Razer mice and keyboards have administrative powers on Windows PCs

Razer is a household name on our lists of the best gaming mice and best gaming keyboards, but it turns out that these serpentine peripherals have a rather bewildering hidden talent: just plug one in and install the Razer software. Synapse, apparently sufficient to grant administrator privileges on any Windows 10 or Windows 11 PC.

Twitter user jonhat discovered the exploit, which was easily replicated by Bleeping Computer. The problem is largely due to the way Windows Update automatically downloads Synapse software: because Windows Update has SYSTEM (i.e. administrator) privileges, it grants the same level of access to Synapse.

Where things can really get dodgy is when installing Synapse. You, or someone who is trying to mess with your PC, can open a PowerShell window from within the installer – and because Windows effectively gave Synapse administrator powers, that also grants administrator powers. PowerShell window. With this uncertain chain of security, anyone who knows how to run commands in PowerShell will essentially have administrator control over the PC.

While there is something darkly funny about a plastic RGB rodent causing someone to fall off someone’s otherwise locked platform, there is obviously room here for some really nasty malpractice, of the deletion of important files with the installation of malware.

Need a local administrator and physical access?
– Connect a Razer mouse (or dongle)
– Windows Update will download and run RazerInstaller as SYSTEM
– Abuse elevated explorer to open Powershell with Shift + right click

I tried to contact @Razer, but no answers. So here is a gift pic.twitter.com/xDkl87RCmz

– jonhat (@ j0nh4t) August 21, 2021

To view this content, please enable targeting cookies.
Manage cookie settings

That said, it seems like it’s quite an easy feat to protect against. On the one hand, it depends on whether the villain has physical access to your PC, and frankly, if he’s at this point in the first place, there are far worse things he could do to him. If you’re worried about leaving your PC unattended, you can always turn off your system’s USB ports through Device Manager and then turn them back on when you return.

I’m also going to start telling people that this is the reason I got rid of my last Razer mouse, and it absolutely wasn’t because I smashed it on my desk during a miserable session. Deep Rock Galactic like a giant baby.