Security researcher Michael Myng recently disclosed that the Synpatics touchpad driver SynTP.sys used in many HP and Compaq laptops and notebooks has the capability to log all keystrokes on the local machine if a registry change is made to the system.  HP reported that the kylogger was actually part of the debug trace functionality and has subsequently removed the key logging functionality the comes with enabling debugging via the registry switch.

This means that many such impacted HP and Compaq laptops could be modified to spy on employee activities or used by a malicious attacker to infiltrate the network security of an organization if access to the targetted machine’s registry is compromised.

HP released a security bulletin to its customers with little fanfare last November 7th, 2017.  Apparently, the patch to prevent this exploitation is being made available to the Windows update process.  The HP website lists both consumer and business workstation products that are impacted by this vulnerability.  HP and Compaq computers that do not have a Synaptics touch pad are likely not impacted by this discovery.

Corporate and personal HP and Compaq laptop users are encouraged to download updated firmware drivers from the HP website at https://support.hp.com/us-en/drivers

More details are available at http://www.zdnet.com/article/keylogger-uncovered-on-hundreds-of-hp-pcs/