Keylogger discovered in hundreds of HP laptops
HP patches touchpad driver, but hackers could exploit flaw to spy on users
 
More than 450 HP laptop models have a keylogger hidden away in a driver, forcing HP to issue patches for the affected devices.
The keylogger, found in Synaptics' touchpad software, is disabled by default, but hackers could potentially enable it if they had access to a computer by elevating user privileges, said Michael Myng, the researcher who discovered the flaw.
Commericial workstations, consumer laptops and other HP products contain the flaw, including Spectre devices, Pavilion devices, ZBooks and others.
"A potential security vulnerability has been identified with certain versions of Synaptics touchpad drivers that impacts all Synaptics OEM partners," an HP statement on its security bulletin read.
"A party would need administrative privileges in order to take advantage of the vulnerability. Neither Synaptics nor HP has access to customer data as a result of this issue."
Myng discovered the issue when trying to control the backlighting of an HP keyboard, noticing a format string for a keylogger when looking through the keyboard driver. Unable to find an HP laptop to test his findings, he contacted HP directly.
"They replied terrificly [sic] fast, confirmed the presence of the keylogger (which actually was a debug trace) and released an update that removes the trace," he said.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
HP claims the keylogger in Synaptics' touchpad was created to debug errors. If activated however, a hacker could track every letter a laptop user typed.
Worth updating with a quick line - they say sorry and working on updating drivers with a patch, don't give people admin access in the meantime
A Synaptics spokesperson apologised for the error and advised users to change their admin settings to prevent anyone taking advantage of the flaw before it's fixed.
"Synaptics is working closely with our PC customers to update drivers and to deploy them to address security concerns," they said. "Synaptics also recommends using best practices by restricting admin access to any system as anyone with this level of access can potentially install malware or other anti-privacy software irrespective of whether the debug tool is on or off."
They added: "In our new normal of heightened concern for security and privacy, Synaptics would like to apologise for any concerns that our debug tool may have raised. We have a path to immediately address this issue and other security concerns should they arise."
A keylogger was also discovered in Synaptics subsidiary Conexant's audio drivers, also installed in HP laptops, back in May.
An HP spokesperson said: "HP was advised of an issue that exists with Synaptics' touchpad drivers that impacts all Synaptics OEM partners. HP uses Synaptics' touchpads in some of its mobile PCs and has worked with Synaptics to provide fixes to their error for impacted HP systems, available in the security bulletin on HP.com. HP has no access to customer data as a result of this issue."
Picture: HP Spectre x360/Credit: IT Pro
- 
 Manufacturers report millions in losses as downtime wreaks havoc on operations Manufacturers report millions in losses as downtime wreaks havoc on operationsNews UK manufacturers are losing up to £736 million every week due to downtime, according to new research, with outages lasting for several days on end. 
- 
 Microsoft gives OpenAI restructuring plans the green light Microsoft gives OpenAI restructuring plans the green lightNews The deal removes fundraising constraints and modifies Microsoft's rights to use OpenAI models and products 
- 
 Critical Dell Storage Manager flaws could let hackers access sensitive data – patch now Critical Dell Storage Manager flaws could let hackers access sensitive data – patch nowNews A trio of flaws in Dell Storage Manager has prompted a customer alert 
- 
 Blackpoint Cyber and NinjaOne partner to bolster MSP cybersecurity Blackpoint Cyber and NinjaOne partner to bolster MSP cybersecurityNews The collaboration combines Blackpoint Cyber’s MDR expertise with NinjaOne’s automated endpoint management platform 
- 
 Flaw in Lenovo’s customer service AI chatbot could let hackers run malicious code, breach networks Flaw in Lenovo’s customer service AI chatbot could let hackers run malicious code, breach networksNews Hackers abusing the Lenovo flaw could inject malicious code with just a single prompt 
- 
 Millions of Dell laptops are are at risk thanks to a Broadcom chip vulnerability – and more than 100 device models are impacted Millions of Dell laptops are are at risk thanks to a Broadcom chip vulnerability – and more than 100 device models are impactedNews Widely used in high-security environments, the PCs are vulnerable to attacks allowing the theft of sensitive data 
- 
 Industry welcomes the NCSC’s new Vulnerability Research Initiative – but does it go far enough? Industry welcomes the NCSC’s new Vulnerability Research Initiative – but does it go far enough?News The cybersecurity agency will work with external researchers to uncover potential security holes in hardware and software 
- 
 ‘The worst thing an employee could do’: Workers are covering up cyber attacks for fear of reprisal – here’s why that’s a huge problem ‘The worst thing an employee could do’: Workers are covering up cyber attacks for fear of reprisal – here’s why that’s a huge problemNews More than one-third of office workers say they wouldn’t tell their cybersecurity team if they thought they had been the victim of a cyber attack. 
- 
 ‘A huge national security risk’: Thousands of government laptops, tablets, and phones are missing and nowhere to be found ‘A huge national security risk’: Thousands of government laptops, tablets, and phones are missing and nowhere to be foundNews A freedom of information disclosure shows more than 2,000 government-issued phones, tablets, and laptops have been lost or stolen, prompting huge cybersecurity concerns. 
- 
 Hackers are targeting Ivanti VPN users again – here’s what you need to know Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.