Windows 10: MicTray64 keylogger issue fixed in latest Conexant ISST Audio drivers?

Does anyone know if the latest Conexant ISST Audio Driver, created 25 Jan 2019 and released by HP 12 Feb 2019 (as well as earlier updates) has REMOVED the accidental keylogger? I just bought a nice used HP Elitebook 840 G3 and downloaded the 12 Feb 2019 driver directly from HP (overwriting whatever was there) and checked that it Is in fact the one now shown in Device Manager, and installed today (Properties).

I checked C:\Users\Public\ and there is NO MicTray.log

Problem or not?

:)

 

HP Accidentally Ships Laptop Audio Driver With Keylogger Installed

"Over the past few years, we’ve seen some high profile security problems with laptops from Lenovo, Samsung, and Dell. HP, up until now, had managed to escape any serious issues. According to the Swiss infosec company ModZero, that’s changed, courtesy of a keylogger embedded (probably accidentally) into certain audio drivers used on HP laptops.

HP uses Conexant audio chips for some of its laptops, which means it also ships Conexant’s included software and drivers. Here’s how ModZero describes the problem:"

"Conexant also develops drivers for its audio chips, so that the operating system is able to communicate with the hardware. Apparently, there are some parts for the control of the audio hardware, which are very specific and depend on the computer model – for example special keys for turning on or off a microphone or controlling the recording LED on the computer. In this code, which seems to be tailored to HP computers, there is a part that intercepts and processes all keyboard input.​
Actually, the purpose of the software is to recognize whether a special key has been pressed or released. Instead, however, the developer has introduced a number of diagnostic and debugging features to ensure that all keystrokes are either broadcast through a debugging interface or written to a log file in a public directory on the hard-drive.​
This type of debugging turns the audio driver effectively into a keylogging spyware. On the basis of meta-information of the files, this keylogger has already existed on HP computers since at least Christmas 2015."
​"The keylogger is created by flaws in Conexant’s MicTray64.exe application. It’s designed to monitor keystrokes and respond to user input, probably to respond to commands to mute or unmute the microphone, or begin capturing information within an application. Unfortunately, it also writes out all keystroke data into a publicly accessible file located at C:\Users\Public\MicTray.log. In the event that this log file does not exist, the keystrokes are passed to the OutputDebugString API, allowing any process to capture this information without being identified as a malicious program."




Conexant doesn’t list “Surprise keylogger” as any of its features.

"This behavior appears to have been introduced with version 1.0.0.46 of MicTray64. ModZero has also provided pseudo-code showing how the MicTray64 application captures data and outputs it to a log file or allows it to be captured, that information is available here.

Any application running in a user session that can monitor debug messages could be modified to log keystroke information based on the way MicTray64 is implemented. There’s no explanation for why Conexant implemented this function in such fashion and the ModZero team doesn’t think it’s intentional. But there’s also no way to fix the issue at this point in time, apart from possibly uninstalling all audio software from the system. Deleting the MicTray64.exe application would seem to work, but this could result in a non-functional microphone.

For now, ModZero recommends that users check for and delete or rename the MicTray64 and MicTray applications (located at C:\Windows\System32\). If you aren’t comfortable accessing protected file space within Windows, ask someone for help — mucking around in the System32 directory without knowing what you’re doing can destroy your OS installation.

HP, to date, has not released any information on how they intend to resolve this issue or made any public comment."

HP Accidentally Ships Laptop Audio Driver With Keylogger Installed - ExtremeTech

 

Conexant ISST audio drivers uninstall after updates to Windows 10

Hi,

I have a 3 month old HP Spectre x360 that came with Windows 10. Every time there is an update which requires a restart (for Windows 10, iTunes or what have you), my audio drivers (Conexant ISST audio) are uninstalled. I have to manually go into Device Manager,
update driver, and choose from a driver installed on my computer to get the driver to work again (after yet another restart). I have tried uninstalling the driver and then restarting the computer, but this (like the device manager option) is only a temporary
fix. Every new update and restart uninstalls the audio drivers again. While the temporary fix has worked every time (so far) it is getting annoying and I would greatly appreciate some advice on a permanent fix.

 

Conexant ISST audio drivers uninstall after updates to Windows 10

I got the same issue with the HP Elitepad 1030 G1.

Windows is up to date, as are all the softpaqs.

Every update, the audio drivers stop working (Connexant ISST 9.0.67.0)

Any update to this issue?