back to article Razer – perfectly happy to sell you a laptop for over $2,000, but when it comes to fixing security holes... tough sh*t

Gaming PC specialist Razer has been singled out for leaving its motherboards vulnerable to a well-known and critical firmware vulnerability. Infosec bod Bailey Fox said Razer's Intel notebook models are still vulnerable to CVE-2018-4251, a security screw-up that potentially allows malware with administrative rights to alter …

  1. sequester

    Gamers are the best target for those attacks

    It's still commonplace in gamer circles to randomly run crap as admin if something doesn't work. Games routinely ask for admin privileges for whatever reason, patchers install root certificates and nobody thinks it's wrong. Something crashes? Sure, rightclick, run as admin. Kid broke into the liquor stash? Sure, here are the car keys, hope you learn from your mistakes son!

    1. Anonymous Coward
      Anonymous Coward

      Re: Gamers are the best target for those attacks

      But the .nfo tells me to run with Admin rights..

      1. Anonymous Coward
        Anonymous Coward

        Re: Gamers are the best target for those attacks

        And to ignore the AV warnings, 'cause it's a false positive

    2. DrXym Silver badge

      Re: Gamers are the best target for those attacks

      Not to mention the greater chance that the person will be downloading warez, cracks, aimbots, etc.

      1. baud Bronze badge

        Re: Gamers are the best target for those attacks

        Not to mention the greater chance that the person will be downloading warez, cracks, aimbots, etc.

        And demos, mods, abandonware titles, cheat engines, game servers, IRC clients, recording/streaming software...

  2. Lee D Silver badge

    Wait... gamers buy Razer?

    I thought it was like Alienware and Apple... only sold to "geeks" and "media" people, and used by their stereotype on TV programs (e.g. Big Bang Theory was all Alienware... but they covered up the Apple logos on quite-obviously-Macs)... i.e. you buy them to look like that class of person, not because you actually are one.

    Surely the proper gamers aren't actually touching anything from Razer at all?

    It's the go-faster stripes of the computer industry. You put them on because you think it makes you look cool, but actually anyone who does the real thing is looking at you like you're an idiot for touching them.

    1. MonkeyCee Silver badge

      Official sponsorship

      "but they covered up the Apple logos on quite-obviously-Macs"

      Generally you can only show the logos if the company has agreed to it, usually as part of a sponsorship deal. So unless Apple/Dell etc have given the green light, you cover up the logo. Even if it's very clearly a macbook.

      Same goes for cars etc. Bond films are a classic case where one company gets to pick the both Bond's car, and the bad guys cars. IIRC Goldeneye had BMW sponsorship, so the bad guys all drove mercs :)

      Some production companies have rules about it, such as the beeb.

      As for gamers buying Razor products, mice maybe? Personal preference is for a RAT of some description, but I thought the Razor Naga was quite highly thought of.

      1. steviebuk Silver badge

        Re: Official sponsorship

        Yes. I had to look up why logos are blurred on US TV. Don't think that applies in the UK though, apart from the BBC not allowing advertising. Other show channels can stick stuff in, even if not sponsored. But in US if Apple has agreed, you have to cover said logos or they can sue. Stupid idea.

        1. steviebuk Silver badge

          Re: Official sponsorship

          Jesus that was a mess. I need a physical keyboard as touchscreen on the phone is shit.

          That should of said "If Apple hasn't agreed, you have to blur or cover the logo or they can sue" it's a very strange system in the US. Surely it's free advertising.

          1. Charles 9 Silver badge

            Re: Official sponsorship

            It's a matter of trademarks. You see the same problem with racing games that tout their realism. If an ersatz car performs badly, it could look bad for the real-world make the car mimics. Product placement is generally a good thing and companies will usually agree to it, but not if it'll make the product look bad.

            As for Apple, I didn't think they allowed the use of their products at all unless their logo was visible; thus why every iPhone/iPad case I know has to have a cutaway to expose the Apple logo.

            1. doublelayer Silver badge

              Re: Official sponsorship

              I don't think they get to decide what cases are allowed. I have only ever had iPhone cases that fully cover the phone's back, and I did not have to do anything unusual to obtain them. I always assumed that customers wanted (or case manufacturers assumed that they wanted) the Apple logo displayed. Given that some view Apple as a brand to show off, that makes sense.

              1. Charles 9 Silver badge

                Re: Official sponsorship

                " I have only ever had iPhone cases that fully cover the phone's back, and I did not have to do anything unusual to obtain them."

                I'd like to know how you obtained them, then. Because EVERY iDevice I see has the Apple logo plain as day somewhere. The one time I saw an iPad with its back completely covered (due to it being mounted on an articulated frame), a large Apple logo was affixed to a corner on the FRONT side of the framework holding the iPad. And this wasn't a consumer device but a device used for taking online orders in a kitchen, so there could be no possible reason to stick a piece of decor to a business device unless they were forced to do so.

                1. doublelayer Silver badge

                  Re: Official sponsorship

                  I went to a place in a mall that was selling phone cases. I wanted one that was somewhat flexible, so I looked at the cases in order to find one. The one I found and decided I liked completely covered the back, other than the camera. So did a bunch of other options at this place. The one before that which fell apart quickly but also covered the whole phone I purchased on Amazon. I didn't make any special effort, and they were dirt cheap. Maybe they don't have them in all places, but it has been quite easy for me to find them without really trying.

            2. steviebuk Silver badge

              Re: Official sponsorship

              But you could argue a game is a simulation of a product so understandable. A car being in a show and seaming being shit you could argue, is the actual real car. However, I guess you could then argue, the story line might be that the car is supposed to be shit but in reality isn't.

              Hmm. Still find it odd but then America is so litigious, one of the reasons I wouldn't want to live there. Got a paper cut from paper over there, sue the paper company. Poke yourself with a needle while sowing, sue the needle company & so on.

              1. steviebuk Silver badge

                Re: Official sponsorship

                I need to stop typing on my phone and also stop rush typing. Why oh why can't we have an edit button!

          2. Anonymous Coward
            Anonymous Coward

            Re: Official sponsorship

            "That should of said" = "That should've said". No such thing as "should of".

            </pedant>

            1. steviebuk Silver badge

              Re: Official sponsorship

              Oh yeah :p

            2. carl0s

              Re: Official sponsorship

              That should of course be true. It irritates the hell out of me ;-)

              1. steviebuk Silver badge

                Re: Official sponsorship

                Like

                "I can't be asked". Someone kept saying that to me until I pointed out it's "I can't be arsed".

          3. elgarak1

            Re: Official sponsorship

            It's not just the US, it's on our German TV, too (and it's specific of the production company and network and which deals they agreed to, and how much they paid). In a very popular crime series over here, one of the star characters gets supplied a different high-end vehicle for each episode, very recognizable, and with a close-up of the logo. Meanwhile, all the cop cars have black circles on the grille where the VW logo should be, although they are very obviously, and realistically, VWs. It's actually worse than that as the 'hero' cars (which the speaking characters drive) have logos, while background cars have not. And to even mess you up more, obviously these only refers to the cars of the production. They film on location, and there are often 'civilian' cars in the background. Guess what, they do NOT go ahead and cgi every car logo out. It's only the cars used and paid for by the TV production crew that gets special treatment.

            All this is on one of the publicly financed TV stations, which have very strict rules about (hidden) advertising. If the car has a logo, it's advertising and paid for by the car company, and the production company is only allowed THAT many (maybe one or two). If the car hasn't, it's not.

        2. jelabarre59 Silver badge

          Re: Official sponsorship

          Yes. I had to look up why logos are blurred on US TV. Don't think that applies in the UK though, apart from the BBC not allowing advertising. Other show channels can stick stuff in, even if not sponsored. But in US if Apple has agreed, you have to cover said logos or they can sue. Stupid idea.

          In the old days (up through the 70's, maybe even into the 80's) no one cared, if you needed a car, radio, whatever in a show, you just acquired one, and used it as though it were just anything you would see in everyday usage. The "product placement" came about, and totally fubarred it.

          I had once thought about creating a set of automotive emblems in the shape of many carmakers (a lot of car makes have oval emblems) and creating a whole set of car models for a bogus carmaker. Release the whole set as Creative Commons just to be an SOB to anyone who would try to monetize it. Then move on to all the other product categories and do the same thing.

          1. Charles 9 Silver badge

            Re: Official sponsorship

            Fake cars in non-live media isn't an issue. They can imagine almost any car they want and get away with it. The trick is when they need an actual, working car for use in a live-action show. Then it becomes cheaper to buy an actual car than to make one from scratch.

            As for product placement, it all comes down to the terms of the sponsorship. Product placement was still there before it really took off in the late 80's. It was just more subtle ("Vehicles provided by Dodge" in the credits, for example), and manufacturers accepted this as a plug. Then things went overboard when outside or competing firms started ragging trademarks ("Energizer Bunny" lawsuits). Since under USPTO rules trademarks need to be used and defended to remain valid, companies started to get a bit touchier on the use of their products.

          2. MJI Silver badge

            Re: Official sponsorship

            I tried to watch the Playstation Academy programme on ITV.

            The following was blurred out so stopped watching at the first break. Cars were just a blur.

            It appears that they were driving Nissan sports cars 370Z I THINK (blurred out)

            The game (Gran Turismo), studio (Polyphony Digital), console (Playstation), maker (Sony) alll blurred out.

            So blur, head, blur, legs. Standing next to a blurmobile.

            Worst ever case of blurring I have seen.

    2. Anonymous Coward
      Anonymous Coward

      Gamers with money to burn, most gamers I know build their own.

      1. Captain Scarlet Silver badge

        Yeah have to agree although most gamers simply upgrade bits as they go along, thats what I do and why I never went to a laptop.

        Back in the day I had a friend with an early Alienware rig and it was definitly an eye turner compared to my case which I now admit had far to many cold cathodes and plastic windows.

        1. Shadow Systems Silver badge

          At Captain Scarlet, re: case addons.

          I agree with the sentiment that gamers tend to build their own machines, if for no other reason than they want to trick the things out with all the crap they can.

          As much RGB lighting as they can cram in the damned thing, liquid coolers with UV reactive coollant in see-through tubing, blinky lights on the *RAM*, SSD's with lights that strobe in time with I/O, HDD cooling fans that whir & blink in user configureable patterns, side panels with "frosted" logos in the plastic, etched & airbrushed case exteriors (and interiors) that include their favorite game character(s), and all the ornamentations they can afford.

          Sure you can now get a prebuilt "gamer rig" that includes all that shite, but what self-respecting "Real Gamer" would stoop so low as to buy an off the shelf computer?

          "Jeez dude. You may have paid $5K for that fucker, but it's still *off the shelf*. The only way you could GET any lamer is if- ... Oh fuck, you DID. You added a Pokemon sticker!"

          *Cough*

          =-)P

          1. J. Cook Silver badge

            Re: At Captain Scarlet, re: case addons.

            And (sadly), finding a case without all that crap but is still put together decently (read: not made from tinfoil with dull blades in the stamping machine, requiring a box of band-aids and a tetnus shot to move around in) is a pain in the anus, too.

            non-rack mount server chassis fit the bill, but the markup for those is also painful.

            1. Baldrickk Silver badge

              Re: At Captain Scarlet, re: case addons.

              There are plenty. I, for example went with a plain, windowless flat sided Fractal Design case. Well built and not at all flashy. Less so than my last work desktop that was some angular Dell design.

          2. DiViDeD Silver badge

            Re: At Captain Scarlet, re: case addons.

            "As much RGB lighting as they can cram in the damned thing, liquid coolers with UV reactive coollant in see-through tubing, blinky lights on the *RAM*, SSD's with lights that strobe in time with I/O, HDD cooling fans that whir & blink in user configureable patterns, side panels with "frosted" logos in the plastic, etched & airbrushed case exteriors (and interiors) that include their favorite game character(s), and all the ornamentations they can afford."

            You say that like it's a bad thing.

            1. ds6 Bronze badge

              Re: At Captain Scarlet, re: case addons.

              It is. The RGB lighting craze does three things:

              1. Makes your rig look gaudy as hell 9 times out of 10 because it seems no one understands subtlety

              2. Increases power consumption

              3. Increases heat

              Case lighting I can understand, but lighted goddamn RAM? What practical purpose would that possibly have besides making you look like a massive douchenozzle?

      2. MrXavia

        Not laptops, if you want a laptop that is capable of gaming, then you need to buy a laptop... Sure they are not as good as a self-built desktop., but they are pretty good

        1. DiViDeD Silver badge

          Gaming Laptops

          Check out ROG's series of gaming laptops, with their complicated unfolding airflow channels.

          Hell, some of em even have light up multicolour keyboards and case lights. What more could you want?

    3. tekHedd

      Gamers buy Razer?

      Sure, not all gamers are tech savvy geeks! Some just like to play games.

      Razer is a "gaming" company that preys on these people by selling a mix of average and substandard products that look cool to people who just want to enjoy playing games. At least everything I've bought from them was, well, mediocre at best, and all had some sort of annoying flaw.

      1. ds6 Bronze badge

        Re: Gamers buy Razer?

        The first thing I bought from Razer that hasn't been shite is one of their mousepads, it was cheap and big so why not...

        ...

        Oh, would you look at that—the huge Razer branding in the top right corner gets my mouse stuck on it...

    4. DiViDeD Silver badge

      Re Gamer buy Razer?

      "Alienware and Apple... "

      I really don't think you'll find any hardcore gamers running Apple gear.

    5. Anonymous Coward
      Anonymous Coward

      'because you think it makes you look cool'

      Like those idiots who buy Beats headphones rather than something from an actual audio manufacturer, like Bose.

      1. ds6 Bronze badge

        Re: 'because you think it makes you look cool'

        Bose is the Mercedes of consumer-grade audio equipment. I know lots of people that will only buy Bose, even if the product itself is not so great (eg. early QuietComfort models).

        You can tell if someone really likes audio stuff if they have some entry-level to mid-grade professional kit that looks ugly as sin but sounds great.

        And then... There's the people that wear AirPods...

    6. Fading Silver badge
      Coat

      I like my Alienware....

      Area 51 - (from dell outlet) - much cheaper than building my own when I bought it in Jan 2018 (cost me £2k in total when the GTX1080Ti inside was selling at £1K alone due to the GPU mining craze) .

      1. ds6 Bronze badge

        Re: I like my Alienware....

        So what you're saying is you paid £1,000 for an ugly lighted fidget spinner-shaped 16gb i7 with weird awkward proprietary internals and what appears to be little to no expandability? And then paid the extra £1k for the graphics card anyway?

        If you would have waited I guarantee you could have found a cheaper local seller for the card (or maybe a Quadro). Source a cheap Chinese case, regular ol' motherboard, Ryzen 5 or whatever else is cheap and good, get some RGB RAM that's on sale (because it always seems to be), and you could have saved a lot.

        I did that exact thing, and only spent half a grand. The case and motherboard were from a Dell ProLiant server with weak CPU and bad RAM; replaced CPU with an i7 from Ebay, replaced RAM with Corsair DDR4 RGB (on sale), dug a nice OEM panel out of some mom's garage sale for a few bucks, threw in an old mouse and keyboard and sold it for over double.

        When it comes to gaming PCs, prebuilt ones are a total joke. Either they're plagued with manufacturing defects and other problems like the iBuyPower and CyberPower ones, or they're stupidly overpriced. Settling for used/refurbished parts that work just as good as new most of the time combined with cheaper new parts opens up other decisions for the budget.

  3. LewisRage

    Same as their phones

    Sounds like there is as much after market care for their laptops as there is for their phones.

    The original Razer phone is still at a patch level of July '18... and there's no sign of an update that I can see.

    1. Matchstick

      Re: Same as their phones

      I contacted support about lack of upgrades to the Razer Phone and asked if they could say whether there would be any more upgrades.

      And the reply was

      "We really apologize but our back office said that at the moment they do not have any information that they can disclose in regards to that."

      Guessing that's a "No but we don't want to actually admit that to customers" then

  4. naive

    It is all hit and run in the gaming world

    MSI is the same. They seduce 13-17 yo with steamy gaming websites, but under the hood things are an absolute mess, light years away from the promised quality and the bloated price levels for the gear.

    My $ 3200,- MSI GT72 from 2015 has hinges secured with 3mm brass inserts in plastic which of course broke off in the 20 or some times I closed and opened it over the years. After sales support is located 1500 km away.

    Since the laptop was designed in de Windows 8 era, support for windows 10 is still half hearted.

    Firmware support is an absolute nightmare, nothing to assist installation of drivers on a new Windows10 install, one has to collect the pieces from their website.

    BIOS updates come with threatening warnings to choose the right CPU iteration, but no monkey proof tools to assist the loser who had spent so much on their precious gear.

    Security updates are a joke, the last updates from MSI on this device are from 2016.

    1. Hans 1 Silver badge

      Re: It is all hit and run in the gaming world

      You should add:

      They overclock the GPU in the BIOS, like it happened for the Alienware fan in this place (bought with his own monies without consulting me, a grown-up who moves a lot between US, UK, France)

      Then GPU fries in the laptop ...

  5. chivo243 Silver badge
    Headmaster

    I need to get out more?

    I just had a user show up with a Razer laptop last week, some keys automagically quit working over night?? I had never heard of them before that. And hearing about it today again? Let's say I'm seeing them in the 'shade'?

    I either need to get out more, or get a bigger rock to live under...

    1. Amentheist
      Flame

      Re: I need to get out more?

      Yep, I made the mistake of buying a keyboard of theirs and 4-5 years later some of the switches stopped working (this is a £100+ keyboard!!).. how?! How bad do you make it to have keys stop working.. It's the board as well it's not down to the switches.

      Anything "gaming" is just cheap plastic with extra marketing on top

      1. ibmalone Silver badge

        Re: I need to get out more?

        The only original part left of the cheap eMachines desktop that I bought to take to university is the keyboard! (The original chassis for that machine was truly awful...)

      2. Dave K Silver badge

        Re: I need to get out more?

        I have a Razer mouse. Wasn't too cheap, yet the scroll-wheel clips into an actuator via a tiny plastic peg. So, guess what happens after a couple of years? The peg breaks and the scroll wheel stops working.

        Thankfully, replacement scroll wheels can be bought from eBay for a few quid, so I was able to resurrect it. Keyboard wise, I went for a Ducky keyboard rather than Razer. No issues at all with mechanical keys after many years of use, but I have had several of the backlight LEDs fail, meaning I've had to attack it with a soldering iron and some replacements...

  6. Simone

    Article conclusion???

    To quote from the article:

    "If you have a software nasty on your computer with admin rights, it's already a game-over situation"

    Depending on the malware, you need to (do whatever) to remove the 'software nasty', so not quite game over. But:

    "with the ability to write to and bury itself in your motherboard firmware via this left-open mode, the malware could ensure it survives a drive wipe or change, and evades detection from antivirus tools"

    So why this conclusion in the final paragraph?

    "exploiting this bug would require the aggressor to have local admin-level access to the machine, and if a miscreant is running privileged code on your PC, there are about a thousand other things you'll want to worry about before considering the integrity of your mobo firmware"

    With the 'bug' fixed, your PC has a big problem; without it your PC (mobo anyway) is a piece of scrap. This is a serious, and simple to fix (?), problem. No excuses required

    1. doublelayer Silver badge

      Re: Article conclusion???

      Nobody disagrees with that. That's not the concern. What the article is saying is that, should there be malware on your system capable of using this vulnerability, you have a lot to worry about. Similarly, if you don't have malware there now and didn't recently have malware, you shouldn't start panicking because it is unlikely that your BIOS is infected. Similar to how meltdown and its ilk are very important vulnerabilities, but not a reason to start chucking all your intel gear despite it still working.

      1. ds6 Bronze badge

        Re: Article conclusion???

        ...That's not a reason??? I mean, I've always wanted an excuse to switch to RISC.

  7. This post has been deleted by its author

  8. Boohoo4u

    Gamers?

    A gamer laptop is something that should not exist...

    Gamers used to build their own rigs and overdrive them for max performance.

    Buying a “gamer” laptop makes you a casual but stupid gamer...

    1. Charles 9 Silver badge

      Re: Gamers?

      Unless you move around a lot. If you're a gamer on the go, it's a gaming laptop or bust, as a custom rig is usually too big and/or heavy for air travel.

    2. MrXavia
      Alien

      Re: Gamers?

      That comment makes you look stupid, clearly anyone who moves about needs a laptop, you can't lug a desktop anywhere.. Sure my Alienware laptop is bulky, its got issues, all gaming laptops do..

      I can travel for work and play VR games in the hotel in the evenings, people with lives who like to game often have to take the opportunity whenever we get it.

    3. MJI Silver badge

      Re: Gamers?

      I like gaming but not a fan of PC gaming (too much like work).

      At home PS4 while plopped on the settee (me not PS4).

      If out and need to, got a Vita for that.

      30 years of using PCs all day every day puts PC gaming out of mind.

      1. MJI Silver badge

        Re: Gamers?

        A son is at uni and likes PC games, especially MOBAs.

        So he bought a lap top for his course. But it is a gaming lap top, but not Razer.

      2. MJI Silver badge

        Re: Gamers?

        Was trying to say that people who like games want a way to play when not at home.

        Some (son) laptop, me and other son Vita. Some people play games on their telephone.

    4. Trixr Bronze badge

      Re: Gamers?

      You've got a really narrow definition of "gamer" is if all you can think of is fast-twitch games that require stupid-spec machines (with the winken-blinken lights and the other garbage those guys who'd rather massage hardware than play games like to install).

      I've got an Origin laptop - it's only 1080p, but it's actually sufficient for my eyesight - which is an excellent gaming machine. It's fine with Farcry at High quality and Witcher 3 with everything maxed. It also weighs less than 2 kg and has multiple ports (including USB-C), so it's good for business stuff and has been around the world multiple times. The only thing that's a slight pain is it needing an external Bluray or DVD drive. But I hardly use that these days anyway.

      1. Anonymous Coward
        Anonymous Coward

        Re: Gamers?

        As far as hardcore gamers go, you don't exist. You're either a cutting-edge gamer ready to go at it with the pros or you're a console loser. Nothing in between.

  9. Glen 1 Bronze badge

    Re: Razer hate

    I have last year's Razer Blade. I have been quite happy with it.

    That is all.

  10. cb7

    So how does one check if one's ME is in manufacturing mode? And turn it off if it is?

    1. Waseem Alkurdi Silver badge

      https://github.com/corna/me_cleaner

      There's a tool over there.

  11. Compuserve User

    Need floppy disk drive to update main board firmware.

    Why is this Razer's problem? It is your responsibility to make sure your laptop/computer is safe especially if it is a specialized piece of kit.

    If I build you a PC (back in the day we had cover disks on magazines) and you fill it full of crap, it is not my problem (people learned the hard way) If the motherboard dies it is, but if you expose your rig to places it shouldn't be connected to, that is your problem. Thus, Razer is not to blame. I am sure it is in the Razer EULA somewhere.

    1. ThadiasVonBasterd

      Re: Need floppy disk drive to update main board firmware.

      So if you purchased a new car that had a defect in the door locking mechnism you wouldn't expect the manufacturer to fix it? This isn't some custom built machine put together by an enthusiast, This is an end user product that hasnt been built properly by the manufacturer.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019