8 ms·
Keylogger in Hewlett-Packard Audio Driver
- doreox 9y ago> ...or it could just monitor the keystrokes itself with SetWindowsHookEx() like this process. ...which any AV will immediately flag. This allows malware to keylog in a much less detectable way by piggybacking off trusted HP software
- arca_vorago 9y agoI remember in the late 90's early 2000's when HP was embracing linux and open source... and then they merged with Compaq and I've seen nothing but mistake after mistake from them since. I'm really tired of seeing companies positioned to make good things and better the world get focused on quarter profits and short term thinking, because it always bites them in the ass eventually. Mismanagement from the C level up abounds.
- stanislavb 9y agoWow. That's going to hit HP
- romanovcode 9y agoYeah, that's even worse than last years Lenovo fiasco.
- TeMPOraL 9y agoYes, and the results will likely be the same - i.e. nothing whatsoever.
- egeozcan 9y agoI personally wouldn't compare these two incidents but just wanted to remind you that the Lenovo incident was malicious by design. This one can, and most likely will, be attributed to carelessness.
- cyphax 9y agoThe article suggests that as well, the way I read it: "Actually, the purpose of the software is to recognize whether a special key has been pressed or released. Instead, however, the developer has introduced a number of diagnostic and debugging features to ensure that all keystrokes are either broadcasted through a debugging interface or written to a log file in a public directory on the hard-drive. This type of debugging turns the audio driver effectively into a keylogging spyware." Carelessness sounds like a fairly reasonable explanation, simply applying Hanlon's razor. :)
- wolfgke 9y ago> Carelessness sounds like a fairly reasonable explanation, simply applying Hanlon's razor. :) On the other hand: If you do believe that there exist software on most computers where a security hole has deliberately left in (and since Snowden you should), applying Occam's razor will tell you that it probably looks like "innocent incompetence", since considering the typical software quality this gives rather plausible deniability.
- krylon 9y agoTo be fair, logging keystrokes to a debug log sounds like something I might have done if I had to write and/or debug such a piece of code. Then again, I probably would have wrapped that code in an #ifdef so it is only present in debug builds. Come to think of it, I have done something like this, except I only logged keystrokes the application received directly, and I did wrap it in an #ifdef, although my motive was more along the lines of preventing the debug log from filling up the customers' hard drives. ;-)
- libeclipse 9y agoUnlikely. Normal consumers simply don't care, unfortunately.
- avian 9y agoWhat is a caring consumer to do? At this point, pretty much all laptop brands are on my blacklist for one such reason or another.
- secfirstmd 9y ago"Neither HP Inc. nor Conexant Systems Inc. have responded to any contact requests. Only HP Enterprise (HPE) refused any responsibility, and sought contacts at HP Inc. through internal channels." A keylogger and this is their response? I hope they get the shit sued out of them.
- vfclists 9y agoThis is one of the main reasons for libre/free/open/choose_your_term software. Even when malice is not to be checked for, genuine error, incompetence, forgetfulness or plain indifference must be checked for.
- krylon 9y agoAs much as I love Free Software, there have been plenty of examples of bugs (security-relevant and otherwise) in FLOSS code that were just as problematic. Source code being open for inspection only helps if people actually take the time to look at the code. OpenBSD deserves an honorable mention.
- mikegerwitz 9y agoProprietary software developers have little incentive aside from the possibility of discovery to not take advantage of users. It's sometimes difficult to determine whether it's malicious or not, and there's a greater chance for plausible deniable---we don't know the story behind that code. If an anti-feature is discovered in free software, it can be promptly removed and replaced, regardless of whether the developers of the software consider it to be an anti-feature. What if HP wants this to remain for debugging/diagnostic purposes? There's little you can do about that. (I'm not saying they do.) The fact that free software can have bugs is an open source argument that falls apart when the argument becomes "open source is better because of technical advantage X".[0] There are frequent arguments that the freedom of drivers isn't important---mainly because it's inconvenient to use a system without non-free drivers and requires purchasing replacement hardware to work around. This is an example that maybe can help counter that point. [0]: https://www.gnu.org/philosophy/open-source-misses-the-point.html https://www.gnu.org/philosophy/open-source-misses-the-point....
- krylon 9y agoI do agree - wholeheartedly - with you that Free Software gives users control over what their devices do. This is important. Control and trust that your devices do what they are supposed to do - no more, no less - are pretty much impossible to establish without free software My point was that if nobody bothers to look at the code, the bug will go undetected. Think of how long the Heartbleed bug had been in OpenSSL before it was discovered.
- 0xFFC 9y agoThis is fucked up world we live in !
- kko11 9y agois it confirmed?
- zollidia 9y agoI'm strangely not surprised with HP and their actions (in this case, a lack there of). It reminds me of the Bose issue a year or so back with their products. And the impact in which HP is going to experience - is nothing. Most people still to this day really don't care/understand on why this is a problem. They just want to get a computer for school, General internet surfing or watch cat videos. (Cat and Dog videos are quite interesting.)
- DaiPlusPlus 9y agoHP got more flak for their "racist webcam" than this issue ever will, I suspect. (2009: http://gizmodo.com/5431190/hp-face-tracking-webcams-dont-recognize-black-people http://gizmodo.com/5431190/hp-face-tracking-webcams-dont-rec... )
- drinchev 9y ago> Actually, the purpose of the software is to recognize whether a special key has been pressed or released. Instead, however, the developer has introduced a number of diagnostic and debugging features to ensure that all keystrokes are either broadcasted through a debugging interface or written to a log file in a public directory on the hard-drive. Looks like it's not intentional. Although really poor code-quality process I would say.
- jlg23 9y ago> Looks like it's not intentional. Although really poor code-quality process I would say. OTOH, pretending incompetence has always been a pretty successful defence. This is a class of error that I won't easily attribute to incompetence.
- wolfgke 9y ago> Looks like it's not intentional. Although really poor code-quality process I would say. To quote from > https://en.wikipedia.org/w/index.php?title=Underhanded_C_Contest&oldid=773989999 https://en.wikipedia.org/w/index.php?title=Underhanded_C_Con... (emphasis by mine): "The Underhanded C Contest is a programming contest to turn out code that is malicious, but passes a rigorous inspection, and looks like an honest mistake." Do you really believe that Malory does not use practices that make the security hole look like a mistake of a not-so-experienced programmer or an internal debugging tool that was accidentally left in?
- drinchev 9y agoThat's why I wrote "Looks like" in first place. A little paranoia here would actually be helpful. Anyway my thought process is : If it's really intentional, they would not dump the keystrokes to a text file ( maybe some `.dat` shit ) and will not truncate it on every log in. On the other hand. It seems quite stupid for anyone to not foresee what happens when the code is being executed on a scale. If I'm a big corp, I would actually demand ( via court ) from HP/Conexant to open source the driver itself, since any investigation will need access to it anyway.
- mijoharas 9y ago
- donpark 9y agogoogling "conexant keylogger" shows this is not a new problem.
- digi_owl 9y agoHmm, Conexant. I seem to recall battling their products back in the modem days...
- nailer 9y agoTo fix the super-wide article: document.querySelector('.blogbody').setAttribute("style", "max-width:650px; margin: 0px auto;");
- rahilwazir 9y agoThanks, you will go far in life.
- xroche 9y agoAs a rule of thumb, you have: * Decent software companies terrible at making hardware * Decent hardware companies terrible at making software I yet have to see one that does both correctly. Hardware manufacturers are known to produce the worst code quality you can think of, badly designed, poorly written, undocumented, insecure, bloated. I have the feeling that the whole IoT problem is also related.
- cat199 9y agoUmm.. https://en.wikipedia.org/wiki/HP_Superdome https://en.wikipedia.org/wiki/HP_Superdome https://en.wikipedia.org/wiki/HP-UX https://en.wikipedia.org/wiki/HP-UX and HP is usually one of the best rather than worst here, though definitely more so in the pre-carly days. though i get the general sentiment, esp when applied to consumer products..
- prklmn 9y agoApple?
- onion2k 9y agoiTunes
- golergka 9y agoApple was not bad at both some time ago. Not anymore though.
- LoSboccacc 9y agoiOS quality dropped jsut after the days of "everything must be skeuomorphic!" - that ux was thrown out quickly (luckily) but the replacement has been hardly stable and quite poorly thought from the inception, and some stuff is still giving me constant annoyance even today - like the time app not opening on the last used tab
- rubatuga 9y ago
- userbinator 9y agoActually, the purpose of the software is to recognize whether a special key has been pressed or released. I'm doubtful of the utility of software like this. Every driver and application seems to want to keep a persistent background process running, and because of the natural inefficiency of software (this executable is ~2MB --- why it needs to be this big, I'm not certain; from a brief inspection, all it seems to be doing is controlling microphone mute/unmute), results in a huge waste of resources and new computers which appear no more responsive and than older ones. However, to put the severity of this problem in perspective, from the description this is not like a typical keylogger that sends keystrokes out to some remote server; it only logs locally. If you regularly make incremental backups of your hard-drive - whether in the cloud or on an external hard-drive – a history of all keystrokes of the last few years could probably be found in your backups. There's going to be plenty of other sensitive information in your backups, which if you don't want others to read you would use encryption anyway, in which case the point is rather moot. Any process that is running in the current user-session and therefore able to monitor debug messages, can capture keystrokes made by the user. ...or it could just monitor the keystrokes itself with SetWindowsHookEx() like this process. Thus, I think the correct reaction to this is more towards the "oops... that wasn't a good idea" than "everybody panic!"
- qeternity 9y ago> There's going to be plenty of other sensitive information in your backups, which if you don't want others to read you would use encryption anyway, in which case the point is rather moot. This is a bit of a strawman. When you're backing things up, you know what you're backing up and chose to do so. Here you'd be backing up things that you didn't want to, or even worse, things you'd never want to be backed up anyway. If someone gets into my backups, maybe they can see some family photos or financial data...but they wouldn't otherwise be able to see all the porn searches I do in incognito mode. With this, they could potentially access that as well.
- deleted 9y ago[deleted]
- saiya-jin 9y ago
- wereHamster 9y agoPlease, use a max-width on text columns. The article is unreadable on a large screen.
- lsaferite 9y agoI tend to hate max-width on sites because I'm left with a giant white page that's only using a few % of the space for text.
- cttet 9y agoBut design is not only about looking good. It may look nice but with terrible UX.
- Aaargh20318 9y agoOnly if you have your browser window maximised or very large, which kind of defeats the purpose of a windowed multitasking OS.
- wereHamster 9y agoYou know, you can have more than one screen. And working wth visual/design/UI tools you pretty much want to use as much of the screen as possible. Most of the time I have a browser fullscreen on one of my screens.
- Aaargh20318 9y ago> working wth visual/design/UI tools you pretty much want to use as much of the screen as possible. Really? You maximise your content window ? Then where do you leave all your tool-windows ? On a second monitor ? Do you only design widescreen content ? Don't you think those white bars on the left/right of your content is a total waste of screen real estate ?
- frou_dh 9y agoThis is a losing battle. For people who have been reflexively maximising everything since they were using Win95 on little goldfish bowl CRTs, they simply won't stop doing it, no matter how ridiculous it is on big/wide screens.
- snowpanda 9y agoI archived the HP page just in case: https://archive.fo/FjWUv https://archive.fo/FjWUv
- amluto 9y agoOne thing I really like about Linux: random platform-specific hardware features like the mic button or whatever this is are handled by an open source "platform" driver in the kernel. These drivers expose a more or less uniform interface to user code. So, when I install Linux on a laptop, most or all of the weird laptop-specific buttons just work without OEM crapware or runtime performance hits. The downside, of course, is that you can't just download fresh crapware to make your brand new laptop fully functional. I'll take that tradeoff.
- cies 9y agoWell said. I have the same sentiment. Gimme Linux (or FreeBSD) and I stay clear of your crapware, re-install my machine less often, and install a new OS+apps much faster.
- darth_mastah 9y ago+1
- CodeSheikh 9y agoIs this an old article? Conexant was acquired by Philips a while back.
- donpdonp 9y agoMicBleed