I am more than a little worried about cybersecurity after patching all my servers over the weekend as a precaution against the WannaCry Ransomware that rocketed around the world last week. That computer exploit was based on a previously unknown security hole on Windows systems. So, you could imagine how shocked I was when I learned that my HP laptop may have keylogger software pre-installed from the factory!
A keylogger is a piece of software that logs every key you press on your keyboard. It can capture personal messages, passwords, credit card numbers, anything you type. Sometimes malware installs keyloggers, but it is sold in stores for folks who wish to spy on their kids, spouse or employees. Depending on how they are used they are perfectly legal.
Here is what happened.
Many HP laptops come with audio driver provided by Conexant Systems. Conexant’s MicTray64.exe is installed with the Conexant audio driver package and registered as a Microsoft Scheduled Task to run after each user login. The program monitors all keystrokes made by the user to capture and react to functions such as microphone mute/unmute keys/hotkeys. This is normal behavior for such a device driver. However, in addition to the handling of key strokes, all key information is written into a logfile in an unprotected path (C:\Users\Public\MicTray.log). If the logfile does not exist or the setting is not yet available in the Windows registry, all keystrokes are passed to debugger API. In either case, malicious code can read the file or tap into the debugger information without looking suspicious to security software. I should also note that this flaw has existed since the year 2015!
I immediately checked my HP Spectre laptop and there it was C:\Users\Public\MicTray.log. Fortunately, the file was empty with a file creation date of 11/21/2015. All users of HP computers should check whether the program C:\Windows\System32\MicTray64.exe or C:\Windows\System32\MicTray.exe is installed. It should be deleted or renamed if it exists. The program was not found on my system.
HP announced last Friday that it had fixed the problem. However, I have not been able to find it on their web site. HP says it has no access to this data, and the keylogger does not appear to be malicious. There is no evidence that the keylogger does anything with the keystrokes it captures. But there is still cause for concern. The WannaCry attack was based on a security flaw uncovered by US intelligence agencies and subsequently released on the internet by WikiLeaks last December. Last week malicious hackers exploited that flaw to launch the WannaCry Ransomware around the world. It is more common for these criminals to use known security flaws rather than undisclosed vulnerabilities known as zero-day vulnerabilities. Now that it has been disclosed, you can bet someone will attempt to exploit the Conexant audio driver keylogger soon.
