HP is logging your keystrokes on many laptops

Forums › Desktop computing › HP is logging your keystrokes on many laptops

Dairyxox

1518 posts

Uber Geek

#214448 12-May-2017 09:24

Stumbled across this news on the internet this morning:

thenextweb.com - HP is shipping audio drivers with a built-in keylogger

Was pretty shocked, but checked the affected models list. We'd just brought some HP Probook G4 450's this week at work, fortunately they were not on the list.

However checking the system, I found the driver was installed & working, and also found the log file as described.

Really poor form HP. The security implications are tremendous, and this will probably become a target for malware before long if not already. This accidental exploit has been active in some systems since 2015.

Thoughts?

There was a lot of fuss about Lenovo having dodgy software installed from factory, although this HP issue seems to have been done by mistake, rather than done with intent.

tehgerbil

735 posts

Ultimate Geek

Subscriber

#1780005 12-May-2017 10:02

Thanks Dairyxox, I've escalated with my client as they have some of these devices.

Much appreciated.

Behodar

7068 posts

Uber Geek

Trusted

Lifetime subscriber

#1780018 12-May-2017 10:18

Yep, thanks. I'm definitely going to have to look at my work PC when I'm next in the office - it's on the list of affected models but has a custom image so may be OK.

nedkelly

571 posts

Ultimate Geek

Trusted

#1780020 12-May-2017 10:18

Appears to be the 1.0.0.43 driver that does it. Where I work we have large numbers of HPs and I was able to check on a few that the 1.0.0.24 and 1.0.0.31 driver dont record anything in that file.

Apple Certified Support Professional (ACSP) 10.10, MCITP 2008

1101

2215 posts

Uber Geek

#1780022 12-May-2017 10:19

to be fair , if malware had access to those logged keystrokes, that would be the least of your worries

ie , its just a log file on the PC. If malware can read files on the PC you're pretty much stuffed at that stage anyway

Just more bloatware coming back to bite laptop manufacturers in the bum.
Will they ever learn, no.

BTR

1522 posts

Uber Geek

#1780055 12-May-2017 11:05

Thanks for that much appreciated. I will be checking my machines.

tripp

3529 posts

Uber Geek

Trusted

Lifetime subscriber

#1780120 12-May-2017 12:11

*smashes laptop*

nzkiwiman

2377 posts

Uber Geek

Subscriber

#1780124 12-May-2017 12:19

And this is why I delete the factory image and use my own; although I guess if I was still using the official driver I would be unknowingly impacted

Dratsab

3581 posts

Uber Geek

Trusted

Lifetime subscriber

#1780143 12-May-2017 13:01

Thanks for the heads-up Dairyxox. Not affected, fortunately, but will spread the message...

ANglEAUT

1216 posts

Uber Geek

Trusted

#1780178 12-May-2017 13:50

1101: ...ie , its just a log file on the PC. If malware can read files on the PC you're pretty much stuffed at that stage anyway ...

It's worse than that. If the malware finds this file, it instantly has a history of what you type, not only from that point going forward. Now, the malware authors also have "semi legit" process name and file location they can use. If this file is found, HP gets blamed and not the malware. If the operator simply updates the HP driver, he might have a false sense of security.

Please keep this GZ community vibrant by contributing in a constructive & respectful manner.

kiwifidget

1952 posts

Uber Geek

Lifetime subscriber

#1780186 12-May-2017 13:57

nedkelly:

Appears to be the 1.0.0.43 driver that does it. Where I work we have large numbers of HPs and I was able to check on a few that the 1.0.0.24 and 1.0.0.31 driver dont record anything in that file.

My HP 430G3 has got 1.0.0.31. Am I OK?

Life is too short to remove USB safely.

plas

377 posts

Ultimate Geek

#1780192 12-May-2017 14:03

kiwifidget:

nedkelly:

Appears to be the 1.0.0.43 driver that does it. Where I work we have large numbers of HPs and I was able to check on a few that the 1.0.0.24 and 1.0.0.31 driver dont record anything in that file.

My HP 430G3 has got 1.0.0.31. Am I OK?

Nope 1.0.0.31 just doesn't log to a file. https://www.modzero.ch/advisories/MZ-17-01-Conexant-Keylogger.txt

The solution is to delete the scheduled task running Mictray64.exe or Mictray.exe on login. Then for good measure delete Mictray64.exe or Mictray.exe

Edit: Sorry even disabling the task doesn't fix the problem, you need to delete the file.

Delete MicTray executables and logfiles. Deleting the Scheduled
Task is not sufficient, as Conexant's Windows Service CxMonSvc will
launch MicTray otherwise. The executable is located at
c:\Windows\System32\MicTray64.exe, the MicTray logfile is located at
C:\Users\Public\MicTray.log

Dairyxox

1518 posts

Uber Geek

#1783626 17-May-2017 12:17

support.hp.com - an Official list of affected systems