Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HP laptops found to have hidden keylogger

bbc.co.uk

Post reply on HN
Print view View original

51–60 of 64 posts

Re: HP laptops found to have hidden keylogger

#51

Post by skocznymroczny »

_Codemonkeyism wrote: post #48
Someone1234 wrote: post #32

Earlier quoted context omitted.

Claiming that an attacker would use this is nonsensical. You need write access HKLM in order to change the registry key, if you have write access to HKLM you can inject your own driver (inc. keylogger) into the OS. Plus the keypresses are context-less (i.e. you don't know what application, or window the keypress was sent to). A continuous stream of keypresses with no context is darn near useless, it doesn't even cont…

www.facebook.com stephan 123abc doesn't seem useless to me.

A person that knows that you can use tab to jump between form fields probably uses a password manager anyway.

Re: HP laptops found to have hidden keylogger

#52

Post by gruez »

Someone1234 wrote: post #42
gruez wrote: post #37

Earlier quoted context omitted.

>you need administrator to install a different keylogger nope. you need administrator if you want to install for all users, but there's nothing preventing a user from keylogging himself.

You need write access to: HKLM\Software\Synaptics\%ProductName%\Default Which requires administrator or equivalent, so that is preventing a user from even keylogging themselves.

i meant you can install any other keylogger without admin.

Re: HP laptops found to have hidden keylogger

#53

Post by sandworm101 »

kbutler wrote: post #13
jchw wrote: post #9

So... This has ballooned from debug code with no evidence of ever being maliciously used to "loss of confidentiality" and now instead of being a keylogger it's a "hidden keylogger." Dramatic tone change for no actual new news. Sure this is getting the person's blog attention, but now I'm certain I don't agree with the alarmist title of the original post.

And the assertion that "an attacker with access to the computer could have enabled it to record what a user was typing" is somewhat silly. If the attacker has access to the computer, why not install some other key logger that would send info to the attacker's site?

>> why not install some other key logger that would send info to the attacker's site?

Because one would assume that this software/driver has been signed and would not be recognized as evil by any protection system, at least not one on the laptop.

Re: HP laptops found to have hidden keylogger

#54

Post by jhiska »

jchw wrote: post #9

So... This has ballooned from debug code with no evidence of ever being maliciously used to "loss of confidentiality" and now instead of being a keylogger it's a "hidden keylogger." Dramatic tone change for no actual new news. Sure this is getting the person's blog attention, but now I'm certain I don't agree with the alarmist title of the original post.

One can also argue that the comments in response to the different phrasings of the same news de-escalated from "this is very serious" to your comment's "this is actually not news."

There are always contrarians, and in this case the comment-section contrarians ended up amusingly contradicting themselves.

Re: HP laptops found to have hidden keylogger

#55

Post by tga »

pnutjam wrote: post #29
tga wrote: post #21

Earlier quoted context omitted.

Most PCs come without Windows installation media and instead rely on a restore partition (keylogger included). If you try to install off random other media (e.g. MSDN), it will not recognize the OEM license that comes with the computer. Because of this, there is no trivial way (edit: OK, without buying Windows again) to get a vanilla install including only the Microsoft keylogger, but not the HP one.

Not true, you can reinstall the same version and it will pick up the licensing from the BIOS. You can even extract the key from the BIOS to use on a VM (same hardware) if your running linux. It's even very easy to get the install media direct from Windows, not like back in XP days. https://www.microsoft.com/en-us/software-download/windows10I...

Thanks, this used to be an issue at least Windows 8. I'm happily surprised if it's now as easy as downloading the ISO from Microsoft and reinstalling it on an OEM machine.

Re: HP laptops found to have hidden keylogger

#56

Post by blibble »

jchw wrote: post #9

So... This has ballooned from debug code with no evidence of ever being maliciously used to "loss of confidentiality" and now instead of being a keylogger it's a "hidden keylogger." Dramatic tone change for no actual new news. Sure this is getting the person's blog attention, but now I'm certain I don't agree with the alarmist title of the original post.

fake news

Re: HP laptops found to have hidden keylogger

#57

Post by jsudhams »

ballenf wrote: post #17
caio1982 wrote: post #10

Earlier quoted context omitted.

It still is a keylogger in a consumer product.

So is Notepad.

The last time i checked the whatever you type in browser, does not end up in text file or notepad. This does show the quality thinking about security. Oh we can enable when we want check things out rather than finding way to add and remove this after informing user

Re: HP laptops found to have hidden keylogger

#60

Post by vertex-four »

bnegreve wrote: post #47
ballenf wrote: post #17

Earlier quoted context omitted.

So is Notepad.

Notepad runs in userland under the supervision of the kernel. This is a driver and could be running in kernel mode. It could make a big difference. Even if it's not malicious, I still think it is a rather serious professional mistake to ship a driver containing potentially dangerous deadcode.

There's plenty of "rather serious professional mistakes" in whatever operating system you happen to run in the first place - it's very rare that something that doesn't affect security in any meaningful way gets the attention this has.
Post reply on HN