This site may earn chapter commissions from the links on this page. Terms of apply.

465208-dimensions HP Omen PCMag

OEMs aren't especially proficient at security, but HP's recent problems deserve some kind of honour. The visitor has been aircraft a keylogger on at to the lowest degree 460 laptop models, and while it's disabled by default, enabling it is as simple as flipping a registry switch.

Security researcher Michael Myng (aka ZwClose) establish the bug while looking for a way to control HP'due south keyboard backlight. During his search, Myng establish data suggesting there could be a keylogger embedded in HP systems (the phrase KeyboardHookCallback was a hint to the function of the capability). The relevant registry keys were located at:

HKLM\Software\Synaptics\%ProductName%
HKLM\Software\Synaptics\%ProductName%\Default

HP has released an update for the flaw, saying:

A potential security vulnerability has been identified with certain versions of Synaptics touchpad drivers that impacts all Synaptics OEM partners. A party would demand administrative privileges in lodge to take advantage of the vulnerability. Neither Synaptics nor HP has access to customer data equally a event of this issue.

It'southward truthful the aggressor would've needed Authoritative access, but that's less difficult than you might think. What the assaulter really needed was for a user to click "Aye," on a UAC box. It's not difficult to get people to practice that, seeing as they rarely sympathise what UAC is or what it does anyway. It remains a prime case of security theater rather than a functional product that provides any benefit for the end user. According to HP, this keylogger was used for diagnostic purposes, but should've been removed earlier systems ever shipped.

To HP's marginal credit, it avoided shipping systems with the keylogger enabled, but problems like this are part of why securing systems is and then difficult to brainstorm with. It's not enough to only update your Bone and run regular scans — OEM systems from Dell, to HP, to Lenovo oft haven't been audited to make sure they're closing their own loopholes. In this instance, the update is also beingness pushed through Windows Update, which should assist some people lock down their systems.

We're not kidding about upwardly to 460 models being afflicted by this, but we'll shortcut information technology for y'all: If y'all have an HP laptop, hie thee to this webpage, search to see if your model is listed, and apply the relevant fix. We'd recommend doing this equally opposed to waiting for Windows Update, since then you lot'll know the fix has been practical, rather than hoping it was rolled into the WU update and took properly. This fix shouldn't accept any impact on your touchpad functioning in any fashion.