Slashdot Mirror

← Back to Stories (view on slashdot.org)

Samsung Plants Keyloggers On Laptops

Posted by samzenpus on from the terrible-marketing-ideas dept.

Saint Aardvark writes "Mohammed Hassan writes in Network World that he found a keylogger program installed on his brand-new laptop — not once, but twice. After initial denials, Samsung has admitted they did this, saying it was to 'monitor the performance of the machine and to find out how it is being used.' As Hassan says, 'In other words, Samsung wanted to gather usage data without obtaining consent from laptop owners.' Three PR officers from Samsung have so far refused comment."

15 of 515 comments (clear)

  1. WTF? by Anonymous Coward · · Score: 5, Insightful

    Worst idea since Sony's rootkit. They should be prosecuted over crap like this.

    1. Re:WTF? by FlatEric521 · · Score: 5, Informative

      They should be prosecuted over crap like this.

      They will be. Sony got hit with tons of lawsuits, and they weren't using software that could steal your password. This just took corporate big brother behavior to a whole new level of invasive.

    2. Re:WTF? by lgw · · Score: 5, Interesting

      If you make a habit of punishing "the CEO", then "the CEO" will be a fall guy hired by whoever actually runs the company. Sony's rootkit got Sony threatened with ending the presence of Sony in America - while America may let corporations slide on many issues, actual espianage involving a foreign corporation and sensitive government data won't be ignored.

      Samsung should be very thankful that the US Government in general avoids foreign-built computers out of a strange fear that there might be keyloggoers or similar installed on them at the factory: an idea that many /.ers once dismissed as crazy paranoia, back when Thinkpad shifted to Lenovo.

      --
      Socialism: a lie told by totalitarians and believed by fools.
    3. Re:WTF? by erroneus · · Score: 5, Informative

      Oh please. Take it from me -- I work for an "American Company" that is completely owned by a Japanese company and is completely run by employees of that same Japanese company. It's a lie. It's a huge lie. It's a lie on the scale of saying "santa claus is real." It's clearly and obviously not the truth.

    4. Re:WTF? by number11 · · Score: 5, Interesting

      If you make a habit of punishing "the CEO", then "the CEO" will be a fall guy hired by whoever actually runs the company.

      True. What needs to be done is, find the corporation guilty, and give it 30 days. Now, 30 days in the slammer is only a slap on the wrist, as punishments go. And of course, you can't actually put the corporation in the local jail, but you can put it under "house arrest". Send the marshalls around to padlock their premises, and freeze their bank accounts for 30 days.

      The economic consequences to the corporation would be vastly greater than any fine that could be levied. But nobody worries about other criminals who won't be able to meet their financial commitments if they do a stretch in the workhouse, so why should we worry about that when it's a corporate "person"?

    5. Re:WTF? by Anonymous Coward · · Score: 5, Insightful

      Draconian solutions remind everyone of their personal responsibility. Rest assured that if investing in corporations that break the law came with actual monetary costs, pretty soon people would be avoiding the stocks of those corporations like the plague. And nothing of value would be lost.

    6. Re:WTF? by number11 · · Score: 5, Interesting

      How many innocent investors and employees are you willing to punish for the malicious actions of a few?

      They don't get "punished". Criminal behavior often hurts innocent bystanders, are you saying that somebody with a spouse and three kids should be exempt from jail because to jail them would hurt their dependents? Hell, the investors will be hurt if the corporation makes a marketing blunder, why not if the corporation commits a crime? Yes, it's unfortunate. Maybe we should give the investors and employees standing to sue the corporation for any damages they suffer.

      What if the company provides a vital service to its customers?

      What if I provide a vital service to my customers? Does that mean I should be exempt from jail?

    7. Re:WTF? by Pharmboy · · Score: 5, Insightful

      That isn't a bad thing. It means the company will have trouble attracting quality talent unless it develops a system and policy to NOT do things like install root kits on computers. If you work for a company that does bad things, and you pay a price, you might want to go work somewhere else, or risk paying that price.

      Is it "fair" to all the low level employees? Maybe not, but it will be effective in protecting the general public, which means it is worth the price, since it creates an incentive for companies to NOT be asshats and install root kits on devices.

      What is fair is that companies (and shareholders) pay a price for breaking the law. This is the only way you can pressure stockholders and employees to pressure their management to do business in a fair and honest way, by having a "price" for not doing so.

      --
      Tequila: It's not just for breakfast anymore!
    8. Re:WTF? by Anubis+IV · · Score: 5, Informative

      Wow. [citation needed] much? Let's go down the list, shall we?

      1) Not only can I find no evidence of a $500M figure ever having existed before your comment, but if they had made a settlement for a half billion dollars, Sony wouldn't exist today. Their operating income last year was just $342M (source). Fat chance that Sony could survive a $500M settlement hit. By all indications (i.e. because it's not mentioned in their annual filings from that year and there are no followup stories to be found), this did not impact their bottom line in any sort of meaningful way.

      2) As for what the settlement actually was, they paid up to $150-175 per customer that damaged their PC in an attempt to remove the rootkit (see here), plus $5.75M in settlements to various states (source). That's it. It probably cost them less than $10M to settle the whole thing.

      3) For a quick example of a company that can take a hit like the one you talked about, we all remember the Microsoft EU antitrust case from a few years back, right? The one regarding media players, where they were fined roughly $600M, and had followup fines of roughly $250M and $1.44B, all of which were extensively covered in the news since they were, at the time, the largest fines ever handed down by the EU (more info). But Microsoft was able to absorb the hit. Of course, they could do that since their operating income last year was about $24B (source), which is roughly 70x that of Sony's.

      4) As for your DOJ claims, I can't find anything about government computers being infected (though I wouldn't doubt it) or the DOJ being involved at all. In fact, they never got involved, despite the public outcry and requests that a criminal investigation be launched.

      Aside from government computers getting infected, is anything you said true, or are you just routinely off by a few orders of magnitude when quoting figures, as well as prone to making up stories that have little basis in fact?

  2. Stop it by MrEricSir · · Score: 5, Insightful

    If you don't get outraged when outrageous stuff happens, then don't be surprised when more outrageous things happen. It's your own damn fault for not standing up for what's right.

    --
    There's no -1 for "I don't get it."
  3. Only one case? by demonbug · · Score: 5, Insightful

    A quick search didn't turn up any other reports of this besides discussion pointing back to the linked Network World article. Considering it seems very easy to detect (an SL folder in the main windows directory, accompanied by an automatic uninstall program?) it seems like people wouldn't have any trouble finding it if it is there. Anyone have any confirmation? Anyone besides Mr. Hassan finding this on their new Samsung?

  4. And we do this how? by jeko · · Score: 5, Insightful

    How do you recommend we install a clean copy of Windows, short of buying your own copy for $189.00? PC manufacturers don't even include a "recovery disk" any more, let alone a copy of the OS you just bought and paid for. Not that I disagree with you at all, but the average consumer isn't going to buy their PC for $500-1200, and then cough up $200 for a clean copy of the OS, and then another couple hundred to find someone to wipe and install it for them.

    --
    He put his boots up on the table and made a face. "The sig," he smirked. "You can waste your life in search of the sig."
  5. Samsung and Sprint do this with Android phones too by chrisj_0 · · Score: 5, Informative

    http://forum.xda-developers.com/showpost.php?p=11763089&postcount=3

  6. Re:Oh say it isn't so... by node+3 · · Score: 5, Insightful

    "Meh, corruption isn't news, stfu" == "give me more corruption", in the end.

    If you don't get upset over these sort of things, you just invite more. Sure, making a fuss won't necessarily stop it from happening again, but remaining silent certainly won't.

  7. Extremely Sceptical by pmc · · Score: 5, Insightful

    OK - we have a keylogger that is plainly visible in the windows directory on his machine and.... that's it. Where is the rest of the evidence? It phones home - I presume he has wireshark traces in the acticle with IP addresses that are owned by Samsung.... Nope. Any network traces showing the activity? .... Nope. Naturally he bought another laptop and, without attaching it to any network, discovered the same keylogger.... Nope. Now he has announced this lots of people have looked at their Samsung laptops and found the keylogger... Nope.

    But wait - he has the admission of the company itself! Well, actually, a junior helpdesk driod who probably had no idea what he was actually talking about and was just agreeing with him to get him off the phone. Because the alternative is that every junior helpdesk droid in Samsung knows about the highly illegal secret keylogger that is install on every laptop, but none of them thought "I'm tired of being a helpdesk droid, I think a class action suit is a better way of making a living".

    There is also nonsense statements - "the keylogger is completely undetectable": Really? Apart from the c:/windows/SL directory, the entries in the registry and everything else that will make any sensible AV product go beserk that is.