibilities in the first place.