Slashdot Mirror
Samsung Plants Keyloggers On Laptops
Saint Aardvark writes "Mohammed Hassan writes in Network World that he found a keylogger program installed on his brand-new laptop — not once, but twice. After initial denials, Samsung has admitted they did this, saying it was to 'monitor the performance of the machine and to find out how it is being used.' As Hassan says, 'In other words, Samsung wanted to gather usage data without obtaining consent from laptop owners.' Three PR officers from Samsung have so far refused comment."
Worst idea since Sony's rootkit. They should be prosecuted over crap like this.
Samsung's legal and PR departments need to get ready for the shitstorm that is sure to come...
Eating the brains of your enemies does not make you smarter. But it's still fun.
But Samsung logged it :(
The public exposure of this software keylogger which could be somewhat easily discovered by a general user is the decoy for the hundreds and thousands of idiosyncratic hardware exploits which are available on nearly all systems.
Those who designed the room sized adding machines knew the exploits and limitations of those. When room sized adding machines became room sized programmatic machines those who oversaw the development and migration knew the limitations and exploits of those. When room sized programmatic machines began to approach table sized microcomputers those who oversaw the development and migration knew the limitations and exploits of those. When table sized microcomputers developed external storage devices then those who oversaw the development and integration knew the limitations and exploits in those.
The obvious has escaped the notice of the overall computing community.
the NPG electrode was replaced with carbon blac
hello
I would like to state that I have quite found a reasonable explaination for said matter and would like to praise Samsung Inc. for their bravery and courage as well as their quality product line. I can not wait to buy another Samsung product, it fills me with a great pride to own such a quality hardware.
--
Sent from my Samsung laptop
of why one should ALWAYS wipe the hard drive of a new machine and install a clean copy of Windows (or Linux).
Let them know their behavior isn't appropriate. Don't buy their product, and let everyone you know why you don't recommend buying their product.
ELOI, ELOI, LAMA SABACHTHANI!?
If this is true then in the United Kingdom at least this is a criminal offence. It's a violation of the Regulation of Investigatory Powers Act and possibly the Computer Misuse Act. The fact that it's hidden deep in some EULA wouldn't fly, unless they made a deliberate effort to ensure users were aware.
I'm surprised that Mr Hassan, having no fewer than 13 letters' worth of titles and certifications after his name, doesn't do what many informed users do immediately upon purchasing a Windows laptop: immediately format the HD and do a fresh installation of the OS. His discovery of a keylogger is yet more evidence of the necessity of doing so.
I had a longer comment, but my machine crashed before I was able to submit. Just read it back at http://logger.samsung.com/mhassan/20110330log.txt
They can put anything they darn well please into the EULA, it doesn't guarantee it to be binding or legally enforceable.
They could sneak a line in somewhere in the middle of page 28 of 45 that says by using this software you're required to send them a check for $500. It would be very hard to enforce.
The practice of installing hidden software like that already has been condemned by the FTC. (from TFA: In the words of the of former FTC chairman Deborah Platt Majoras, "Installations of secret software that create security risks are intrusive and unlawful." (FTC, 2007).) So they're probably going to get hammered on this. And rightfully so.
Usually when their legal department refuses to reply when you're requesting comments before someone goes public, it's because they're busy batoning down the hatches and polishing up their resumes.
I work for the Department of Redundancy Department.
If you don't get outraged when outrageous stuff happens, then don't be surprised when more outrageous things happen. It's your own damn fault for not standing up for what's right.
There's no -1 for "I don't get it."
A quick search didn't turn up any other reports of this besides discussion pointing back to the linked Network World article. Considering it seems very easy to detect (an SL folder in the main windows directory, accompanied by an automatic uninstall program?) it seems like people wouldn't have any trouble finding it if it is there. Anyone have any confirmation? Anyone besides Mr. Hassan finding this on their new Samsung?
Whoever approved this needs some jail time. Merely a fine for the "corporate person" guilty of this would just mean this sort of thing will continue if there's a chance of profitability.
How do you recommend we install a clean copy of Windows, short of buying your own copy for $189.00? PC manufacturers don't even include a "recovery disk" any more, let alone a copy of the OS you just bought and paid for. Not that I disagree with you at all, but the average consumer isn't going to buy their PC for $500-1200, and then cough up $200 for a clean copy of the OS, and then another couple hundred to find someone to wipe and install it for them.
He put his boots up on the table and made a face. "The sig," he smirked. "You can waste your life in search of the sig."
Is Samsung now a NORTH Korean company?
I will create a sig when innovation restarts in the U.S.
http://fearthegovernment.com/keystroke_logger.html
i looked at the date... March 31st. so close.
so now i'm not sure whether to believe this or not.
i'm'a gonna watch and see if anybody else in the world of Samsung laptops finds the same thing. i'm sure many are searching for it now.
I get the feeling that my disabling all those update services that my HP and Toshiba laptops are bundled with can be justified better now. It's not just a performance issue anymore, but a security one. How much longer till others come forward and admit they've been doing the same?
I've never fresh installed a new laptop on purchase day unless other than for business purposes, but this is getting scary.
batoning down the hatches
It's "battening down the hatches", though you might legitimately feel the urge to baton Samsung right now.
Maybe the laptop the BP lost with personal information from thousands of people who've filed claims related to the Deepwater Horizon disaster was a Samsung. Just wait for someone to connect it to the internet.... voila. See? It's a FEATURE.
any other sources on this, it seems an incredibly stupid thing to do for a non-microsoft company.
http://forum.xda-developers.com/showpost.php?p=11763089&postcount=3
How many times do companies have to beat it in to your head? You don't *own* the hardware you buy. Therefore they don't need your permission, and any attempt to circumvent it is illegal!
Consent implies the person giving consent is aware of what they are agreeing to. If I mumble, "if you ask me 'what?', you agree to immediately pay me a million dollars", and you ask me, "what?", that does not mean you actually agreed to pay me a million dollars.
"Meh, corruption isn't news, stfu" == "give me more corruption", in the end.
If you don't get upset over these sort of things, you just invite more. Sure, making a fuss won't necessarily stop it from happening again, but remaining silent certainly won't.
I'll try.
Does Samsung have some sort of mass key-logger analysis software that can correlate keystrokes with arbitrary activity? How else would they make use of thousands or potentially millions of key-logger streams? If so, from whom did they get it? The most plausible source of a key-logger analysis system is either a criminal outfit or an "intelligence" organization (assuming you draw distinction between the two.)
Is it possible that the tech support guy just made up this 'monitor the performance of the machine and to find out how it is being used' stuff because they routinely use that excuse for other things, it sounds plausible and might seem to him to be less heinous than 'we shipped an infected operating system'?
Given Sony you have to discount the latter.
Maw! Fire up the karma burner!
There's no need to choose between boycotting the manufacturer and criminal prosecution. Both are available to all of us and both should be used.
"The computers have already sold" makes it sound like future sales with keyloggers are impossible. Samsung is not the only organization who can do this either.
Digital Citizen
OK - we have a keylogger that is plainly visible in the windows directory on his machine and.... that's it. Where is the rest of the evidence? It phones home - I presume he has wireshark traces in the acticle with IP addresses that are owned by Samsung.... Nope. Any network traces showing the activity? .... Nope. Naturally he bought another laptop and, without attaching it to any network, discovered the same keylogger.... Nope. Now he has announced this lots of people have looked at their Samsung laptops and found the keylogger... Nope.
But wait - he has the admission of the company itself! Well, actually, a junior helpdesk driod who probably had no idea what he was actually talking about and was just agreeing with him to get him off the phone. Because the alternative is that every junior helpdesk droid in Samsung knows about the highly illegal secret keylogger that is install on every laptop, but none of them thought "I'm tired of being a helpdesk droid, I think a class action suit is a better way of making a living".
There is also nonsense statements - "the keylogger is completely undetectable": Really? Apart from the c:/windows/SL directory, the entries in the registry and everything else that will make any sensible AV product go beserk that is.
You think that's bad? Google were setting their analytics cookie to expire after *38 years* without seeking the surfer's permission They only backtracked when they got busted....
I was just talking to my wife last night about how I liked Samsung products. Its getting harder to find anything from a company that Hasn't fucked its customers somehow.
Installing a keylogger that also does screen captures to "monitor the performance" of their laptops would be like a homebuilder installing secret video cameras all over your house that relay the pictures back to him telling you he needs to "monitor the performance" of the house.
He's got a Muslim name, so it's ok to have a keylogger on his machine.
"Samsung takes Mr. Hassan's claims very seriously. After learning of the original post this morning on NetworkWorld.com, we launched an internal investigation into this issue. We will provide further information as soon as it is available." posted here
So, how many bank passwords did they capture and do they have a complete audit trail of everyone who may have accessed that data? Did any of those laptops get sold to government?
This was a seriously stupid move on their part, do they give the same amount of "thought" to their other engineering decisions?
Ya, they're only selling commodity hardware for the most part. Why buy anything from a company I now know to be untrustworthy?
It seems like it was relatively easy to find, and both laptops were purchased at the same store so it could easily be the source, some kid in the stock room could have installed it thinking they could steal someones identity or that it made them 'leet' hackers. Taking the admittance from a customer support rep is not reliable, so I don't really count that one. Also, new computers come with various pieces of crapware installed that could also be the source without Samsung being aware(if that is the case, they need to screen the software better). I seriously doubt this was intentional on Samsung's side, if they are even responsible to begin with. It is even quite possible that the keylogger was part of debugging and QA that made it into the production image. Would like to see more data on this, at least try and capture it phoning home. That would tell you a lot about who the responsible party is.
Network World should have at least done the due diligence of purchasing the same model and verifying the existence of the logger, and considering they are networking magazine, I am surprised they didn't test to see where the data is going.
http://en.wikipedia.org/wiki/First_Amendment_to_the_United_States_Constitution
From Engadget 'official quote: "Samsung takes Mr. Hassan's claims very seriously. After learning of the original post this morning on NetworkWorld.com, we launched an internal investigation into this issue. We will provide further information as soon as it is available."' http://www.engadget.com/2011/03/30/samsung-reportedly-installing-keylogger-software-on-r525-privac/
Pick one, you retard. "Literally" does not mean "here comes some hyperbole!"
Yes, yes it does. Despite what peevologists[1] claim, the use of "literally" as an intensifier dates back hundreds of years, and can be found in formal and academic writing as regularly as in casual speech. The American Heritage dictionary lists this as a "usage problem", but still lists it. Collier's lists it without comment. Note that the "usage problem" doesn't say it's wrong, it merely observes that this is something some people complain about.
Words often have multiple meanings in English. Do you jump up and call someone a retard because they use "cool" to mean something other than "has a low temperature"? If not, why not? It would be no less silly.
If you want to complain about the ambiguity, don't worry. Linguists who have studied the use of "literally" have found that it's almost never used in ambiguous contexts. Nobody (not even you, no matter how much you might pretend) thought for a second that GPP actually meant that his testicles would be expelled via his anus. People naturally avoid the ambiguous cases.
And if it's not the ambiguity that bugs you, then why on earth does it bother you any more than the uses of "cool" or "hot" to refer to something other than temperature? I really am curious.
[1] I prefer the term "peevologist" to the term "grammar nazi" because the latter term implies that the peevers actually know something about the language they claim to defend, even though this is usually not the case, as here.
What a bunch of fucknuts!
Yeah you did! They've got the keylog to prove it!
Forget what you wrote? We back it up wholesale!
If Google really cared they would fix Android Chrome to reflow text, instead of discriminating
I mean, literally, unbelievable. I do not believe it. And anyone else who believes it without some proof apart from what this dude says, is a god damned moron. Apparently that's most of the people in this thread.
(The fact that someone at Samsung seems to have "confirmed" it just means that someone got hold of an idiot somewhere and he said some stupid crap, probably without even understanding what he was saying.)
I thought of this - I also thought that the guy might have been under scrutiny by said criminal/intelligence outfit, and the "tech support" call might have been routed to a nice guy in an unmarked van.
That said, based on my experience in the corporate world, I'm blaming Marketing. It's almost always Marketing when something embarrassing and stupid happens.
Learn about Photography Basics.
How much you wanna bet someone very high up at Samsung, upon seeing this story hit the 'net, snatched up the phone, dialed up a memorized phone number, and feverishly whispered to the high mucky muck at the Department of Homeland Security that the deal was off....
*** *** You're just jealous 'cause the voices talk to me... ***
Thanks. Obvious fake is obvious
Microsoft should be saying "if you want the best possible OEM pricing, you are not allowed to do xyz" where xyz might be "knowingly install keyloggers, rootkits, spyware, or malware"
Nothing about this story even closely resembles the truth. He has no evidence? He doesn't know how to create a disk image or ask professionals for help documenting this?
Ok. Along with Sony, Samsung is now on my personal purchase blacklist. I just don't get it, do these guys think they'll get away with stuff like that? Have the marketing&management clowns that came up with and approved of this crap even considered what this does to the firms credibility? Have they an IQ that exceeds their shoesize? (rethorical question).
Timeo hominem unius libri
I browsed around a bit and found this thread in a forum: http://www.pctools.com/forum/archive/index.php/t-66173.html
In which Bianca150 last year posted that they had discovered Stealth KeyLogger 5.0 on a brand new Samsung laptop but assumed it was legit because you could download it from CNET!
Coincidence or corroboration?
Vik :v)
Does seem like a reasonable thing to do with a baton if your hatches are stuck, though...
Wow, just checked my Intercept and sure enough I have this spyware on my phone as well. It is everywhere. Trying to disassemble/reassemble everything like that poster to remove it now...
Apparently LG phones have this as well. How about the EVO line?
The economic consequences to the corporation would be vastly greater
As would the economic consequences to the poor sods who happen to work for it on minimum wage and whom had absolutely no part in the decision which caused the problem.
What about going after the shareholders instead? Levy a fine per share and allow shareholders the option of surrendering shares to cover the fine. Since it is often claimed that CEOs do all the creative accounting to make themselves look good to their shareholders perhaps making the shareholders suffer will help keep the CEOs inline.
This should also be coupled with a law to allow companies that are fined to break the contract of any company officer without penalty. This is so the shareholders are not prevented from going after the officers by clever employment contracts as seemed to happen with the bankers.
Hello 2008! Greetings from 2011!
So good to hear from you. It's been an eventful three years. Now, I mean, right exactly now, could you please tell Japan to shore up their nuclear reactors against the possibility of a 8.biggish tsunami? Also, that Hope and Change? Yeah, not so much...
(thanks and credit to XKCD)
He put his boots up on the table and made a face. "The sig," he smirked. "You can waste your life in search of the sig."
> ".... there should be a similar requirement for PC vendors to list all the bloat/crap/ad-ware they include on their products. "
Your PC already comes with such a list.
To see it, run this command:
dir c: /s /a
Place nail here >+
Our Great Leader Kim Jung Ill, has installed these key loggers to discover why citizens have not yet placed orders for the great leaders Galaxy Tablet, or downloaded the new apps of the great leader using a laptop with the key logger installed.
Thank you Samsung for implementing our great leaders wishes!
Ross Youngblood
The fact that it repeatedly happens in no way makes it an acceptable practice.
Complacency is losing, in this case. This is actually borderline data theft. Not borderline, it IS.
I know myself and millions of others that type their bank info into their computer. That goes into the wrong hands, and it's bad.
Acting like it's an accepted practice means you've accepted it as normal appropriate business acumen.
-- This space for lease, low setup fee, inquire within!
I have a Samsung monitor. Does this mean they watch the same kinky pr0n I do........I mean that my brother does?
Table-ized A.I.
"Okay so.. This Samsung Laptop is brand new.. It has Kaspersky for Anti-Virus and it detects four Keyloggers.. three Keyloggers are detected in Samsungs programs.. Samsung Support Center and two others"
http://answers.yahoo.com/question/index?qid=20101225135730AA0V8c6
saw this posted on samsung blog.
http://samsungtomorrow.com/1070
What they are saying is that the user was using security program called Vipre which reports \SL folder (slovenian language) created by Microsoft Live app as keylogger.
And another one:
"I literally just bought a new Samsung r540, guess its going back to newegg
Scary
UPDATE
Laptop has the SL directories and all affected files from the writeup
KEYLOGGER INSTALLED"
http://www.overclock.net/laptops-notebook-computers/978296-samsung-keylogger-confirmed-keylogger-installed-pics.html
And again. This guy says Samsung told him it came with the laptop. Dated 05-14-2010
http://www.pctools.com/forum/showthread.php?66173-Spyware-detects-stealth.keylogger-is-it-a-false-positive
http://samsungtomorrow.com/1070 What they say is (keylogger) . The claim that a keylogger is installed on Samsung notebooks is false. , Vipre . we found out that the person was using a security program (av) called Vipre. Microsoft Live Application "SL" keylogger . this program reports \SL folder created by Microsoft Live App as keylogger (Live Application Microsoft , , . c:\windows "SL" , "KO" , "EN" .)
something like this. If this claim is false, I see lawsuit the other way around.
And please no bashing on Koreans.
I purchased a Samsung RF710 a month ago, and am running the default OS install with zero problems. Sure, I scanned the machine, but it had almost NO crapware (as compared to HP and Gateway), and it has performed flawlessly. No key loggers or other problems. If anything, this has been the cleanest laptop I've every purchased. I wonder why Samsung did this? Has anyone other than the original author seen the same thing? It seems a strange move on Samsung's part.
All about me
See http://www.samsungtomorrow.com/1071, from RTFA link.
I think therefore I can't be ~TTNH
If you use a crap AV product such as VIPRE, which apparently cannot tell the difference between StarLogger keylogger, and a Slovenian language pack from Microsoft Live! you are destined to end up causing ridicule on /. homepage.
Samsung posted an explanation on a blog - http://www.samsungtomorrow.com/1071
"The confusion arose because VIPRE mistook Microsoft's Live Application multi-language support folder, "SL" folder, as StarLogger."
"(Depending on the language, under C:\windows folders "SL" for Slovene, "KO" for Korean, "EN" for English are created.)"
According to k0nane, it's on the Evo as well. Thanks for calling attention to the presence of CarrierIQ on LG.
Source: http://forum.androidcentral.com/lg-optimus-s-rooting-roms-hacks/64914-carrier-iq-4.html
That bit of German history is very cool, thaks.
If the final assembly and sale of a laptop is done in the US by a US company, then the government can hold the company responsible for making sure there are no rootkits, in software, firmware, or BIOS.
If you know how to "make sure", short of re-installing everything from scratch from trusted sources at the software, firmware, and BIOS level, you should patent it, publish some paper, and make a load of money out of it. I am pretty sure it can't be done in a general way. And what if you don't trust the company that wrote the firmware or drivers for a particular piece of hardware? Plan to re-write it yourself? And if you do re-install everything with trusted code, malicious hardware can still do whatever it wants, and the technology to detect it isn't there either.
The conclusion is that whoever put the backdoor there or knew about it is responsible (and should go to jail, be fined, etc as appropriate). But you cannot hold some random engineer accountable because he didn't spot the backdoor: bottom line is you can't spot backdoors in a reliable way.
but this seems like something that needs verification before we grab the torches and pitchforks.
This is slashdot! Put on your tin foil hat and grab your pitchfork like a good slashdottie now...
Samsung has denied it's installed keyloggers on the machines. It claims Hassan's security software registered a false positive. http://www.pcpro.co.uk/news/366442/samsung-denies-installing-keyloggers-on-laptops
I'd rather baton down windows!
Just bought a new quantum computer, but I'm uncertain how it works.
I've been shopping laptops for a while and Samsung keeps popping onto my list because I really like their monitors. I cannot give this company another penny, now that I know they do this.
Even though I would have erased the hard drive, destroyed the partitions and probably installed LINUX on it after the sale...the moral implications are there. If they thought installing a keylogger was a good idea, what else have they done with their products? I'd rather not have to be the person to find out.
False positive from a rarely used AV package - detects the same thing in an empty folder on a clean machine.
http://www.f-secure.com/weblog/archives/00002133.html
if the code also included cc: RIAA, FBI, NSA...
this permission wasn't granted deep in the EULA boilerplate.
The more I read the more upset I am. There are now several different stories floating around about this.
Many sources are purporting that the Samsung Keylogger incident was a false alarm raised by an incompetent person. However, some of these sources are Samsung the company itself.
Two questions:
1. Why would Samsung self-implicate if they were innocent? According to the article, they did state to the author that they were complicit.
2. Why hasn't this been verified in a technically sound and competent manner? Most of the feedback I'm reading are a bunch of tweets and retweets either trying to create or destroy confidence in Samsung and/or in the story, with no technical backing and no apparent technical backGROUND. One dutch site takes hearsay for science and promotes itself as holding a definitive opinion. Etc.
IF it is true, here's what you do about that: tell everybody in every media you can about the incident. suggest that it would be wise to stop using or buying samsung computers as they are potential minefields of security nightmares and backdoors. tell everybody with samsung stock to sell samsung. don't buy it when the price dips -- just leave it alone. let them die miserable out in the cold -- teach companies a lesson not to do this to consumers.
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
No, no, no, you don't go to the ACCUSED as the source! Jesus. WTF... they already admitted complicity!
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
I don't work for Samsung but I am a fan of their products.
It seems this so called 'IT consultant' used a crap, rarely used AV product called VIPRE which caused a false-positive, mistaking a SLovenian language pack from Microsoft Live! with a keylogger called StarLogger (both use C:\windows\SL apparently.. jeez I'd hate to use such a poorly written AV package!)
Please refer to posts by Sophos NakedSecurity blog http://nakedsecurity.sophos.com/2011/03/30/samsung-intentionally-shipping-laptops-with-keyloggerspy-software/
and Samsung Tomorrow http://www.samsungtomorrow.com/1071
NOW, can we please restore the integrity of /. frontpage news with actual facts instead of fear and obsolete debunked information.
PS - where did this "IT Consultant" get his training from? back of a cereal carton???
I had been recommending Samsung laptops to people who asked me for advice after having a lot of good experiences with them... then they go and pull this BS?
Great way to alienate people, Samsung. No way I can give out recommendations now.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
'The supervisor .. confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."'
Hey fucking useless Slashdot editors... please update the summary so you don't continue to slander Samsung over this one guy's erroneous complaint.
I browsed around a bit and found this thread in a forum: http://www.pctools.com/forum/archive/index.php/t-66173.html
In which Bianca150 last year posted that they had discovered Stealth KeyLogger 5.0 on a brand new Samsung laptop but assumed it was legit because you could download it from CNET!
Hey, congrats on making a bad situation worse! If you had actually read that webpage, you'd discover that it too was a false-positive. Somebody's cheap AV found a single registry key that was created by the Atheros driver, and flagged it as belonging to a keylogger... a keylogger which, curiously, was missing all of its other registry keys and files.
FATMOUSE + YOU = FATMOUSE
FFS Editors, wake the hell up and update the summary.
This has been confirmed false by numerous sources.
Beauty is in the eye of the beerholder.
...looks like Samsung joins a long list of companies I refuse to buy from.
What do I know, I'm just an idiot, right?
Samsung 'keylogger' is a GFI VIPRE antivirus false-positive
Excerpt from link:
I’ve confirmed that the ‘keylogger’ that Samsung was accused of shipping with certain notebooks yesterday by NetworkWorld is, in fact, a false-positive result by GFI VIPRE antivirus software. Replicating the false-positive is easy simply create an empty folder called SL in the Windows folder and scan it.
Initial reports due to incompetence - there never was a rootkit: http://www.f-secure.com/weblog/archives/00002133.html
Things to remember: 1. Mohamed Hassan - Remember not to read his articles or believe any gossip he spreads. 2. NetSec Consulting Corp - Remember not to ever hire them or trust any of their findings. 3. Norwich University - Remember not to let my children attend that university. 4. University of Phoenix - Same as number 3, except that I already knew this. Is the University of Phoenix the only place he could become an adjunct professor? To top it off, his position is in the School of Business and not an engineering based tract.
Also, Samsung save the passwords, logins and personal data like backup service to their customers. They are so nice!