Hi @ll,

the WHQL-signed(!) Synaptics touchpad driver delivered via Windows Update
executes a rogue program C:\Program.exe with system privileges after its
installation.

The observed offending command line is
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe /NT /I

According to Microsofts security response team the vulnerable driver was
pulled from Windows Update.

Unfortunately (or should I write: of course) the drivers offered on
Synaptics web site have this silly bug too!


regards
Stefan Kanthak


PS: the following lines of the SYNPD.INF show the same silly bug:

| HKLM,Software\Microsoft\Windows\CurrentVersion\Run,SynTPEnh,0,"%16422%\%targetdir%\SynTPEnh.exe"
| HKLM,Software\Microsoft\Windows\CurrentVersion\Run,SynTPEnh,0x00020000,"%ProgramFiles%\%targetdir%\SynTPEnh.exe"
| HKR,Software\Synaptics\SynTPPlugIns\SynTP,Start,0x00020000,"%ProgramFiles%\%targetdir%\SynTPEnh /RegPlugIn"
| HKR,Software\Synaptics\SynTPEnh\PopupConfig,Pressure Graph,0x00020000,"%ProgramFiles%\%targetdir%\SynZMetr.exe"
| HKR,Software\Synaptics\SynTPEnh\PopupConfig,MoodPad,0x00020000,"%ProgramFiles%\%targetdir%\SynMood.exe"
|
HKR,Software\Synaptics\SynTPEnh\PlugInConfig\Defaults\2FingerGestures,ConfigID2RunApp,0x00020000,"%ProgramFiles%\%targetdir%\SynMood
.exe"
| HKR,Software\Synaptics\SynTPCpl,PracticeExe,0x00020000,"%ProgramFiles%\%targetdir%\Tutorial.exe"
| HKR,SOFTWARE\Synaptics\SynTPCpl\Controls\1Multifinger Gestures\1Two-Finger
Scrolling\Dialog\7Practice,ActionPath,0x00020000,"%ProgramFiles%\%targetdir%\Tutorial.exe"
|
HKR,SOFTWARE\Synaptics\SynTPCpl\Controls\2Scrolling\Dialog\94Practice,ActionPath,0x00020000,"%ProgramFiles%\%targetdir%\Tutorial.exe
"

    It's a shame that developers still dont know how to handle
    filenames containing spaces properly: you had 20 years time
    to learn that! And of course their QA hat the same time!

    Take a look at <http://support.microsoft.com/kb/2647300/de> and
    notice the screenshot of REGEDIT.EXE showing the contents of the
    registry key
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    OUCH!


Timeline
~~~~~~~~

2014-04-09    sent vulnerability report to Microsoft

2014-04-10    Microsoft asks for more log files

2014-04-10    sent log files to Microsoft

2014-04-11    MSRC 18931 case opened

2014-04-15    sent notice regarding MSKB 2647300

2014-05-08    Microsoft acknowledges vulnerability and pulls driver