HP Laptops Found To Have Hidden Keylogger (bbc.com)

Hidden software that can record every letter typed on a computer keyboard has been discovered pre-installed on hundreds of HP laptop models, BBC reported on Monday citing the findings of a security researcher. From the report: Security researcher Michael Myng found the keylogging code in software drivers preinstalled on HP laptops to make the keyboard work. HP said more than 460 models of laptop were affected by the "potential security vulnerability." It has issued a software patch for its customers to remove the keylogger. The issue affects laptops in the EliteBook, ProBook, Pavilion and Envy ranges, among others. HP has issued a full list of affected devices, dating back to 2012. Mr Myng discovered the keylogger while inspecting Synaptics Touchpad software, to figure out how to control the keyboard backlight on an HP laptop. He said the keylogger was disabled by default, but an attacker with access to the computer could have enabled it to record what a user was typing. According to HP, it was originally built into the Synaptics software to help debug errors. It acknowledged that could lead to "loss of confidentiality" but it said neither Synaptics nor HP had access to customer data as a result of the flaw.

Comments

See, they did not leak any data.

[140Mandak262Jamuna]

but it said neither Synaptics nor HP had access to customer data as a result of the flaw.

It is like Yale announcing that its locks, made since 1929, could be opened by any pentalobulous screw driver, but neither Yale, nor the screwdriver maker, got any share of the loot taken by any burglar taking advantage of the flaw.

Re:See, they did not leak any data.

[rmdingler]

In case anyone else is curious: It's Pentalobular though, not to place too fine a penta-pedant on it.

Airtight hatchway, etc

[Anonymous Coward]

How do you end up with an attacker that can write to your registry (and also read your log files) but can't just install their own keylogger?

Re:Airtight hatchway, etc

[TWX]

An attacker's own keylogger might well be recognized as malicious and blocked from communicating with the network stack or otherwise blocked by not appearing in a whitelist in a corporate environment. The trusted device driver for the keyboard would probably be whitelisted and since vendor software is usually allowed to talk to the Internet so that it can check for updates, allowed to communicate. With these in-mind, the attacker's own payload to activate the keylogger might make so few changes as to not be recognized for what it is by such security software. Also, if someone were to hack HP or Synaptics' systems they could potentially enable it subtly where it might not be obvious that it has been enabled.

Additionally those traveling internationally with these laptops where the computer may be 'inspected' by a foreign government could find such a logger enabled and again, the security software on the computer might not recognize that it has happened while it might recognize third-party software. If that government would have a second opportunity to inspect the computer then they could retrieve the contents of the log.

What I miss.

[orlanz]

This is one of the reasons I really liked the preprocessor in C. I miss #IF DEBUG / #ENDIF.

Re:What I miss.

[KiloByte]

I call bullshit on this "mistake" not being intentional. Their coding practices might be bad for other reasons, but if companies add backdoors left and right, at this point it's reasonable to assume malice rather than stupidity.

The NSA loses another preferred partner tool

[sasparillascott]

Just like the things we saw with the networking folks, another vendor says oops look at this surveillance tool we just happened to have left in our production stack we've been putting on all our machines for years. Time for someone to look at Dell and see if they've made the same "mistake".

Re: The NSA loses another preferred partner tool

[Zero__Kelvin]

Every vendor that ships Windows 10 ships their product with a surveillance tool. At least this one can be and is disabled.

Re:repost?

[KiloByte]

isnt this a repost from May

Nope, this is a second keylogger. The one from May was in audio driver, this one is in the keyboard driver. Mentioned in the article -- have you read it before responding?

Same "accident" twice?

[Holi]

Sorry but how the hell do you allow this to happen twice?

http://www.zdnet.com/article/k...

Maybe it's time for law enforcement to get involved.