Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




1476 posts

Uber Geek


# 214448 12-May-2017 09:24
4 people support this post
Send private message

Stumbled across this news on the internet this morning:

 

thenextweb.com - HP is shipping audio drivers with a built-in keylogger

 

Was pretty shocked, but checked the affected models list. We'd just brought some HP Probook G4 450's this week at work, fortunately they were not on the list.

 

However checking the system, I found the driver was installed & working, and also found the log file as described.

 

Really poor form HP. The security implications are tremendous, and this will probably become a target for malware before long if not already. This accidental exploit has been active in some systems since 2015.

 

 

 

Thoughts?

 

There was a lot of fuss about Lenovo having dodgy software installed from factory, although this HP issue seems to have been done by mistake, rather than done with intent.


Create new topic
537 posts

Ultimate Geek


  # 1780005 12-May-2017 10:02
Send private message

Thanks Dairyxox, I've escalated with my client as they have some of these devices. 

 

Much appreciated.


6674 posts

Uber Geek

Trusted
Lifetime subscriber

  # 1780018 12-May-2017 10:18
Send private message

Yep, thanks. I'm definitely going to have to look at my work PC when I'm next in the office - it's on the list of affected models but has a custom image so may be OK.


 
 
 
 


564 posts

Ultimate Geek

Trusted

  # 1780020 12-May-2017 10:18
Send private message

Appears to be the 1.0.0.43 driver that does it. Where I work we have large numbers of HPs and I was able to check on a few that the 1.0.0.24 and 1.0.0.31 driver dont record anything in that file.





Apple Certified Support Professional (ACSP) 10.10, MCITP 2008

1823 posts

Uber Geek


  # 1780022 12-May-2017 10:19
Send private message

to be fair , if malware had access to those logged keystrokes, that would be the least of your worries

 

ie , its just a log file on the PC. If malware can read files on the PC you're pretty much stuffed at that stage anyway

 

Just more bloatware coming back to bite laptop manufacturers in the bum.
Will they ever learn, no.

 

 


BTR

1514 posts

Uber Geek


  # 1780055 12-May-2017 11:05
Send private message

Thanks for that much appreciated. I will be checking my machines.


3336 posts

Uber Geek

Trusted
Lifetime subscriber

  # 1780120 12-May-2017 12:11
Send private message

*smashes laptop*

 

 

 

 


2228 posts

Uber Geek


  # 1780124 12-May-2017 12:19
2 people support this post
Send private message

And this is why I delete the factory image and use my own; although I guess if I was still using the official driver I would be unknowingly impacted


 
 
 
 


3400 posts

Uber Geek

Trusted
Lifetime subscriber

  # 1780143 12-May-2017 13:01
Send private message

Thanks for the heads-up Dairyxox. Not affected, fortunately, but will spread the message...


971 posts

Ultimate Geek

Trusted

  # 1780178 12-May-2017 13:50
Send private message

1101: ...ie , its just a log file on the PC. If malware can read files on the PC you're pretty much stuffed at that stage anyway ...

 

It's worse than that. If the malware finds this file, it instantly has a history of what you type, not only from that point going forward. Now, the malware authors also have "semi legit" process name and file location they can use. If this file is found, HP gets blamed and not the malware. If the operator simply updates the HP driver, he might have a false sense of security.





Please keep this GZ community vibrant by contributing in a constructive & respectful manner.


1659 posts

Uber Geek

Lifetime subscriber

  # 1780186 12-May-2017 13:57
Send private message

nedkelly:

 

Appears to be the 1.0.0.43 driver that does it. Where I work we have large numbers of HPs and I was able to check on a few that the 1.0.0.24 and 1.0.0.31 driver dont record anything in that file.

 

 

My HP 430G3 has got 1.0.0.31. Am I OK?





Life is too short to remove USB safely.


376 posts

Ultimate Geek


  # 1780192 12-May-2017 14:03
Send private message

kiwifidget:

 

nedkelly:

 

Appears to be the 1.0.0.43 driver that does it. Where I work we have large numbers of HPs and I was able to check on a few that the 1.0.0.24 and 1.0.0.31 driver dont record anything in that file.

 

 

My HP 430G3 has got 1.0.0.31. Am I OK?

 

 

Nope 1.0.0.31 just doesn't log to a file. https://www.modzero.ch/advisories/MZ-17-01-Conexant-Keylogger.txt

 

The solution is to delete the scheduled task running Mictray64.exe or Mictray.exe on login. Then for good measure delete Mictray64.exe or Mictray.exe

 

 

 

Edit: Sorry even disabling the task doesn't fix the problem, you need to delete the file.

 

 

 

Delete MicTray executables and logfiles. Deleting the Scheduled
Task is not sufficient, as Conexant's Windows Service CxMonSvc will
launch MicTray otherwise. The executable is located at
c:\Windows\System32\MicTray64.exe, the MicTray logfile is located at
C:\Users\Public\MicTray.log

 

 


Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Disney+ streaming service confirmed launch in New Zealand
Posted 20-Aug-2019 09:29


Industry plan could create a billion dollar interactive games sector
Posted 19-Aug-2019 20:41


Personal cyber insurance a New Zealand first
Posted 19-Aug-2019 20:26


University of Waikato launches space for esports
Posted 19-Aug-2019 20:20


D-Link ANZ expands mydlink ecosystem with new mydlink Mini Wi-Fi Smart Plug
Posted 19-Aug-2019 20:14


Kiwi workers still falling victim to old cyber tricks
Posted 12-Aug-2019 20:47


Lightning Lab GovTech launches 2019 programme
Posted 12-Aug-2019 20:41


Epson launches portable laser projector
Posted 12-Aug-2019 20:27


Huawei launches new distributed HarmonyOS
Posted 12-Aug-2019 20:20


Lenovo introduces single-socket servers for edge and data-intensive workloads
Posted 9-Aug-2019 21:26


The Document Foundation announces LibreOffice 6.3
Posted 9-Aug-2019 16:57


Symantec sell enterprise security assets for US$ 10.7 billion to Broadcom
Posted 9-Aug-2019 16:43


Artificial tongue can distinguish whisky and identify counterfeits
Posted 8-Aug-2019 20:20


Toyota and Preferred Networks to develop service robots
Posted 8-Aug-2019 20:11


Vodafone introduces new Vodafone TV device
Posted 7-Aug-2019 17:16



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.