A couple of days ago it was reported that the mice and keyboards of the technology company Razer could allow threat actors to access Windows 10 systems because their installer runs with SYSTEM privileges. As if that weren’t enough, it was confirmed that a SteelSeries bug could remove Windows 10 administrator rights by simply connecting a device and even tricking an Android smartphone to complete a successful attack.
SteelSeries is a hardware developing company, specialized in the manufacture of devices like gamer mouse, keyboards, headsets, controllers and mousepads.
The Danish firm has already fixed this vulnerability, which could have been exploited during the process of configuring a new device through the License Agreement, which as in Razer runs with SYSTEM privileges.
Researcher Lawrence Amer presented his findings to SteelSeries on Tuesday. In turn, the company responded by mentioning that the problem had already been detected and would be addressed as soon as possible in order to mitigate the risk of active exploitation.
“We are aware of the identified issue and will proactively disable the release of the SteelSeries device installer, automatically activated when connecting new hardware to a system.” The company expects this to completely eliminate any attack risk, though it is believed that further action will be taken eventually.
In this regard, the researcher believes that the company has not realized the severity of this report, since the vulnerability could still be exploited in updated systems, as hackers are able to save the signed executable that causes this problem in a temporary folder and inject it into the exposed systems in the form of a DNS poisoning attack.
As some users may already know, this is an attack variant that allows the introduction of malicious data into the compromised system, causing the DNS to return incorrect records.
So far, the company has not commented on the diagnosis the researcher provided about the patch released.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
