HP laptops found to have hidden keylogger

Post by Someone1234 » Mon, Dec 11, 2017, 3:13 PM UTC

gruez wrote: post #37

Someone1234 wrote: post #35

Earlier quoted context omitted.

Exactly. You need administrator to enable this, and you need administrator to install a different keylogger. So then the question becomes: Why use this? Well, an attacker wouldn't but the press doesn't know anything about tech' so, this fact escapes them. This is like science reporting all over again... If you have HP's update agent installed, HP are able to install drivers, so all bets are off as far as what HP coul…

>you need administrator to install a different keylogger nope. you need administrator if you want to install for all users, but there's nothing preventing a user from keylogging himself.

Post by kbutler » Mon, Dec 11, 2017, 3:20 PM UTC

julianj wrote: post #34

kbutler wrote: post #13

Earlier quoted context omitted.

And the assertion that "an attacker with access to the computer could have enabled it to record what a user was typing" is somewhat silly. If the attacker has access to the computer, why not install some other key logger that would send info to the attacker's site?

I agree that the someone having access to run arbitrary code on a machine is a much bigger deal. In this case, the difference between this debugging feature and an installed keylogger is the use of trusted software to perform the keylogging. When the mictray issue came out earlier this year, I ran across a blog post you may find interesting [1]. To summarize, the author repurposed the HP executable to log keys to a r…

Post by radarsat1 » Mon, Dec 11, 2017, 3:24 PM UTC

astura wrote: post #43

radarsat1 wrote: post #24

Earlier quoted context omitted.

Okay so reading the comments here makes me feel a bit more at ease, but honestly after reading the article I was literally like, "why the hell would the AUDIO driver need to monitor key strokes.." It really sounded like a deliberate installation of a hidden keylogger. I am glad to read that perhaps it is not, but damn sloppy.

Listening for function key presses, I would imagine. Every laptop I've ever had allowed volume control with function keys. Disclaimer: it's been over a decade since I've done applications development and I've never done driver development.

Post by _Codemonkeyism » Mon, Dec 11, 2017, 3:31 PM UTC

Someone1234 wrote: post #32

kbutler wrote: post #13

Earlier quoted context omitted.

And the assertion that "an attacker with access to the computer could have enabled it to record what a user was typing" is somewhat silly. If the attacker has access to the computer, why not install some other key logger that would send info to the attacker's site?

Claiming that an attacker would use this is nonsensical. You need write access HKLM in order to change the registry key, if you have write access to HKLM you can inject your own driver (inc. keylogger) into the OS. Plus the keypresses are context-less (i.e. you don't know what application, or window the keypress was sent to). A continuous stream of keypresses with no context is darn near useless, it doesn't even cont…

Post by user5994461 » Mon, Dec 11, 2017, 3:41 PM UTC

Someone1234 wrote: post #32

kbutler wrote: post #13

Earlier quoted context omitted.

And the assertion that "an attacker with access to the computer could have enabled it to record what a user was typing" is somewhat silly. If the attacker has access to the computer, why not install some other key logger that would send info to the attacker's site?

Claiming that an attacker would use this is nonsensical. You need write access HKLM in order to change the registry key, if you have write access to HKLM you can inject your own driver (inc. keylogger) into the OS. Plus the keypresses are context-less (i.e. you don't know what application, or window the keypress was sent to). A continuous stream of keypresses with no context is darn near useless, it doesn't even cont…