Did you buy HP EliteBook or ZBook models? It may be silently recording every keystroke on your computer. Swiss infosec firm ModZero claims that several HP Laptops and tablets, including the HP Elitebook, ProBook, and ZBook models come with keylogger as a part of its audio driver.
Security researcher ModZero found the audio driver with a keylogger. This keylogger secretly records every keystroke and saves it in an unencrypted file on the computer’s hard drive. This driver was developed by audio chip maker Conextant, and was found in more than two dozen models of HP laptops and tablets.
HP’s audio driver was released in 2015 with new diagnostic features. It used to detect a special key press and release. But it was poorly implemented and acted like a keylogger and was capturing every single keypress.
The later update made it even worse and it was started storing keystrokes to a log file stored locally on user’s system. It can be accessed at location: C:\Users\Public\MicTray.log.
The good thing was that log file is overwritten every time the computer is booted up.
This is the list of laptops and tablet affected by this keylogger:
- HP EliteBook 820 G3 Notebook PC
- HP EliteBook 828 G3 Notebook PC
- HP EliteBook 840 G3 Notebook PC
- HP EliteBook 848 G3 Notebook PC
- HP EliteBook 850 G3 Notebook PC
- HP ProBook 640 G2 Notebook PC
- HP ProBook 650 G2 Notebook PC
- HP ProBook 645 G2 Notebook PC
- HP ProBook 655 G2 Notebook PC
- HP ProBook 450 G3 Notebook PC
- HP ProBook 430 G3 Notebook PC
- HP ProBook 440 G3 Notebook PC
- HP ProBook 446 G3 Notebook PC
- HP ProBook 470 G3 Notebook PC
- HP ProBook 455 G3 Notebook PC
- HP EliteBook 725 G3 Notebook PC
- HP EliteBook 745 G3 Notebook PC
- HP EliteBook 755 G3 Notebook PC
- HP EliteBook 1030 G1 Notebook PC
- HP ZBook 15u G3 Mobile Workstation
- HP Elite x2 1012 G1 Tablet
- HP Elite x2 1012 G1 with Travel Keyboard
- HP Elite x2 1012 G1 Advanced Keyboard
- HP EliteBook Folio 1040 G3 Notebook PC
- HP ZBook 17 G3 Mobile Workstation
- HP ZBook 15 G3 Mobile Workstation
- HP ZBook Studio G3 Mobile Workstation
- HP EliteBook Folio G1 Notebook PC
If you are using any of these models, you should worry. If you have any other HP computer, you should check if your computer has a programC:\Windows\System32\MicTray64.exe or C:\Windows\System32\MicTray.exe installed. I recommend you to delete of rename the executable files until the update is available to fix so that no keystrokes are recorded anymore However, the special function keys will stop working.