HP audio drivers have built in keylogger

[Red Squirrel]

Yet another device/software that spies on users.

https://thenextweb.com/insider/2017...vers-with-a-built-in-keylogger/#.tnw_Z07r4EGt

 

[pcgeek11]

Well at least it wasn't intentional... Just stupidity.

 

[Red Squirrel]

Or so they say. Seems something this specific would almost have to be coded on purpose. Someone at HP is probably really good at PR and was able to quickly turn this around when approached about it.

 

[HitAnyKey]

Quote "It also recommends that users delete the MicTray log file, as it may contain sensitive information, like passwords and login credentials."

That's pretty crazy. Poorly implemented yeah right.

 

[John Connor]

Why on EARTH would a simple audio driver need to record keystrokes? That was coded on purpose and it looks like HP got caught with their pants down.

 

[pcgeek11]

They wanted to capture the hotkey stroke for volume controls etc and instead of coding it to only capture those specific keys they had it capture everything. Probably just lazy programming... I don't think HP cares about your keystrokes.

Also instead of just deleting the MicTray log file in your current hard disk you should also go through any image backups and get rid of the MicTray log file there also...

 

[Brainonska511]

Quote "It also recommends that users delete the MicTray log file, as it may contain sensitive information, like passwords and login credentials."

That's pretty crazy. Poorly implemented yeah right.

Saw that file on my work laptop after getting an email from IT. At least on my computer, the text file was empty. Still, wtf

 

[Red Squirrel]

Why on EARTH would a simple audio driver need to record keystrokes? That was coded on purpose and it looks like HP got caught with their pants down.

Yeah I feel they tried to disguise it as an accident. How do you accidentally log and record keystrokes? Especially with a driver that has nothing to do with user input. I could almost understand if it was a keyboard driver but audio?

 

[Rifter]

there is no way you unintentionally install a keylogger in your software. this was 100% a deliberate act.

 

[pcgeek11]

there is no way you unintentionally install a keylogger in your software. this was 100% a deliberate act.

The question in that case is why? What did they get out of it? The log file gets deleted and rewritten at every boot. It wasn't being sent out as far as I have read anyway.

I'm not seeing it being intentional. Stupid - yes.

 

[John Connor]

I'm more inclined to think HP software engineers aren't very bright.

 

[Red Squirrel]

The question in that case is why? What did they get out of it? The log file gets deleted and rewritten at every boot. It wasn't being sent out as far as I have read anyway.

I'm not seeing it being intentional. Stupid - yes.

I'm thinking it was there for perhaps another assistive tool to then pickup the log file and do something with it. Maybe not even one written by HP. Heck or just the web browser. You go to a certain site, and it just reads that file.