SteelSeries bug gives Windows 10 admin rights by plugging in a device

guest · Aug 24, 2021

SteelSeries bug gives Windows 10 admin rights by plugging in a device
August 24, 2021
https://www.bleepingcomputer.com/ne...dows-10-admin-rights-by-plugging-in-a-device/

The official app for installing SteelSeries devices on Windows 10 can be exploited to obtain administrator rights, a security researcher has found.

Leveraging the bug is possible during the device setup process, using a link in the License Agreement screen that is opened with SYSTEM privileges. A real SteelSeries device is not necessary to exploit the bug.
Click to expand...

Emulating a device also works
The discovery comes after news broke over the weekend that the Razer Synapse software can be used to gain elevated privileges when connecting a Razer mouse or keyboard.

Encouraged by the research from jonhat, offensive security researcher Lawrence Amer found that the same can be achieved with the SteelSeries device installation software.
Playing with a recently acquired SteelSeries keyboard on Monday, the researcher discovered a privilege escalation vulnerability that allowed him to run the Command Prompt in Windows 10 with admin privileges.
Click to expand...

A real SteelSeries device is not necessary for this attack to work. Penetration testing researcher István Tóth published an open-source script that can mimic human interface devices (HID) on an Android phone, specifically for testing local privilege escalation (LPE) scenarios.

After Amer published his research, Tóth published a video demonstrating that LPE discovered by Amer can be achieved using his USB Gadget Generator Tool.
Click to expand...

Rasheed187 · Aug 28, 2021

How the hell can M$ miss this stuff? Seems like a very simple bypassing method.

Log in or Sign up

SteelSeries bug gives Windows 10 admin rights by plugging in a device

guest Guest

Rasheed187 Registered Member

Log in or Sign up

SteelSeries bug gives Windows 10 admin rights by plugging in a device

guest Guest

Rasheed187 Registered Member

Useful Searches