HP’s second laptop keylogger in less than a year

Researcher Michael Myng was trying to work out how to control the backlight on an HP laptop keyboard.

What he found instead was that the keyboard driver used by 475 models of HP laptops contained a secret keylogger, capable (potentially) of stealing passwords and other confidential information.

The news made for some pretty scary headlines, and – as I discussed in a past episode of the “Smashing Security” podcast – it’s not the first time that a hidden keylogger on HP devices has caused eyebrows to be raised.

But, before you get too alarmed, bear this in mind. The keylogger in the HP Synaptics Touchpad driver (SynTP.sys) keyboard driver was not enabled by default.

It looks like, once again, debugging code was contained in a keyboard driver shipped by HP. To turn on the debug “feature” a user with admin privileges would have to make a change to the Windows registry, whereupon keystrokes would be logged to a local file.

Not a great scenario, but also not as bad as it being enabled by default, or your keypresses being beamed to a server under the control of HP or Synapatics.

HP has issued a security advisory, and pushed out updates to fix the potential security issue.

Of course you should ensure that any affected devices are patched as soon as possible, and if you’re a developer learn the lesson not to leave debug code lurking within your shipping code if it might put users’ privacy and security at risk.

And, if you really feel you do need to be seriously disgruntled about something, feel angry that HP has now made the same mistake twice in less than a year. That’s certainly something worthy of turning your CAPS-LOCK on for.

Found this article interesting? Follow Graham Cluley on Twitter, Mastodon, or Threads to read more of the exclusive content we post.

Graham Cluley •   @gcluley

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.