{"id":2861,"date":"2017-05-16T10:14:19","date_gmt":"2017-05-16T08:14:19","guid":{"rendered":"http:\/\/borncity.com\/win\/?p=2861"},"modified":"2024-10-05T23:21:02","modified_gmt":"2024-10-05T21:21:02","slug":"the-hp-conexant-audio-driver-stop-key-logger-placebo-update","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2017\/05\/16\/the-hp-conexant-audio-driver-stop-key-logger-placebo-update\/","title":{"rendered":"The HP Conexant audio driver ‘stop keylogger’ placebo update"},"content":{"rendered":"

[German<\/a>]A few days ago I've reported about a key logger within HP's Conexant audio drivers for several devices. HP claimed this key logger has been left accidentally within the driver and offered quickly an update to 'remove' the key logger. But what would you think, if the key logger hasn't removed? Addendum:<\/strong> A 2nd update has changed the situation again.<\/p>\n

<\/p>\n

\"\"Recently I 've learned, we are living in an age of 'alternative facts & fake news'. And from movies I learned that there ist a 'good cop, bad cop' game. Media has applauded HP for their quick update for the audio driver. But we have to have a closer look.<\/p>\n

What's the matter?<\/h3>\n

\"\"Some HP notebooks with Conexant audio chips (see the list within this Security Advisory<\/a>) has been shipped since 2015 with a 'special' audio driver. This driver contains a key logger, writing all keystroke into a text file located at:<\/p>\n

C:\\Users\\Public\\MicTray.log<\/em><\/p>\n

Security researcher Thorsten Schr\u00f6der<\/a> detected this key logger within the audio driver during a security audit for a customer on a HP driver package. I've written about this topic within my blog post HP Notebooks: Keylogger in Conexant's audio driver<\/a>.<\/p>\n

HP says, the key logger should have never been shipped and left accidentally within the driver. The company offers immediately a driver update, that is believed to remove the key logger.<\/p>\n

The direction light problem: on, off, on, off ported to a key logger \u2026<\/h3>\n

Probably HP's management and the driver developers has been under a great time pressure. So they took the lection from 'alternative facts' and offered an update to remove logging keystrokes into the text files. But it seems only a placebo, as security analyst Thorsten Schr\u00f6der<\/a> found out and reported within this tweet:<\/p>\n

\n

#HP<\/a> did not remove the #keylogger<\/a> functions in new version. Simply turn it on by setting SeeScanCode and EnableLog = 1 in Windows Registry. pic.twitter.com\/321uLSDP7s<\/a><\/p>\n

\u2014 THS (@__ths__) 13. Mai 2017<\/a><\/p><\/blockquote>\n