Some HP laptops are vulnerable due to a now known bug that has an enormous security fail:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-8360
In simple words, Conexant the sound driver in the machines, keeps track of all the keystrokes in a text file named: MicTray.log
This file contains all the keystrokes that the user typed… It only takes to transcribe the key code to read it. You can find the codes that matches the keys here:
https://msdn.microsoft.com/fr-fr/library/windows/desktop/dd375731(v=vs.85).aspx
Example:
and:
Here, the affected laptops:
- § HP EliteBook 820 G3 Notebook PC
- § HP EliteBook 828 G3 Notebook PC
- § HP EliteBook 840 G3 Notebook PC
- § HP EliteBook 848 G3 Notebook PC
- § HP EliteBook 850 G3 Notebook PC
- § HP ProBook 640 G2 Notebook PC
- § HP ProBook 650 G2 Notebook PC
- § HP ProBook 645 G2 Notebook PC
- § HP ProBook 655 G2 Notebook PC
- § HP ProBook 450 G3 Notebook PC
- § HP ProBook 430 G3 Notebook PC
- § HP ProBook 440 G3 Notebook PC
- § HP ProBook 446 G3 Notebook PC
- § HP ProBook 470 G3 Notebook PC
- § HP ProBook 455 G3 Notebook PC
- § HP EliteBook 725 G3 Notebook PC
- § HP EliteBook 745 G3 Notebook PC
- § HP EliteBook 755 G3 Notebook PC
- § HP EliteBook 1030 G1 Notebook PC
- § HP ZBook 15u G3 Mobile Workstation
- § HP Elite x2 1012 G1 Tablet
- § HP Elite x2 1012 G1 with Travel Keyboard
- § HP Elite x2 1012 G1 Advanced Keyboard
- § HP EliteBook Folio 1040 G3 Notebook PC
- § HP ZBook 17 G3 Mobile Workstation
- § HP ZBook 15 G3 Mobile Workstation
- § HP ZBook Studio G3 Mobile Workstation
- § HP EliteBook Folio G1 Notebook PC
All this to say that taking advantage of this bug is as easy as it is dangerous.
HP has put at disposal a new hotfix: SP80323.exe
If your laptop appears in this list, please urgently update it!
Another way of doing it is deleting the executable, the log and all kind of automatic launch to prevent from this fail. To do so, delete MicTray.exe or MicTray64.exe, MicTray.xml or MicTray64.xml (both can be found under System32), delete the log in the Public repertoire and restart the machine!
This link will show you a PowerShell script cleaning the system!
https://github.com/jolegape/RemoveConexantKeylogger/blob/master/Remove_Conexant_Keylogger.ps1
Have a blast with this patch,
Security first!
@RioJoubert
