Razer mice plus a windows machine can give you admin privileges, contact tracing data
is exposed in a data leak, and a t-mobile hack followup - yes, it’s real!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for August 24, 2021!
This is your weekly summary of the threats to our security, privacy and Internet freedom.
Happy Pumpkin Spice Latte day if you’re into that like I am!
We have some hacks and zero days to get into today so..
Onto the news!!
Props to Joel for sharing this story!
Microsoft is currently investigating a newly discovered bug that could let a person plug
in a peripheral and gain admin rights… yes, that’s the bug.
It’s a zero day found in the device installer software for Razer mice and keyboards and
any other peripherals using the Razer Synapse utility.
It’s possible this could affect Windows 11 too, so we may see updates as that OS is
tested.
Razer manufactures popular gaming peripherals like headsets, mice, and keyboards and Synapse
allows for you to change lighting patterns, macros, and other configurations.
While this bug wasn’t disclosed through a private communication, Razer did award a
bug bounty to the original security researcher who found the issue.
Jonhat on twitter had posted a tweet about the bug on Saturday after he tried to contact
Razer and got no reply, but the tweet did get their attention.
According to his tweet, if you have physical access you could plug in a razer dongle or
mouse, Windows Update will download and execute RazerInstaller as SYSTEM, and you can hit
Shift+ Right Click to abuse the elevated explorer and open Powershell.
Moreso he added that quote “if you go through the installation process and define the save
directory to a user controllable path like Desktop, a service binary is saved there which
can be hijacked for persistence and is executed before user logon on boot.”
Since the RazerInstaller executable launches via a Windows process with SYSTEM privs, and
it keeps those same admin privileges, you can change the default installation folder
and at that point, hit shift and right click to open powershell with the same privs.
That Powershell prompt allows you to “Open Powershell Window Here” and that can open
PowerShell from the folder directory with the same elevated privileges.
Again, this does require physical access, but can take just a minute or two to implement.
And knowing how many different gaming mice I’ve tested for my tech channel I immediately
wondered if I could do this with other brands, too, given all of them have similar installation
patterns and prompt you to install their software.
And other commenters on Jonhat’s tweet are starting to share the same hypothesis, with
one saying that it works on Republic of Gamers peripherals too.
It’s entirely possible it doesn’t just affect Razer.
This is a really easy one to test, so if you have a computer where you can legally do so,
I’d love to know if it works with other brands of peripherals too.
Security research firm Upguard discovered a flaw in Microsoft’s Power Apps portals
that was exposing data to the internet.
They found about 38 million records were exposed from over a thousand different web apps that
many companies were using, including 750,000 datasets from Indiana’s contact tracing
system for Covid-19.
Unfortunately, Indiana’s Department of Health described this as “unauthorized access”
from Upguard, even though it was a data leak that Upguard was alerting them to.
Microsoft’s Power Apps portal service is a dev platform that allows you to easily create
mobile or web apps and spin them up quickly - so they’re great for setting up a public
facing site and a data management backend for large companies, government agencies,
or small businesses.
Now that this flaw has been fixed - it was originally found in May by the researchers
- we know that several companies were leaving this data exposed.
That includes American Airlines, Ford, Maryland Department of Health, the NYC Municipal Transportation
Authority, NYC public schools, and Indiana’s Dept of Health.
Some of these web apps were being used for job application portals, employee databases,
vaccination appointment sign ups, and contact tracing.
Which means some of the data exposed is very sensitive, like home addresses, social security
numbers, phone numbers, emails, date of birth and more.
Upguard found that when spinning up some Power Apps APIs, they defaulted to leaving data
publicly accessible, and you have to manually set up privacy settings, so many companies
and agencies just never did that.
Microsoft responded after Upguard reported the issue to them by changing Power Apps portals
to default to storing data privately in their API.
They also released a tool so users can easily tell if their app is exposing data.
Almost all of the sensitive data is now secured due to Upguard contacting customers of Power
Apps directly to disclose this info before publicizing this news to media outlets.
I love it when y’all send me these adorable pictures of your pets so these are a few from
my hush puppy Patreon Alliance members.
And also THANK YOU to Kristi and Jose for joining.
Patrons are starting to receive their new merch rewards in the mail like mugs and stickers
depending on your perk level - shoutout to Brian for this great mugshot!
You can always sign up at any time to get access to those perks!
Patreon.com/ThreatWire as always for that - OK, onto the third story.
Last week, I shared news about a potential T-Mobile hack that was yet to be confirmed
by the carrier.
The day after recording, T-Mobile did confirm this hack and gave us some more information
about what is going on and what was stolen.
If you want to check out the original story, it’s a part of my Bitcoin Cryptocurrency
video on the Hak5 channel and my video podcast feed.
So this is what we know from T-Mobile’s disclosure.
This hack affects 7.8 million current customers, with data like first and last names, date
of birth, SSN, and drivers licsense and ID info being compromised.
Phone numbers and IMEI and ISMI numbers were also compromised.
Another 5.3 million postpaid customer accounts had one or more of those mentioned data points
accessed as well, but no SSNs or drivers license data were compromised for those 5.3 million.
Along with this, another 40 million former or prospective customers data were exposed.
That included names, date of birth, SSN and drivers licenses.
And another 667,000 former customers had data accessed, including names, phone numbers,
addresses and date of birth.
Furthermore, they also found that separate data points like phone numbers, IMEI and IMSI
numbers were stolen but with no identifiable info tied to them.
No payment information including credit card or financial info was exposed.
About 850,000 active prepaid customers also had their data exposed - including names,
phone numbers, and account PINs.
T-Mobile is offering affected customers 2 years of ID Theft Protection and recommends
customers sign up for Scam Shield as well as reset PINs and Passwords.
I’d also add to that, be very aware of the threat of SIM swapping and take all steps
you can to protect your phone number from being ported to a new phone.
They’ve also closed off the backdoor that was used by a malicious actor to steal the
data and the hack is under an active investigation by authorities.
Now that the studio is finished I’m back to filming content at youtube.com/ShannonMorse.
Hit the subscribe button on that channel to see my upcoming review of the Pixel 5a 5G!
And with that, don't forget to like and subscribe to this channel as well!
I'm Shannon Morse, I'll see you on the Internet!