Slashdot Mirror
HP Laptops Found To Have Hidden Keylogger (bbc.com)
Hidden software that can record every letter typed on a computer keyboard has been discovered pre-installed on hundreds of HP laptop models, BBC reported on Monday citing the findings of a security researcher. From the report: Security researcher Michael Myng found the keylogging code in software drivers preinstalled on HP laptops to make the keyboard work. HP said more than 460 models of laptop were affected by the "potential security vulnerability." It has issued a software patch for its customers to remove the keylogger. The issue affects laptops in the EliteBook, ProBook, Pavilion and Envy ranges, among others. HP has issued a full list of affected devices, dating back to 2012. Mr Myng discovered the keylogger while inspecting Synaptics Touchpad software, to figure out how to control the keyboard backlight on an HP laptop. He said the keylogger was disabled by default, but an attacker with access to the computer could have enabled it to record what a user was typing. According to HP, it was originally built into the Synaptics software to help debug errors. It acknowledged that could lead to "loss of confidentiality" but it said neither Synaptics nor HP had access to customer data as a result of the flaw.
but it said neither Synaptics nor HP had access to customer data as a result of the flaw.
It is like Yale announcing that its locks, made since 1929, could be opened by any pentalobulous screw driver, but neither Yale, nor the screwdriver maker, got any share of the loot taken by any burglar taking advantage of the flaw.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
How do you end up with an attacker that can write to your registry (and also read your log files) but can't just install their own keylogger?
This is one of the reasons I really liked the preprocessor in C. I miss #IF DEBUG / #ENDIF.
Wouldn't someone able to access the device and enable the keylogger be instead able to, you know, install a keylogger ?
Hype.
Each and every recent Intel Core-i with ME can have a very hidden key logger running in the ME the whole day, and even sending them out on the NIC. Say NO to hidden "security" backdoor processors, and "military grade" *lol* trust zones, ....
Comment removed based on user account deletion
Just like the things we saw with the networking folks, another vendor says oops look at this surveillance tool we just happened to have left in our production stack we've been putting on all our machines for years. Time for someone to look at Dell and see if they've made the same "mistake".
C'mon, this is just a more streamlined way to enable pwd help. This way you can have a 30 character pwd, and if you forget call HP support to retrieve it...what could be the harm in that :|
isnt this a repost from May
Nope, this is a second keylogger. The one from May was in audio driver, this one is in the keyboard driver. Mentioned in the article -- have you read it before responding?
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Perhaps it's in one of HP's libraries?
#include "stdkeylogger.h"
So I own two of the laptops listed. They both originally came with Win7. I've rebuilt them clean with Win10 which installed a Synaptics driver on its own which is a waay newer version than what HP originally shipped or any updates they previously provided for Win7. Does anyone know if there's a test to see if the version you have is affected? Now HPs offering a softpaq with a new driver. If I install that one is Windows Update going to clobber it when the next one comes out? Will the Windows Update versions include the 'fix'?
For true eye-popping shock, have someone disassemble the FIRMWARE for older Apple Macbook Pro's that allegedly circular buffer store to flash all typing of text hoping to capture passwords BEFORE a machine even finishes booting, including sleep wake. Naughty naughty. Different keyboard firmware updates get presented to certain people so it is not always uniform. I don't know if TSA does anything amusing at airports with this. A small briefcase of NSA money to a rogue engineer employee can do wonders in historical anecdotes in cyber warfare legends. Funny how you can get root from a few mouse clicks in last months version of latest Mac OS X (reported here on slashdot, dissassembly on a blog) .... including REMOTELY on Apple desktop remote... so long as you had at least some guest account showing the screen remotely to you.
Sorry but how the hell do you allow this to happen twice?
http://www.zdnet.com/article/k...
Maybe it's time for law enforcement to get involved.
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
So an attacker with access to the computer could turn on HP's built-in keylogger.
Couldn't that same attacker with access to the computer install and turn on his own keylogger, which is probably to his preference because it works with the rest of his toolkit seamlessly on any model of computer instead of just on HPs?
So, what's the impact exactly?
This reminds me of promiscuous mode on ethernet interfaces. Debugging tool with security implications that is turned off by default. Useful. Not a big deal. Useful in fact for spotting hackers, because they might turn it on and not hide it. You notice your interface is in promiscuous mode? You know something is up.
I just can't get worked up about this. It's like they just left some debugging tools around, and yes, nearly any debugging tool can be turned to evil uses, but so can the OS itself if it's been compromised by "a local attacker".
Mentioned in the article -- have you read it before responding?
You must be new here.
BOOM!
"Never attribute to malice what can be explained by stupidity -- except money is involved".
Nope. It's a false flag, orchestrated by trump, to divert attention from his treason.
When the original keylogger problem was discovered a few months ago, HP said it was because someone left the debug "feature" for keylogging turned on by accident. So why is everyone surprised it exists, at least in the old versions?
Comment removed based on user account deletion
According to HP, it was originally built into the Synaptics software to help debug errors.
WHAT THE FUCK are you talking about you fucking liars?!? DEBUG ERRORS? You know, when you press "F," and "U" appears on screen? That kind of thing happen a LOT?
That's like someone who makes WALLETS that are built with a secret wormhole in it that could be opened to a space above a box somewhere in their factory's basement, you know, to DEBUG the wallet. To make sure the wallet doesn't spontaneously have a different amount of money from what it SHOULD HAVE, for some reason, somehow?
You know, something that can't happen, physically?
Now, Sir, if you're wondering what government Agency could have Come up with such an Insane idea As this, or Fiddled with Basic Internal parts of a computer, or insist they install a Keystroke Goddamned logger, Boy, you should be. (Hint, hint.)
Yeah, fuck HP.
Our reign has gone on long enough. Indeed. Summon the meteors.
This is very alarming, whether HP or Synaptics did or did not leak any customer information. They should not be saving keystrokes without user permission. - http://www.backgroundpi.com/ team
THERE ARE THREE LETTERS!
I long ago have lost the password for my /. account. +1 Sir.
It means someone with access to the computer can start keylogging without:
- having to download or install anything from the internet or local media, in cases of airgapped or usbport-glued-up machines
- without any virus scanner or regular auditing software detecting any new exes or files installed on the machine
- bypassing any kind of 'trusted exe only' hardened security rules
I'm sorry your lack of imagination means you don't see what the impact of this is, or ways in which it differs to an attacker installing his own keylogger.
well, with all this BS about HP products. why should I council my clients/employers to buy such things??
HP = highly penetrated
not
HIGH POERFORMANCE
whAts worse HP had full controll of the situation, but chose to dicks for profit..
THANKS MeG wHITmann (ha he sed meg[fart sound])
In case you missed it, the election was over a year ago. Slashdot even had stories about it.
https://politics.slashdot.org/...
https://politics.slashdot.org/...
"Trump would _______ [whatever]" isn't helpful at this point; it only serves to get your blood pressure up.
If you just can't get enough of presidential politics, you could start looking at who might be good in 2020, because that's the next election. Or seek counseling because the whole thing is bull, and not good to focus on 24/7/365. Taking a break for a couple years might be good.
This is only the billionth time that debug code has made it into a production release. It will continue to happen unless there are consequences.
I think I'd like to see a modest fine from the government whenever debug code makes it into a production environment in a way that poses a risk to security or confidentiality.
Not enough to really hurt a business. Just enough to encourage following SOPs so their projects are built correctly before getting shipped out to customers.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
because it is backdoored by design.
HP pre-installs a keylogger so I don't have to click on pr0n popups to get one installed. Just another customer service from HP. Yay.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Both HP and Synaptics should get out of the software business. Even if you ignore this flaw; the touchpad drivers installed on HP computers are so awful, unresponsive, glitchy, buggy, and unusable, it's no wonder Microsoft is slamming the hammer down with Precision Touchpad drivers.
What a bunch of FUD...
> an attacker with access to the computer could have enabled it to record what a user was typing
An attacker with access to the computer could just install a keylogger. This is a non-issue.
"but it said neither Synaptics nor HP had access to customer data as a result of the flaw."
I'm no expert, but I think it's an outright lie to describe this as a 'flaw'. The keylogger is software, right? Software deliberately written and installed on these computers. That's not a flaw. My guess is that it's a bit of preplanning by HP for future surveillance requirements mandated by law, or worst yet, by the intelligence community on their own. One software update and millions of computers go into 'watch me' mode.
C++
#include
using namepace std::p0wned ;
Don't you have to wait for the machine to boot to type in a password? How are they sniffing for passwords before the machine even boots?
Even worse, SSD drives cycle through all the available memory space to write and update files rather than burning out the same memory locations. Each location can only be written around 10,000 times, so in theory, nothing is ever deleted, just marked as deleted.
Most HP users are running Windows and any post-WInXP version of that IS a keylogger (and mouse logger, and microphone snooper...)
When every keystroke and every mouse move is potentially going to Microsloth, why worry if HP gets a copy too..... Hell, the modern model of making money in the computer industry (see:Facebook,Google,LinkedIn, et al), which seems to be where MS is going, is to snoop like crazy and sell every bit of consumer info so obtained, therefore HP probably could buy the info from MS (if not already, then soon) and is just saving money by grabbing their own copy first for free...
They don't usually prematurely detonate the bomb blowing themselves up but nobody else in a false flag operation. Not much of a distraction and highlights the fact that we need to be a little more careful about who we accept into our borders. But don't let anything as trivial as reason interfere with your blind Trump hatred.
I don't believe in karma, I just call it like I see it.
Sort of incorrect. Typically the file itself is not deleted, but marked for deletion. The contents are still there until that space is over written by a new file. Which on an SSD is less frequent because of the cycling of "free space". But it does get overwriting eventually. And then recovery through interleaving and other methods.... even after it's been deleted and overwritten it can still be recovered with forensics software. This is not unique to SSD. If you really want something gone you need to explicitly delete it with file destruction software like burn.
if keyloggers are present on your system by default.
By extension, it should be simple to include a built in hardware keylogger into the guts of any keyboard. Simply type in a key sequence to bring up the log file.
I used to have a usb dongle that did this, don't see why it couldn't be wired directly into the keyboard itself. No way to find it without tearing apart the keyboard and knowing what to look for.
To download the update, I had to pause and resume the download every 30 megabytes or the download completed prematurely, leaving a corrupt file.
No, there are four. Are you quite sure?
Perhaps you're aware of the incision on your chest. While you were under the influence of our drugs, you were implanted with a small device. It's a remarkable invention. By entering commands in this NSA PADD, I can produce pain in any part of your body at various levels of severity. Forgive me. I don't enjoy this *snickering* but I must demonstrate. It will make everything clearer.
Surprising, isn't it? Most people feel at first that they can steel themselves against it but they're completely unprepared for the intensity of the pain. That was the lowest possible setting.