Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




1480 posts

Uber Geek


# 214448 12-May-2017 09:24
4 people support this post
Send private message

Stumbled across this news on the internet this morning:

 

thenextweb.com - HP is shipping audio drivers with a built-in keylogger

 

Was pretty shocked, but checked the affected models list. We'd just brought some HP Probook G4 450's this week at work, fortunately they were not on the list.

 

However checking the system, I found the driver was installed & working, and also found the log file as described.

 

Really poor form HP. The security implications are tremendous, and this will probably become a target for malware before long if not already. This accidental exploit has been active in some systems since 2015.

 

 

 

Thoughts?

 

There was a lot of fuss about Lenovo having dodgy software installed from factory, although this HP issue seems to have been done by mistake, rather than done with intent.


Create new topic
553 posts

Ultimate Geek


  # 1780005 12-May-2017 10:02
Send private message

Thanks Dairyxox, I've escalated with my client as they have some of these devices. 

 

Much appreciated.


6697 posts

Uber Geek

Trusted
Lifetime subscriber

  # 1780018 12-May-2017 10:18
Send private message

Yep, thanks. I'm definitely going to have to look at my work PC when I'm next in the office - it's on the list of affected models but has a custom image so may be OK.


 
 
 
 


564 posts

Ultimate Geek

Trusted

  # 1780020 12-May-2017 10:18
Send private message

Appears to be the 1.0.0.43 driver that does it. Where I work we have large numbers of HPs and I was able to check on a few that the 1.0.0.24 and 1.0.0.31 driver dont record anything in that file.





Apple Certified Support Professional (ACSP) 10.10, MCITP 2008

1875 posts

Uber Geek


  # 1780022 12-May-2017 10:19
Send private message

to be fair , if malware had access to those logged keystrokes, that would be the least of your worries

 

ie , its just a log file on the PC. If malware can read files on the PC you're pretty much stuffed at that stage anyway

 

Just more bloatware coming back to bite laptop manufacturers in the bum.
Will they ever learn, no.

 

 


BTR

1514 posts

Uber Geek


  # 1780055 12-May-2017 11:05
Send private message

Thanks for that much appreciated. I will be checking my machines.


3355 posts

Uber Geek

Trusted
Lifetime subscriber

  # 1780120 12-May-2017 12:11
Send private message

*smashes laptop*

 

 

 

 


2250 posts

Uber Geek


  # 1780124 12-May-2017 12:19
2 people support this post
Send private message

And this is why I delete the factory image and use my own; although I guess if I was still using the official driver I would be unknowingly impacted


 
 
 
 


3424 posts

Uber Geek

Trusted
Lifetime subscriber

  # 1780143 12-May-2017 13:01
Send private message

Thanks for the heads-up Dairyxox. Not affected, fortunately, but will spread the message...


992 posts

Ultimate Geek

Trusted

  # 1780178 12-May-2017 13:50
Send private message

1101: ...ie , its just a log file on the PC. If malware can read files on the PC you're pretty much stuffed at that stage anyway ...

 

It's worse than that. If the malware finds this file, it instantly has a history of what you type, not only from that point going forward. Now, the malware authors also have "semi legit" process name and file location they can use. If this file is found, HP gets blamed and not the malware. If the operator simply updates the HP driver, he might have a false sense of security.





Please keep this GZ community vibrant by contributing in a constructive & respectful manner.


1686 posts

Uber Geek

Lifetime subscriber

  # 1780186 12-May-2017 13:57
Send private message

nedkelly:

 

Appears to be the 1.0.0.43 driver that does it. Where I work we have large numbers of HPs and I was able to check on a few that the 1.0.0.24 and 1.0.0.31 driver dont record anything in that file.

 

 

My HP 430G3 has got 1.0.0.31. Am I OK?





Life is too short to remove USB safely.


376 posts

Ultimate Geek


  # 1780192 12-May-2017 14:03
Send private message

kiwifidget:

 

nedkelly:

 

Appears to be the 1.0.0.43 driver that does it. Where I work we have large numbers of HPs and I was able to check on a few that the 1.0.0.24 and 1.0.0.31 driver dont record anything in that file.

 

 

My HP 430G3 has got 1.0.0.31. Am I OK?

 

 

Nope 1.0.0.31 just doesn't log to a file. https://www.modzero.ch/advisories/MZ-17-01-Conexant-Keylogger.txt

 

The solution is to delete the scheduled task running Mictray64.exe or Mictray.exe on login. Then for good measure delete Mictray64.exe or Mictray.exe

 

 

 

Edit: Sorry even disabling the task doesn't fix the problem, you need to delete the file.

 

 

 

Delete MicTray executables and logfiles. Deleting the Scheduled
Task is not sufficient, as Conexant's Windows Service CxMonSvc will
launch MicTray otherwise. The executable is located at
c:\Windows\System32\MicTray64.exe, the MicTray logfile is located at
C:\Users\Public\MicTray.log

 

 


Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Facebook Portal to land in New Zealand
Posted 19-Sep-2019 18:35


Amazon Studios announces New Zealand as location for its upcoming series based on The Lord of the Rings
Posted 18-Sep-2019 17:24


The Warehouse chooses Elasticsearch service
Posted 18-Sep-2019 13:55


Voyager upgrades core network to 100Gbit
Posted 18-Sep-2019 13:52


Streaming service Acorn TV launches in New Zealand with selection with British shows
Posted 18-Sep-2019 08:55


Bitcoin.com announces partnership with smartphone manufacturer HTC
Posted 16-Sep-2019 21:30


Finalists Announced for Microsoft NZ Partner Awards
Posted 16-Sep-2019 19:37


OPPO Showcases New CameraX Capabilities at Google Developer Days China 2019
Posted 15-Sep-2019 12:42


New Zealand PC Market returns to growth
Posted 15-Sep-2019 12:24


Home sensor charity director speaks about the preventable death which drives her to push for healthy homes
Posted 11-Sep-2019 08:46


Te ao Maori Minecraft world set to inspire Kiwi students
Posted 11-Sep-2019 08:43


Research reveals The Power of Games in New Zealand
Posted 11-Sep-2019 08:40


Ring Door View Cam now available in New Zealand
Posted 11-Sep-2019 08:38


Vodafone NZ to create X Squad
Posted 10-Sep-2019 10:25


Huawei nova 5T to be available 20th September
Posted 5-Sep-2019 11:55



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.