HP Issues Fix For Hundreds of Laptop Models For Bug That Can Record Keystrokes
Hewlett-Packard recently issued security patches for hundreds of its laptop models found to be infected by a bug that can record users' keystrokes.
This week, HP released a long list of security patches for more than 400 laptop models found to be affected by the discovered bug. In the same information bulletin, the company explained that the issue was specifically embedded in "certain versions of Synaptics touchpad drivers."
Meanwhile, Michael Myng, the security researcher who discovered the bug, also explained in his website that the bug was a keylogger - a known computer issue that covertly records a user's actions and strokes when using the keyboard or other input devices.
Get Our Latest News for FREE
However, Myng added that the recorded keystrokes from the Synaptics bug were "disabled by default" but could still be used with the proper tool.
In the same security bulletin that HP posted, users were reassured that "administrative privileges" would be required to access any data that the vulnerability stored.
HP added: "Neither Synaptics nor HP has access to customer data as a result of this issue."
A lot of the listed affected laptop models were categorized by HP as commonly used for commercial purposes and as mobile workstations. These include those that were part of the Elite series, ProBook units, those in the Spectre line, notebooks and several others.
Many consumer notebooks also need to be updated due to the potential keylogging threat, including several Compaq-branded products and laptops from HP's Envy, Omen, Pavilion, Stream, and Split series.
Meanwhile, in Myng's account -- which was posted a week before HP came up with a security patch -- he shared that he learned about the Synaptics bug when a friend asked for his help in controlling the backlight of an HP laptop's keyboard.
Before informing HP about the issue, Myng said he first tried to confirm if someone else had found out about the bug and got no response. That was when he decided to message HP and report the vulnerability.
"They replied terrificly fast, confirmed the presence of the keylogger (which actually was a debug trace) and released an update that removes the trace," Myng said.
