Pre-installed Keyloggers... on HP Laptops

[Hervé]

Security researcher uncovers keylogging software in hundreds of HP laptop models (https://www.rt.com/news/412778-hp-laptop-keylogger-code/)


RT (https://www.rt.com/news/412778-hp-laptop-keylogger-code/)
Tue, 12 Dec 2017 17:23 UTC


https://www.sott.net/image/s21/438665/large/5a2ed897fc7e9380108b4567.jpg (https://www.sott.net/image/s21/438665/full/5a2ed897fc7e9380108b4567.jpg)
Hewlett-Packard Co. logo is displayed on the back of the Envy x2 laptop © Bloomberg / Gettyimages.ru


A security researcher has revealed that some HP laptops have hidden software which can log everything typed on its keypads. More than 460 models have been affected, dating back to 2012, according to the list released by HP.

The discovery was made (https://zwclose.github.io/HP-keylogger/) by researcher Michael Myng who found the keylogging code in the pre-installed Synaptics Touchpad software on HP laptops.

Keyloggers record every key that is pressed on a keyboard. This means HP laptop users are at risk of having their passwords, bank details, private communications and search history recorded without their knowledge. The keylogger is disabled by default but there's risk it can be enabled by a hacker.

Myng, who is known online as "ZwClose," learned about the keylogger when he was examining the Synaptics Touchpad software to find out how to control the keyboard backlight. Myng has issued a software patch to remove the keylogger, and HP has released a driver update for affected laptops.

HP says neither the company nor Synaptics had access to the files, and that it was built into the Synaptics software to help debug errors.

"HP uses Synaptics' touchpads in some of its mobile PCs and has worked with Synaptics to provide fixes to their error for impacted HP systems, available via the security bulletin on HP.com," HP said. The company provided a list (https://support.hp.com/us-en/document/c05827409) of models affected.
This is the second keylogger code found in HP laptops this year. In May, Swiss security firm Modzero discovered (https://www.modzero.ch/modlog/archives/2017/05/11/en_keylogger_in_hewlett-packard_audio_driver/index.html) a keylogger built into the HP audio driver.

Also this year, the company was found (https://www.extremetech.com/computing/259605-hp-caught-installing-spyware-windows-10-systems-without-permission-notification) to have installed spyware applications on Windows 10 computers. Following a November update, users began noting a HP TouchPoint Analytics Client was installed and uploading information to HP servers daily.

[petra]

Good Grief (says Charlie Brown)!

Shouldn't some of those virus-pattern scanners be picking up the keylogging? We need something that'll detect when something "acts malicious", I'd rather have a pile of false positives than keyloggers getting past.

Webroot (https://www.webroot.com/blog/2016/02/17/proven-next-generation-endpoint-security/) seems to be a really good one, it found a virus in a piece of software which none of my other scanners were detecting (this was years ago though). Once I was able to find the virus I was able to clean my machine. Without Webroot, I would have had to flatten the machine.

[conk]

I recently read about how millennials solve problems. Often they "socialize" the issue using Facebook, Twitter, etc. When asked about privacy and perhaps they were sacrificing privacy by using social media, they replied that privacy was not something they worried about. Many of them intimated that privacy was the least of their concerns. The brainwashing is nearly complete!

[Omni]

I recently read about how millennials solve problems. Often they "socialize" the issue using Facebook, Twitter, etc. When asked about privacy and perhaps they were sacrificing privacy by using social media, they replied that privacy was not something they worried about. Many of them intimated that privacy was the least of their concerns. The brainwashing is nearly complete!

And these are the so-called gifted indigos of the galaxy. :facepalm:

[Flash]

One day I may get the hang of it (computers and block chain lol)

Window 10 has keyloggers spying as well

https://www.express.co.uk/life-style/science-technology/783098/windows-10-turn-off-microsoft-secret-keylogger

In the meantime, I will refresh my Spanish skills....

[SpookyMulder]

This is just one of so many.
You can name a few more, Acer, Asus, HP, Dell, Lenovo, etc.

Pre-installer "crapware" as commonly called has been nothing but a plague for decades. The first thing buyers should do when purchasing a new laptop is to totally reformat the machine and either install a customized version of Windows (by creating your own ISO after removing all the unnecessary stuff) or even better a Linux distro - for the lambda citizen Ubuntu or Linux Mint should be a good start.

The only issue is people are clueless, they just don't want to know and don't to want to care and they don't care to know.

This is just the tip of a gigantic iceberg that will only get bigger, now that crypto currencies are involved, ransomware on computers and mobile phones, faster Internet meaning a faster way to fall deeper down the rabbit hole and on and on it goes.

[Lifebringer]

The millenials us the FB and Twitter sites who have the best hack protection $ can buy to put their own info through. If any hacks happen, These sites like YT can afford to re-emburse for damages from their system. Just a little guaranteed insurance to keep hackers out their personal by going through one or two major sites that protect their clients interest while gathering. Yes they are trusting these sites, other than to have bank accts hacked. These major companies will seek hackers our, prosecute, and re-imburse. That's all, millenials say: "If they want me and my information here, they better cover the hacking when I order." That's pretty much it. Proof of when it occurred on record and rapid response to heal the damage of loss. Otherwise their site is "poo."

[petra]

Many of them intimated that privacy was the least of their concerns. The brainwashing is nearly complete!

Well, that's one way of looking at it! Personally I think that internet privacy has always been an illusion, since the very start.

I remember my PC getting hijacked in the late 90's, and not giving a crap. Could be part of my brainwashing tho :) The dude on the other end ended up giving me the hijacking software to play with, and that's exactly what I did. It's a scary feeling having "too much access". With the state of the internet at the time (no one had firewalls), it was ridiculously easy to detect infected people in chat rooms too. Pretending to be a ghost is pretty fun, but it got old fast! After a while I figured disinfecting people and letting them know they had a virus was more better use of my time.