Hacker News new | ask | show | jobs
by fancyfredbot 1203 days ago
Two customers with the same malware?
2 comments

It could also just be buggy firmware. I had an HP 4530s and anytime I quickly typed the sequence “oun”, the chrome developer tools would pop open (something low level was translating that sequence into F12).

Turns out this was a known issue and there was a bios update which specifically fixed it. https://forums.tomsguide.com/threads/f-keys-activate-from-ty...

I guess the BIOS is responsible for handling the conversion of some key sequences into extended ASCII, so plausible it could be buggy in this way (but not so plausible for the OP issue). The link doesn't seem to mention a BIOS update or acknowledge it as a known BIOS issue though?
The same malware called HP SuperDuperSmartThing™, of course. Laptop manufacturers tend to install a lot of shovelware, and one of them might prevent making "password" your password.
I recall another HP shovelware product acting as a keylogger a few years back...

Found it: https://www.bleepingcomputer.com/news/security/keylogger-fou...

> This file is registered to start via a Scheduled Task every time the user logs into his computer. According to modzero researchers, the file "monitors all keystrokes made by the user to capture and react to functions such as microphone mute/unmute keys/hotkeys."

I was in support at the time and can confirm 1-2-1 recording of all keystrokes to the file mentioned, utterly baffling.

Sounds like a rookie programmer making something that just worked and then not being able to go back and do it properly.

Remember programmers, sometimes it's better just not to complete the task at all than it is to end up with a keylogger that management won't give you time to remove.

There would probably be a few more users complaining if the responsible malware shipped with the laptop.