Slashdot Mirror
HP Issues Fix For Keylogger Found On Several Laptop Models (zdnet.com)
HP says it has a fix for a flaw that caused a number of its PC models to keep a log of each keystroke a customer was entering. The issue, caused by problematic code in an audio driver, affected PC models from 2015 and 2016. From a report: HP has since rolled out patches to remove the keylogger, which will also delete the log file containing the keystrokes. A spokesperson for HP said in a brief statement: "HP is committed to the security and privacy of its customers and we are aware of the keylogger issue on select HP PCs. HP has no access to customer data as a result of this issue." HP vice-president Mike Nash said on a call after-hours on Thursday that a fix is available on Windows Update and HP.com for newer 2016 and later affected models, with 2015 models receiving patches Friday. He added that the keylogger-type feature was mistakenly added to the driver's production code and was never meant to be rolled out to end-user devices. Nash didn't how many models or customers were affected, but did confirm that some consumer laptops were affected. He also confirmed that a handful of consumer models that come with Conexant drivers are affected.
A fix is all well and good, but an explanation would be a nice touch. I guess people just don't get pissed off about getting the shaft anymore.
There is no XUL, only WebExtensions...
I only buy Windows 7 machines for myself and my company, but the first thing I do when I buy them (new or refurbished) is format the drive, install Windows 7, and use the Windows drivers whenever available.
I don't respond to AC's.
Does this mean the sub 1MB h/w driver can be installed without a 100+MB package or will I need to still extract and roll my own?
A fully functioning keylogger is a flaw?
I will be Mr BATFECES CIA-FBI SWAT. You are just a average PC owner.
Hi Mr President, itsa me Mr SWAT, we understand there is a probability that we will catch terrorists that use these cheapskate retail laptops so we need a presidential private secretarial order made to HP to subsidize their computers to be affordable by terrorists as well as pay HP manufacturer WidgetXChin in Chi-Com villange PingPongDingDang to roll these terrorist craptop bates with keyloggers.
And the president responds over the phone, sounds great and I will put that into tomorrow's hidden budget meeting. A baby cries uncontrollably followed by a muffled cry and alot of thumping, as Mr SWAT asks, how will you pay for it? And Mr President responds, aaaahhhhh-aaaaaahhhhh as the cries stop ro the sound of a blender, that we will pay for it with the arriving asset forfeitures for convinctions to auction of criminal property.
SIGHUP
Then the system works as designed. Someone that came here illegally broke the law. The current process for legal immigration is fucked up at best and needs a major overhaul, but that doesn't make it ok to just come across the border, steal someone's identity or work under the table tax free often below minimum wage. There are no jobs here that Americans won't do, there are scumbag employers all too happy to pay someone less than a decent wage knowing they have no other choice.
Is it just me, or is this patch that difficult to find? I know google is my friend, but this is just sad.
Nobody who reported this said it was sending the keystroke data to server or anything. Just that it had been included in a driver and was apparently used in testing but never removed. Seems pretty benign and now HP has issued a update to correct it.
Sorry, but one of our programmers leaned on his keyboard while eating lunch and wouldn't you know, it caused the driver he was working on to start logging keystrokes and storing them into a file.
You mean a fix as in it is no longer detected?
it squarely fit the profile of malware and spyware, allowing HP and American intelligence services to suck up sensitive information. It's as bad as it gets. If you buy American, this is what you should expect.
So the GNU/Linux model is write once use everywhere. A lot of code gets shared. The chance this would have happened on GNU/Linux is effectively zero. There isn't a different driver (well, slightly changed) for every computer that uses the same chipset. There is one driver for many different computers using the same chipset and if there is a different device ID it just gets added to the driver. Don't get me wrong. GNU/Linux has a ton of crap code too- but this just takes the cake. I did Microsoft Windows support for a long time (10+ years) and ran into a lot of different issues. I've been doing GNU/Linux support for over 10 years now and I have to say each system has its problems, but hardware support on GNU/Linux is a thousand times better to the extant you don't buy crappy hardware dependant on proprietary software/drivers/firmwares. Nearly all the support I do today the issues people encounter are due to customers using free software hardware with OTHER companies hardware for which isn't properly supportable by the community. For example if a USB controller is flaky the a wifi adapter may not work with it even if a keyboard will. Why? Larger USB packet sizes can overwhelm crappy USB controllers on some systems.
If there was no way to retrieve the logs from the machines affected then who's to say that this was a deliberate move on HP's part? Not trying to do damage control for HP here, I'm honestly just thinking about how somebody could access my logs.
... MP3 rip you!
Check your premises.
Blame the developer, of course.
The name of the game is Plausible Deniability.
That's great news! now, who's going to jail over this? Nobody? That's fucked up!
I really love all the people calling Trump insane... Pot meet kettle.. Trump is the most sane President we've had in my lifetime (67 years old)... There sure are a LOT of completely unhinged people out there.. I pray to God daily for President Trump's safety...
THANK YOU, Edward Snowden!! Americans owe you a debt of gratitude (whether they know it or not..)
So there's a keylogger. How do you take a look at the log?