11 ms·
HP keylogger
- bluedino 9y agoKeyboard driver had debugging code in it.
- Rexxar 9y agoIs having optional debug trace that can be activated only with admin rights really a bad thing security-wise ? Maybe when combined with other bug/features ?
- iriche 9y agoOne less to have to write if you want to do evil. HP -oh nice, just have to enable their builtin keylogger.
- gruez 9y agoBut you can write a key logger that works without admin rights and on every windows computer in less than 100 lines.
- WhitneyLand 9y agowhat api gives a global hook across apps without rights escalation?
- Someone1234 9y agohttps://msdn.microsoft.com/en-us/library/windows/desktop/ms644990(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/ms6...
- WhitneyLand 9y agoI don’t think that works without rights scalation / admin privileges. I believed it stopped working in Windows Vista, at which time MS locked this and UAC and such things further than in Windows 7. This answer explains and also has a link to ms with more detail on how it’s blocked: https://stackoverflow.com/questions/3169675/how-to-use-setwindowshookex-in-vista-and-hook-admin-apps-with-uac https://stackoverflow.com/questions/3169675/how-to-use-setwi... Malicious keyloggers are used all the time of course, but I believe they all require some sort of exploit or way to effectively gain admin privileges.
- Someone1234 9y agoIt works without administrator, you misread the stackoverflow answer. The answer was about intercepting messages sent to an already escalated process (i.e. monitoring administrator processes from a user's context, even if they're technically an administrative user). It works for one user context process monitoring another user context process. It doesn't work for IE or Edge due to LowPriv context isolation.
- userbinator 9y agoIf you have admin access, you could install whatever keylogger you want, so IMHO this is a moot point.
- citrin_ru 9y agoExternal keylogger will likely be detected by antivirus sowtware and HP drivers are probably whitelisted.
- yitchelle 9y agoIf HP was able to release a patch to remove keylogger is a very short amount of time, does that mean that they already know about the keylogger being in the production code and had a patch ready just in-case it was detected?
- rb2k_ 9y agoNo
- Namidairo 9y agoI don't see a disclosure timeline on there, so "quick" is a relative term. Perhaps they just recognised that it could explode into a Superfish sized PR problem and went to fire off some angry calls to Synaptics for not surrounding their debug prints with ifdef. I wonder if the old driver was WHQL-certified as well... (Although I'm under the impression that just needs to pass the SDV)
- yjftsjthsd-h 9y agoCould be, but if it really was extra debugging code then they might just have forgotten to remove a debug flag or add a prod flag, so they just had to flip a bit and recompile. Yes, that requires incompetence over malice, but firmware/drivers seems to have some really low quality stuff happening.
- domenukk 9y agoYet another one? There was already this one in the audio driver earlier this year... https://news.ycombinator.com/item?id=14314795 https://news.ycombinator.com/item?id=14314795 Makes you wonder who this is for.
- jhiska 9y agoDon't use computers for anything you want to keep private.
- vortico 9y agoOr rather, proprietary software and hardware.
- ryanlol 9y agoWhy would non-proprietary software and hardware not be insecure?
- vortico 9y agoBecause typically you can't get away with sneaking code like `void keylogger() {` into freely available code. Even if hidden well, it will be discovered sooner or later with enough eyes. The only insecurities "allowed" by open-source code are accidents, and these can be discovered much quicker than accidents included in proprietary code.
- ryanlol 9y agoIn practice the situation is a little different though https://archive.fosdem.org/2017/schedule/event/linux_desktop_versus_windows10/attachments/slides/1730/export/events/attachments/linux_desktop_versus_windows10/slides/1730/fosdem_linux_desktop_security.pdf https://archive.fosdem.org/2017/schedule/event/linux_desktop... Perhaps you've heard of the disaster known as X? It's pretty clear that 'security' has never been a concern for Linux desktop developers, what software would you choose to run on your open source hardware instead of linux? Here are a plenty of exploit mitigations that simply do not exist for Linux, https://www.blackhat.com/docs/us-16/materials/us-16-Weston-Windows-10-Mitigation-Improvements.pdf https://www.blackhat.com/docs/us-16/materials/us-16-Weston-W...
- devwastaken 9y agoYou only get what your expectations are. If your expectations is defeatism in the privacy space, then you're only creating what you don't want.
- vasili111 9y agoThat is why we need opensource hardware.
- simula67 9y agoOr open source drivers
- bhhaskin 9y agoWhy not both?
- vasili111 9y agoProprietary hardware can have a hardware backdoors.
- crankylinuxuser 9y agoYes, and even those can be detected, triaged, and then summarily killed. Even those with heavy crypto and intentional hiding schemes. I'm speaking of Intel's management engine. Hacked. I'm also speaking of Apple's secure enclave processor. Hacked and unencrypted. Yeah, it'll by you some time. But when the target's nice and fat and juicy, well do I have a story for you...
- jchw 9y agoIt's a debug log. On its own, this driver doesn't do anything malicious. A malicious piece of software could exploit it, but there's no evidence that any did. Even if it got flipped on accidentally, it would merely log information and not transmit it anywhere.
- userbinator 9y agoEven if it got flipped on accidentally, it would merely log information and not transmit it anywhere. Indeed, this is pretty benign compared to the "feature" in Windows 10 which does log and send that information if you enable it... and I believe this is enabled by default: https://images.techhive.com/images/article/2015/08/0904-win10-general-100609115-orig.jpg https://images.techhive.com/images/article/2015/08/0904-win1... I really wish the "security" people would stop "crying wolf" constantly with things like this.
- keyboardhitter 9y agoI dunno, I didn't get a sense of urgency or crying wolf from the blog post. it was interesting information and a good read but I don't see verbiage leaning towards these "security" people you are criticizing. to me it read as something he was curious about and ended up inquiring to the manufacturer who confirmed some details. keylogger is a pretty scary word, but is that not what is happening, despite it being benign to other software's behavior? I personally appreciate the post, because i like to be aware of what could be potentially recorded or transmitted on machines i use. It doesn't have to "be worse than windows10" to be useful info to some users, and we certainly shouldn't expect all security-minded blog posts to be breaking news to be taken seriously. Context aside i find it fun to watch things unravel or peer into how other people work!
- jchw 9y agoI liked it too, myself. Personally I didn't find it over the top, but the title could've been more descriptive. It is technically a keylogger but keeping it vague just makes people assume it's malicious, when the code in question is obviously not, on its own.
- herf 9y agoSynTP.sys is signed by Synaptics on my Thinkpad. Why is this HP-specific?