Slashdot Mirror
Samsung Keylogger Stories a False Alarm
Trailrunner7 writes "The panic that arose yesterday about Samsung allegedly shipping laptops that contained a pre-installed keylogger turns out to have been a complete mistake after further investigation by security researchers and the company itself. In fact, the controversy was the result of a false positive from one commercial antimalware suite and nothing else. Several outlets reported on Wednesday that Samsung laptops had been found to contain a keylogger known as StarLogger right out of the box from the factory. However, upon closer inspection by security companies, the folder on the laptops that supposedly contained the malware was actually a directory that is part of Windows' multi-language support."
We believed someone who used a 3rd rate antivirus and didnt verify with a kernel debugger? FAIL on all our parts especially the "security researcher" who so thoroughly researched this one
The following fortune quote accompanied this story for me:
Disturbingly appropriate, considering the story is about people jumping all over a false assumption. But I'm constantly surprised at the number of times a Windows installation with full multilingual support trips anti-malware or anti-virus software. Don't these guys even use their MSDN subscriptions to get a full set of Windows installs to test against?
At least Slashdot has the journalistic ethics to post the follow-up. Good for them. I note that Network World is doing the same.
Yes, I said "journalistic" in the same sentence as "Slashdot." It's important.
Never attribute to malice that which can be explained by mere idiocy.
Even if they could, which I doubt, why would they want to bring extra attention to this when it'll just go away tomorrow?
My postings are informational and does not constitute legal advice. Act on it at your risk.
The earlier article quoted Samsung as admitting to placing the software on their computers to gather information. Either that part of the earlier story is false or the current one is. This is not good journalism.
I still hate the keylogging bastards that they are, and I want to see the whole company in jail...
But the original writer and now famous Security researcher is MSIA, CISSP, CISA ... That must say something no ?
what do you mean Security Certification are worthless ?
I believe you forgot LOL, SOL and GTFO.
Could? More like should.
The title of the article was not "Did Samsung install keylogger on its laptop computers?"
No, the title was "Samsung installs keylogger on its laptop computers", though it looks like they've updated it now to
"UPDATE: Samsung keylogger could be false alarm"
Great journalism there. Leap out of the gate screaming "keylogger!!!!" with zero fact checking, but later back off and say "oops we could be wrong"
Beauty is in the eye of the beerholder.
http://yro.slashdot.org/comments.pl?sid=2061772&cid=35672358
My wife has a Samsung R580 which is almost a year newer than the laptops the guy mentioned in the article. I was going to scan it with some decent rootkit programs (like f-secure blacklight or rootkit revealer) only to find out some of my favorites don't work with 64bit Win7. I wrote to the guy who wrote the article, asking about the name of the "commercial security scanner" he installed. He never replied back. I booted my wife's laptop into Linux last night using a Live CD, and performed some find commands for supporting files of the StarLogger program (which showed up in a google search). Nothing. I was thinking if this was true, hers was exempt because it was almost a year older. Turns out, I find out today, I did more research than this supposedly "phd security expert" had.
FLR
Inb4 all of the commenters from the previous Samsung article come in here and act like they didn't assume that the keylogger was real, didn't yell about how Samsung should/will be persecuted for this, and didn't ask for people to boytt Samsung ;)...
I always hear Slashdotters complaining about "moral panic" and complaining about the "idiots" who don't do their research before making claims... How is this any different? Really, it's no different. Is the level of "corporate hate" on Slashdot really that high as to exclude any common sense (apparently not so common) when dealing with a subject like this where it's impossible to tell whether he was right? He said he was right in the previous article, but why did you blindly trust him? All it takes for a simple, non-assuming comment is to add "If this is true," to the beginning of your comments. It isn't very hard and it doesn't make you look like an idiot when the entire reason you said those things turned out to be bullcrap.
"Our country is not nearly so overrun with the bigoted as it is overrun with the broadminded." -Archbishop Fulton Sheen
Turn on the TV. Go to any "News" site. Everything is designed to make you react in some way. They especially like to find the most "outraged" person and interview them. /., where is the outrage for things that matter?
It is a bit sad. People will freak out about stuff like this and demand action, yet your government erodes your rights and destroys your country a little bit more each day and the same people are quite.
Tell me
The tagline for VIPRE AntiVirus is 'Finally Antivirus Software That Won't Slow Down Your PC!'.
I guess we know why. Who wants to spend all those CPU cycles searching through binaries both in RAM and on disk, comparing them against a database of virus patterns, and performing advanced heuristics checks when it's so much easier to match directory names and call it a day?
From Samsung's comment at http://www.samsungtomorrow.com/1071 it seems that the security program used identified the folder as StarLogger based solely on the fact that the folder's name is SL for Slovene. Incredible.
My initial reaction was more along the lines of "That sounds unlikely" than "Burn them!".
My initial response was;
It's a Network World/IT World article, so its probably made up garbage that will be debunked within hours.
And look at that... it was. Shocking.
I have a friend who likes to sent me IT World articles. It's become a running joke how bad their articles are written. Well, a joke to me at least, he still thinks they are some sort of reputable news source for all things IT and that I am just 'picking on them'.
Everyone who left a comment decrying Samsung in the last article is just as much to blame. You give approval to such antics by your reaction.
Not to mention these gems:
I installed ... security software ... The scan found two instances of a commercial keylogger called StarLogger ... This key logger is completely undetectable ...
So, this program found something which couldn't be found. Check.
After an in-depth analysis of the laptop, my conclusion was that this software was installed by the manufacturer, Samsung. I removed the keylogger software, cleaned up the laptop
Removed the keylogger by removing the folder? Check.
I found the same StarLogger software in the c:\windows\SL folder of the new laptop. The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the years.
So, "false-positive proof." Good to know that your extensive experience running an anti-virus program has yielded perfect results. Don't worry about the fact that you don't actually know what you're talking about.
... logged incident 2101163379 with Samsung Support (SS). First, as Sony BMG did six years ago, the SS personnel denied ... SS changed its story ... SS personnel relented and escalated the incident ...
Can we claim Godwin here? I have a feeling Samsung Support doesn't refer to itself as the SS.
You obviously have some kind of agenda, Mohamed Hassan, MSIA, CISSP, CISA. I know now to never trust anything NetSec Consulting Corp does. Also, congrats on being an "adjunct professor of Information Systems in the School of Business at the University of Phoenix."
This is the Internet. You can say "fuck" here. - AC
"Mohamed Hassan, MSIA, CISSP, CISA is the founder of NetSec Consulting Corp, a firm that specializes in information security consulting services. He is a senior IT Security consultant and an adjunct professor of Information Systems in the School of Business at the University of Phoenix."
And is now the laughing-stock of the IT security world.
Nice job moron!
Removed the keylogger by removing the folder? Check
I'm guessing that by 'removing the keylogger', he meant 'let the anti-virus' software do its default recommended action'.
RETURN without GOSUB in line 1050
Is "One" the slovenian translation of the English word "Three"?
If you want to be seen, stand up. If you want to be heard, speak up. If you want to be respected, sit down and shut up.
John Graham-Cumming has an excellent, level-headed response to Mohamed Assan's entire "research."
Also confirmed at F-Secure.
Where did the quote come from? It came from an idiot, apparently. If it was true, only an idiot would admit to it. If it was not true, only an idiot would say it was. I tend to discount what idiots say, as should you.
All those who knew that this was obviously false when it was posted yesterday, raise your hands and link to your comments:
"This is not believable." Oh, and let me reiterate. Anyone who actually believed a company would do something like this, is a god damned moron. I mean seriously, what the fuck people?
The Streisand effect is generally associated with people doing something silly, realising their mistake and then trying to shut the door after the proverbial horse has bolted.
In this case, I think the thing most likely to invoke the Streisand effect would be if the blogger tried to cover up the whole sorry episode by trying to bully sites mentioning either the original article or the subsequent debunking. I reckon Samsung, OTOH, could sue the blogger with relatively little fear of Streisanding. As long as they didn't try to sue everyone else for reporting the story.