Slashdot Mirror
Samsung Keylogger Stories a False Alarm
Trailrunner7 writes "The panic that arose yesterday about Samsung allegedly shipping laptops that contained a pre-installed keylogger turns out to have been a complete mistake after further investigation by security researchers and the company itself. In fact, the controversy was the result of a false positive from one commercial antimalware suite and nothing else. Several outlets reported on Wednesday that Samsung laptops had been found to contain a keylogger known as StarLogger right out of the box from the factory. However, upon closer inspection by security companies, the folder on the laptops that supposedly contained the malware was actually a directory that is part of Windows' multi-language support."
We believed someone who used a 3rd rate antivirus and didnt verify with a kernel debugger? FAIL on all our parts especially the "security researcher" who so thoroughly researched this one
The following fortune quote accompanied this story for me:
Disturbingly appropriate, considering the story is about people jumping all over a false assumption. But I'm constantly surprised at the number of times a Windows installation with full multilingual support trips anti-malware or anti-virus software. Don't these guys even use their MSDN subscriptions to get a full set of Windows installs to test against?
At least Slashdot has the journalistic ethics to post the follow-up. Good for them. I note that Network World is doing the same.
Yes, I said "journalistic" in the same sentence as "Slashdot." It's important.
Never attribute to malice that which can be explained by mere idiocy.
The earlier article quoted Samsung as admitting to placing the software on their computers to gather information. Either that part of the earlier story is false or the current one is. This is not good journalism.
Could? More like should.
The title of the article was not "Did Samsung install keylogger on its laptop computers?"
No, the title was "Samsung installs keylogger on its laptop computers", though it looks like they've updated it now to
"UPDATE: Samsung keylogger could be false alarm"
Great journalism there. Leap out of the gate screaming "keylogger!!!!" with zero fact checking, but later back off and say "oops we could be wrong"
Beauty is in the eye of the beerholder.
From Samsung's comment at http://www.samsungtomorrow.com/1071 it seems that the security program used identified the folder as StarLogger based solely on the fact that the folder's name is SL for Slovene. Incredible.
Everyone who left a comment decrying Samsung in the last article is just as much to blame. You give approval to such antics by your reaction.
Not to mention these gems:
I installed ... security software ... The scan found two instances of a commercial keylogger called StarLogger ... This key logger is completely undetectable ...
So, this program found something which couldn't be found. Check.
After an in-depth analysis of the laptop, my conclusion was that this software was installed by the manufacturer, Samsung. I removed the keylogger software, cleaned up the laptop
Removed the keylogger by removing the folder? Check.
I found the same StarLogger software in the c:\windows\SL folder of the new laptop. The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the years.
So, "false-positive proof." Good to know that your extensive experience running an anti-virus program has yielded perfect results. Don't worry about the fact that you don't actually know what you're talking about.
... logged incident 2101163379 with Samsung Support (SS). First, as Sony BMG did six years ago, the SS personnel denied ... SS changed its story ... SS personnel relented and escalated the incident ...
Can we claim Godwin here? I have a feeling Samsung Support doesn't refer to itself as the SS.
You obviously have some kind of agenda, Mohamed Hassan, MSIA, CISSP, CISA. I know now to never trust anything NetSec Consulting Corp does. Also, congrats on being an "adjunct professor of Information Systems in the School of Business at the University of Phoenix."
This is the Internet. You can say "fuck" here. - AC
And the 2010 Foot in Mouth award goes to...
The writer AND the "security researcher" both of whom put the credibility of their school, degree, and certifications at risk.
I sense two egos deflated for the better.
You should really included Slashdot community there as well, as we jumped on crucifying them based on no evidence whatsoever, just the word of a random blogger.
"Extraordinary claims require extraordinary evidence"
-- Carl Sagan