Some HP laptops shipped with a keyboard driver from Synaptics in which a developer debugging feature was accidentally left enabled. The effect of this mistake is that the driver has built-in support for logging all keystrokes via WPP (a debugging tool that’s built into Windows).<\/p>\n
This sounds bad, really bad, but thankfully it’s not actually as bad as it sounds.<\/p>\n
<\/p>\n
The driver did not log keystrokes by default, it merely has the ability to do so. To enable the ‘feature’<\/em> (for want of a better word), you need to set a registry key, and only users with administrator access can do that. If you have administrator access, you have the power to install a keyboard logger anyway, so all this does is give malicious admins, (or malware that gets admin access) another alternative to do something they already had the power to do anyway.<\/p>\n It’s important to note that there’s absolutely no evidence of malice of any kind here. This really does look like a simply case of human error. IMO, Hanlon’s Razor<\/a> applies.<\/p>\n The security researcher who found this issue reported it to HP responsibly, and HP have released driver updates for affected models.<\/p>\n While owners of affected laptops shouldn’t set their proverbial hair on fire, it’s definitely not a good thing to have a pre-installed keylogger on your laptop, so definitely do update your drivers if you own an affected laptop!<\/p>\n This isn’t so much a single bug as a collection of similar bugs relating to the same spec.<\/p>\n The Simple Mail Transfer Protocol (SMTP<\/a>) is the protocol used to transport our emails around the world. SMTP is old, very old \u2014 in fact, it dates back to 1982, which is 7 years before Tim Berners Lee invented the world wide web.<\/p>\n Because SMTP is old, the spec only allows for the use of ASCII characters in the You might imagine that a specification so old would be well implemented by now, but that’s where you’d be wrong. What security researchers discovered is that lots of mail apps and web mail services have code that does a really bad job of processing RFC–1342-encoded mail headers. The mistakes, and their consequences, vary from app to app and from webmail service to webmail service, but in general, the most common problem is from-address spoofing leading to spam filter bypasses, but in a few cases, the result is cross site scripting or arbitrary code execution.<\/p>\n Sabri Haddouche, the security researcher behind this work, is maintaining a Google Docs spreadsheet outlining the current status of a whole load of common mail clients and webmail services \u2014 docs.google.com\/\u2026<\/a><\/p>\n Thankfully, for most people the only effect here will be spam filter bypasses, and they’ll get fixed over time with server and software updates. To figure out how you’re affected, check the Google doc for your mail software, and\/or webmail provider. Even if there’s no patch yet, if you’re only affected by spoofing, don’t panic, it’s not ideal, but it’s not a calamity.<\/p>\n Security Medium 1 \u2014 HP’s Accidental Keylogger Some HP laptops shipped with a keyboard driver from Synaptics in which a developer debugging feature was accidentally left enabled. The effect of this mistake is that the driver has built-in support for logging all keystrokes via WPP (a debugging tool that’s built into Windows). This sounds bad, […]<\/p>\n","protected":false},"author":4,"featured_media":13191,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[147],"tags":[2044,854,50,569],"class_list":["post-13841","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-posts","tag-keylogger","tag-mail","tag-security","tag-security-bits"],"jetpack_featured_media_url":"https:\/\/www.podfeet.com\/blog\/wp-content\/uploads\/2017\/10\/security_bits_logo_300px.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/13841","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/comments?post=13841"}],"version-history":[{"count":3,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/13841\/revisions"}],"predecessor-version":[{"id":13844,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/13841\/revisions\/13844"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media\/13191"}],"wp:attachment":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media?parent=13841"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/categories?post=13841"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/tags?post=13841"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Links<\/h4>\n
\n
Security Medium 2 \u2014 MailSploit<\/em><\/h3>\n
from<\/code> mail header. That’s a problem, because lots of people have names that contain non-ASCII characters (Irish names like Gr\u00e1inne, German surnames like M\u00fcller, etc.). To square that circle, an encoding scheme was developed to allow non-ASCII characters to be represented with ASCII strings. This scheme goes by the highly forgettable moniker RFC–1342, and was released way back in 1992. For example, you can use RFC–1342 to encode Gr\u00e1inne<\/code> as Gr=C3=A1inne<\/code>, and M\u00fcller<\/code> as M=C3=BCller<\/code>.<\/p>\nLinks<\/h4>\n
\n
Notable Security Updates<\/h3>\n
\n
Notable News<\/h3>\n
\n
\n
Suggested Reading<\/h3>\n
\n
\n
\n
\n
\n
\n
\n
Palate Cleansers \u2014 Bumper Christmas Edition<\/h3>\n
\n