HP Laptops Found with Keylogger Built Into Audio Driver
-
@momurda said in HP Laptops Found with Keylogger Built Into Audio Driver:
Ive got one hp laptop here, but is the Spectre line, and does not use this driver and has no mictray.exe
Checking all my other hp desktops just in case. There are some using the Conexant audio driver, but none have mictray.exe so far.Look for the log file as well, just in case it is being created via some other process.
-
C:\Users\Public\MicTray.log
-
Glad that I just returned the demo we received, although I don't recall what model it was.
-
@DustinB3403 said in HP Laptops Found with Keylogger Built Into Audio Driver:
Glad that I just returned the demo we received, although I don't recall what model it was.
But it can recall an awful lot
-
So very important to know... if you have one of these HPs and you take it to Geek Squad or return it to HP or send it out for recycling: it is easily full of your very, very private data, stuff that you never yourself recorded on the machine!
-
@scottalanmiller said in HP Laptops Found with Keylogger Built Into Audio Driver:
So very important to know... if you have one of these HPs and you take it to Geek Squad or return it to HP or send it out for recycling: it is easily full of your very, very private data, stuff that you never yourself recorded on the machine!
I generally never let MY computer go without first DoD'ing the drive.... And if the system died (my ACER) I keep the HDD... nothing was wrong with it any way.
No logger found in my old system -
![0_1494528121143_underwood5small[1].jpg](https://i.imgur.com/PozXs3z.jpg)
-
Good lord, someone's getting fired + put on trial for that one
-
@MattSpeller said in HP Laptops Found with Keylogger Built Into Audio Driver:
Good lord, someone's getting fired + put on trial for that one
One can only hope.
-
-
@MattSpeller said in HP Laptops Found with Keylogger Built Into Audio Driver:
Good lord, someone's getting fired + put on trial for that one
Haha, oh man that's funny.
-
@scottalanmiller said in HP Laptops Found with Keylogger Built Into Audio Driver:
@MattSpeller said in HP Laptops Found with Keylogger Built Into Audio Driver:
Good lord, someone's getting fired + put on trial for that one
One can only hope.
Stop reading my mind before I scroll down far enough to see your reply
-
-
@scottalanmiller said in HP Laptops Found with Keylogger Built Into Audio Driver:
https://cdn.arstechnica.net/wp-content/uploads/2017/05/keylogger.jpg
That password though. . . I mean come on "football23" no capitals, or special characters. . . Would you even need a keylogger for that?
-
I have one here.
I made the log file read only.
Let's have a little fun. -
@DustinB3403 said in HP Laptops Found with Keylogger Built Into Audio Driver:
@scottalanmiller said in HP Laptops Found with Keylogger Built Into Audio Driver:
https://cdn.arstechnica.net/wp-content/uploads/2017/05/keylogger.jpg
That password though. . . I mean come on "football23" no capitals, or special characters. . . Would you even need a keylogger for that?
My guess for a single cracking machine (8 video cards for massively parallel compute), about 2 minutes.
-
Yeah I actually just shipped one of these laptops back yesterday!
Good thing it was only a trial device and we did nothing with it.
-
@scotth Is the log file showing all keystrokes before you made it readoly?
-
@momurda No. Zero byte file at this time. I haven't checked alternative streams yet.
-
@scotth said in HP Laptops Found with Keylogger Built Into Audio Driver:
@momurda No. Zero byte file at this time. I haven't checked alternative streams yet.
Interesting. While attempting to open the file, I get denied access due to another process.
Edit: It's currently marked as readonly and hidden.
-
@scotth said in HP Laptops Found with Keylogger Built Into Audio Driver:
@scotth said in HP Laptops Found with Keylogger Built Into Audio Driver:
@momurda No. Zero byte file at this time. I haven't checked alternative streams yet.
Interesting. While attempting to open the file, I get denied access due to another process.
Edit: It's currently marked as readonly and hidden.
The executable will delete it and recreate it though.
