Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HP laptops found to have hidden keylogger

bbc.co.uk

Post reply on HN
Print view View original

21–30 of 64 posts

Re: HP laptops found to have hidden keylogger

#21

Post by tga »

djsumdog wrote: post #14

At least with a PC, it's relatively easy to put in a fresh install, either Windows or some other operating system, which everyone in tech should do considering the recent HP/Lenovo issues (although I'm not sure if it would help I this situation if this particular exploit was in the official drivers). It's considerably harder with phones, with all of them running non standard, non upstreamable kernels, and consumers n…

Most PCs come without Windows installation media and instead rely on a restore partition (keylogger included). If you try to install off random other media (e.g. MSDN), it will not recognize the OEM license that comes with the computer.

Because of this, there is no trivial way (edit: OK, without buying Windows again) to get a vanilla install including only the Microsoft keylogger, but not the HP one.

Re: HP laptops found to have hidden keylogger

#23

Post by muxator »

To me, this is one more reason to never use the default install of an operating system.

In this specific case, if the debugging "leftovers" were part of the official drivers, then I would say there is a good indication towards preferring a free OS.

Re: HP laptops found to have hidden keylogger

#24

Post by radarsat1 »

jchw wrote: post #9

So... This has ballooned from debug code with no evidence of ever being maliciously used to "loss of confidentiality" and now instead of being a keylogger it's a "hidden keylogger." Dramatic tone change for no actual new news. Sure this is getting the person's blog attention, but now I'm certain I don't agree with the alarmist title of the original post.

Okay so reading the comments here makes me feel a bit more at ease, but honestly after reading the article I was literally like, "why the hell would the AUDIO driver need to monitor key strokes.." It really sounded like a deliberate installation of a hidden keylogger. I am glad to read that perhaps it is not, but damn sloppy.

Re: HP laptops found to have hidden keylogger

#25

Post by dragonwriter »

tga wrote: post #21
djsumdog wrote: post #14

At least with a PC, it's relatively easy to put in a fresh install, either Windows or some other operating system, which everyone in tech should do considering the recent HP/Lenovo issues (although I'm not sure if it would help I this situation if this particular exploit was in the official drivers). It's considerably harder with phones, with all of them running non standard, non upstreamable kernels, and consumers n…

Most PCs come without Windows installation media and instead rely on a restore partition (keylogger included). If you try to install off random other media (e.g. MSDN), it will not recognize the OEM license that comes with the computer. Because of this, there is no trivial way (edit: OK, without buying Windows again) to get a vanilla install including only the Microsoft keylogger, but not the HP one.

There's a trivial way, it's just not zero added cost if your PC was bundled with Windows: buy a retail version of Windows.

Re: HP laptops found to have hidden keylogger

#26

Post by jchw »

acqq wrote: post #18
jchw wrote: post #9

So... This has ballooned from debug code with no evidence of ever being maliciously used to "loss of confidentiality" and now instead of being a keylogger it's a "hidden keylogger." Dramatic tone change for no actual new news. Sure this is getting the person's blog attention, but now I'm certain I don't agree with the alarmist title of the original post.

The previous one in the audio(!) drivers was as bad as it could have been: https://www.bleepingcomputer.com/news/security/keylogger-fou... "writes all keystrokes to a local file at: C:\users\public\MicTray.log" Note: Public folder! All keystrokes. Discovered May 2017, preinstalled on 28 HP laptop models. Other hardware that uses this driver may also be affected. Edit, to the other commenters in other threads: please…

Unlike this one, it even looks like the audio driver exploit is on by default. Much stranger. Guess HP developers aren't very clean with their release process.

Re: HP laptops found to have hidden keylogger

#28

Post by Klathmon »

13of40 wrote: post #7

There are key loggers and Key Loggers. If you need admin rights to enable it and it saves the keystrokes locally, then you probably shouldn't care. Anyone with that level of access can install something worse.

"keylogger" has become one of those loaded words for me that I basically ignore whenever I read.

You can make any piece of software that takes user input sound like a "keylogger" with the right wording, that the word has basically lost all meaning.

Re: HP laptops found to have hidden keylogger

#29

Post by pnutjam »

tga wrote: post #21
djsumdog wrote: post #14

At least with a PC, it's relatively easy to put in a fresh install, either Windows or some other operating system, which everyone in tech should do considering the recent HP/Lenovo issues (although I'm not sure if it would help I this situation if this particular exploit was in the official drivers). It's considerably harder with phones, with all of them running non standard, non upstreamable kernels, and consumers n…

Most PCs come without Windows installation media and instead rely on a restore partition (keylogger included). If you try to install off random other media (e.g. MSDN), it will not recognize the OEM license that comes with the computer. Because of this, there is no trivial way (edit: OK, without buying Windows again) to get a vanilla install including only the Microsoft keylogger, but not the HP one.

Not true, you can reinstall the same version and it will pick up the licensing from the BIOS. You can even extract the key from the BIOS to use on a VM (same hardware) if your running linux.

It's even very easy to get the install media direct from Windows, not like back in XP days.

https://www.microsoft.com/en-us/software-download/windows10I...

Re: HP laptops found to have hidden keylogger

#30

Post by _0w8t »

djsumdog wrote: post #14

At least with a PC, it's relatively easy to put in a fresh install, either Windows or some other operating system, which everyone in tech should do considering the recent HP/Lenovo issues (although I'm not sure if it would help I this situation if this particular exploit was in the official drivers). It's considerably harder with phones, with all of them running non standard, non upstreamable kernels, and consumers n…

If the driver is not written by Microsoft, that new Windows installation will downloads it and quite likely it will be same HP driver with keylogger.
Post reply on HN