Samsung installs keylogger on its laptop computers

http://www.networkworld.com/newsletters/sec/2011/032811sec2.html

by pietrofmaggi • 15 years ago

489 202 15 years ago

mrcharles• 15 years ago

It would be interesting to hear from the HN community, people with Samsung laptops, if they've had this happen, or if they check now, if this keylogger is discovered.

tldnr• 15 years ago

I've got an R580, had a quick look in the Windows folder and can't see any SL folder.

dionysianstanza• 15 years ago

Currently on an R720 and I've no SL folder, either.

I've poked around various locations on the machine and run some scans with a number of different tools, but I've discovered nothing untoward, as yet.

My attestation is somewhat of an irrelevance, however, as I've no way of accurately replicating the environment in which Mr Hassan carried out his research. It looks as though I shall simply have to wait and see how this all plays out over the coming days.

infinity• 15 years ago

I have a Samsung Q210 Aura Seven, I could not find any folders called "SL" or any other suspicious things so far on the preinstalled Windows Vista.

ordinary• 15 years ago

NC10 here, nothing crazy on mine.

biot• 15 years ago

Given US law enforcement's use of surveillance on individuals with certain foreign ties, in order to faithfully replicate this it might require someone named "Mohamed" unfortunately.

po4• 15 years ago

Talk about burying the lede...

And what does he mean by "After the initial set up of the laptop"? What exactly did he do? Couldn't it just mean that the security software he is using to do the scan or the media he is using is infected? I just think this sounds fishy until he's verified it with a completely different set of tools.

codingthewheel4• 15 years ago

Not only that, but there are legit reasons to include a keylogger as part of a laptop build out. Every computer has, or should have, this kind of auditing capacity. The question is a) whether it's turned on by default and b) whether any information is being transmitted on the sly. In all likelihood, this was either some sort of mistake, or the keylogger is intended for use by the computer's owner -- not by Samsung.

EDIT: Sorry for scaring people. Listen, I HATE keyloggers and other invasive software. Here:

http://bit.ly/2U3iAH

My point was that I can see a legit need for low-level auditing by whoever owns the PC. Including such a package that's turned off by default, might be better than forcing a worried parent to sift through 12 keyloggers on Google, half of which are malware, a quarter of which don't work, in order to find out if her 12-year-old is composing YouTube dances and uploading them to 4chan.

unwind• 15 years ago

Why should my computer have auditing capability, without my explicit knowledge or me making the decision to put it there? Who is it good for?

allending• 15 years ago

Uhm. No.

IgorPartola• 15 years ago

Yeah, and your house should have cameras too. Just in case you are up to no good.

Xurinos3• 15 years ago

Hey guys, I disagree with codingthewheel's idea, too, but we need to get a little meta here:

His comment is not spam.

His comment caused discussion.

His comment is an opinion, not a false fact.

There are no personal attacks of any kind in his comment, and his language is fine.

His argument is simply unpopular.

None of your responses indicate any of the usual legitimate reasons for downvoting.

So why the downvotes? Do you really want HN to be an echo chamber instead of an arena of civil discussion?

Panoramix• 15 years ago

Please don't use URL shorteners.

rhizome2• 15 years ago

Nobody is scared, don't flatter yourself. Your attitude is simply invasive and pointy-haired. Couple that with using a URL-shortened blind link where you are supposedly establishing some kind of safe-computing credibility, and I can only LOL.

Worried parents?! Now you're really getting dangerous. I hope you think long and hard before having children if this is the kind of treatment you expect to give them. If you have a 12 year old who is already uploading "dances" (?) to YT/chans, you have much bigger problems than a computer or the internet (hint: mirror).

w1ntermute• 15 years ago

It's certainly not a sure thing, but given the poor track record for OEMs, the fact that this guy has a master's in an IT field, that it happened on 2 different model laptops, and that Network World chose to publish it, I'm inclined to believe him. After all, if he's done this "initial setup" on other laptops in the past and not detected this keylogger, Samsung probably has a part to play in this.

rexreed• 15 years ago

This is easy enough to verify, confirm, or deny independently. All you need is another security expert to come to the same conclusion, and it's confirmed. Likewise, another security expert can invalidate the conclusion just as easily. There's not much ambiguity in the outcome.

Maascamp2• 15 years ago

If you read the follow up article (linked to from the original) Samsung actually confirmed that they install the software.

piaskal2• 15 years ago

Link: http://www.networkworld.com/newsletters/sec/2011/040411sec1....

po4• 15 years ago

Someone confirmed that they install software to monitor some kind of usage data:

* When told that did not make sense, SS personnel relented and escalated the incident to one of the support supervisors.

The supervisor who spoke with me was not sure how this software ended up in the new laptop thus put me on hold. He confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."*

http://www.networkworld.com/newsletters/sec/2011/040411sec1....

Just playing devil's advocate here but I wouldn't trust a "support supervisor" to know what he's talking about. He could be talking about the task manager for all we know. He could be just saying whatever he thinks will make this dude get off the phone so he can go grab lunch.

jpablo• 15 years ago

This in no way compares to the Sony Rootkit fiasco. Even if the keylogger is still there I'll hardly doubt that Samsung installed it on purpose.

wladimir2• 15 years ago

He should have analyzed the SL configuration to see where the logged keystrokes are sent. That'd have been interesting to see. Now it's just guesswork.

Tyrannosaurs2• 15 years ago

It's an interesting one.

If it was Samsung's responsibility (big if at this stage obviously) then I'd actually be more scared if they didn't install it on purpose.

I get that large corporations intentionally do bad things for money but I kind of assume that they're competent enough that they don't accidentally let their master install for a new laptop get infected with a key logger. I'm not saying that I believe them to be completely competent, just that the level of cock ups I expect from them doesn't run to this.

For me if they did install it accidentally then that's worse than them installing it deliberately for some ill considered audit or support purpose.

lwhi10• 15 years ago

This for me, is the root of the problem.

I don't believe any corporation can be 'good' or 'evil'. Corporations are comprised of people - some of whom will choose to do 'bad things'.

Digital technology provides a huge amount of power to those who have access to it. People are necessarily subject to human emotions and motivations - some will choose to do things which place people at risk.

Transparency and division of power within an organisation needs to be set-up and maintained to prevent abuses from occurring .. but I'd imagine, in most cases the stage has already been set to allow this kind of thing to happen without a corporation's knowledge.

jpr• 15 years ago

> I kind of assume that they're competent

"Never attribute to malice that which is adequately explained by stupidity."

Derbasti• 15 years ago

Well, if this turns out to be true, no more Samsung in my family.

denysonique• 15 years ago

However, a scan result does not mean much, a full proof would be if he found the keystrokes actually logged in some file and/or being sent to somewhere.

Btw, I am typing this from a Samsung R510 laptop. Fortunetaly I don't use crappy windows. I run Gentoo Linux.

nopassrecover3• 15 years ago

"Fortunetaly (sic) I don't use crappy windows. I run Gentoo Linux."

A reasonable observation followed by a stupid effectively ad hominem attack. The reason your Linux PC is free from the Samsung keylogger (if it does exist) is only because there's little to no incentive to bother with attacking Linux users. Do you really believe Microsoft has spent billions in research and hiring the brightest minds in technology to create an inherently insecure OS, or is it more likely that the incredibly large userbase creates much greater incentives for security attacks?

notoem• 15 years ago

No, the reason his computer does not have the keylogger is because he installed an operating system other than the one it came with (assuming the story is accurate). Even if he had reinstalled Windows, he would not have it.

Bud• 15 years ago

Windows is not a man (or person), and therefore cannot possibly be the target of an "ad hominem" attack.

nettdata2• 15 years ago

Luckily, I'm using OS X, so I don't have anything as gauche as a keylogger to worry about.

I have a much classier Keyboard Concierge.

voidpointer2• 15 years ago

The fact that Macs are statistically less likely to be infected by malware does not mean they are immune. It just means, that most malware-authors are more interested in windows because of the larger number of potential victims.

(Who came up with the idea to spin the fact that Macs are less attractive to black-hats into Macs being more secure anyway?)

rjbond3rd2• 15 years ago

Gentoo is good but paranoid penguins prefer Linux From Scratch :)

jedsmith7• 15 years ago

Except for the teams of people patching software for security holes and issuing those updates automatically through a package manager?

hbz• 15 years ago

I wonder where it stores all this logged information. Despite a lot of references to the Sony rootkit, the author doesn't specifically call this a rootkit other than to say it's "completely undetectable" (not really). There's also mention of traces of the program being found in c:\windows\SL, which means its not very well hidden. More information is required.

GiraffeNecktie4• 15 years ago

I would have expected this to show up from many different sources. The fact that only one person is reporting this makes the story somewhat suspect. Surely he's not the only Samsung owner to run a malware scan.

pavel_lishin3• 15 years ago

> Surely he's not the only Samsung owner to run a malware scan.

On a machine he just bought, without installing anything else?

Besides, someone has to be first.

GiraffeNecktie4• 15 years ago

He noticed this back in February so I'd think that's a fairly long time to be the only report. A few other things bothered me about the article: the heavy handed reference to Sony's rootkit, as others noted, is inappropriate since the Sony rootkit was clearly a deliberate decision. In this case, the most we can say at this point in time is that he found a keylogger on a Samsung computer. Whether it was put there deliberately or not is unknown. Which leads to my further gripes with the headline (which flatly implies that it was deliberate), with the fact that he didn't retain the evidence but chose to write about it (which means noone can verify his findings), and with his apparent lack of curiousity about whether the keylogger was operational and where it might be sending its data.

JamieEi• 15 years ago

It seems much more likely that the AV exe that he is running is infected.

westbywest2• 15 years ago

He mentioned the models of Samsung laptops that he had access to. Perhaps someone on this HN thread could verify?

jgrahamc2• 15 years ago

Mohamed Hassan, MSIA, CISSP, CISA graduated from the Master of Science in Information Assurance (MSIA) program from Norwich University in 2009

Really bad way to start an article. Who cares about all these qualifications? Did he find a key logger and how did Samsung respond?

Unfortunately, they have decided to make us wait for the response. That seems really lame IMHO.

Lost_BiomedE• 15 years ago

I think it means that the author does/did not expect you to be the target audience. To you, an appeal to authority does not mean much, but for someone who does not have much technological knowledge, it may have some weight.

Maybe they were trying to pull views from yahoo finance or something?

jobu• 15 years ago

Perhaps he wasn't getting any response from Samsung, and posted this to prod them into action. Still this seems like a really terrible way to end an article:

In the next article, Mr Hassan discusses how Samsung responded to his discovery.

dkarl• 15 years ago

It was mentioned because the author of the column (M.E. Kabay) used to be a director of the same program at Norwich University that Hassan got his master's from, and as he said, "it is a pleasure to collaborate with an alumnus." Basically it's a shout-out to the university.

GiraffeNecktie4• 15 years ago

Somewhat ironic now that the whole story turns out, not only to be false, but the result of stunningly inept research. Yeay Norwich!

roc• 15 years ago

When I read the article there was a link directly to part 2 at the end of the first part.

http://www.networkworld.com/newsletters/sec/2011/040411sec1....

"He confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."

piaskal2• 15 years ago

If it's true I wonder if Samsung actually does that deliberately or were their production systems hit by some malware.

lell• 15 years ago

It's possible --- and the customer service manager he was talking to just said anything to get off the phone, even if it meant lying about something he didn't understand. Maybe he didn't even realize it would paint his company in a bad light.

albedoa2• 15 years ago

The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the years.

Thus, it is false-positive proof? Why wouldn't he test it against other tools? Why wouldn't he try to find out as much about this as you can before writing an accusatory article?

Further, why is he running a full-system security scan on a fresh installation of Windows? Is that normal? If this is a genuine accusation of wrongdoing, then I think that the actual sequence of events and his entire methodology should be disclosed.

drzaiusapelord2• 15 years ago

Wow, that's a lot of faith in the AV industry and definition based AV. Perhaps Mr. Security Consultant should realize the limitations of his tools and the importance of doing random samples. He seriously saw this on one laptop and is accusing Samsung of a conspiracy?

Not that I put anything above big multinational companies, but some due dilligance would be nice. I guess its all about selling ad impressions. Facts, accuracy, and responsibility come last.

capstone2• 15 years ago

He seriously saw this on one laptop and is accusing Samsung of a conspiracy?

He saw it on TWO laptops.

Not that I put anything above big multinational companies, but some due dilligance would be nice.

He called Samsung to report the issue and had Samsung supervisor confirm that keyloggers are knowingly installed on Samsung laptops in order to monitor usage.

sorbus• 15 years ago

> Further, why is he running a full-system security scan on a fresh installation of Windows? Is that normal?

If you're a bit paranoid or don't trust the manufacturer (with good reason, apparently) it makes perfect sense to run a scan on a fresh system after initial setup. It's probably not a normal thing to do - pausing all usage of the system to check it for malware - but it makes sense.

> the actual sequence of events and his entire methodology should be disclosed.

Eh, not really. We just need to run the same scans (using lots of different software) on other Samsung laptops, both the same and different models, and see if it detects the logger. If the logger is found, then he's right, if it's not than he's wrong (and probably it's his own software which is infected). His methodology only matters if no supporting evidence for infection is found.

albedoa2• 15 years ago

> If you're a bit paranoid or don't trust the manufacturer (with good reason, apparently) it makes perfect sense to run a scan on a fresh system after initial setup.

That's what I mean. If he had reason to not trust them, then he should share his reasoning. It would help us to understand why he was conducting a post-installation scan in the first place. It is not normal behavior otherwise.

> Eh, not really. We just need to run the same scans (using lots of different software) on other Samsung laptops, both the same and different models, and see if it detects the logger.

Very true. I meant that it would help us to maximize our success with duplicating his method, which would translate into a higher detection rate if the logger actually exists. If one isn't found, it would help us figure out why he might be seeing what he sees.

motters3• 15 years ago

It's a disappointing cliff-hanger ending. Without more information it's impossible to say whether this is just some malware accident or a deliberate policy by Samsung. I'm inclined to think that the former situation is more likely.

donohoe2• 15 years ago

The link to the part where someone from Samsung confirms they installed the keylogger so they could lern how people use the machines.

motters3• 15 years ago

Second part http://www.networkworld.com/newsletters/sec/2011/040411sec1....

loganlinn2• 15 years ago

Is there not a hole in this argument? Why wouldn't he first question the store at which he bought both of these Samsung laptops? This isn't solid evidence that the source of the keylogger is from the hardware manufacturer and is borderline defamation.

darkmethod• 15 years ago

The following line from the article in question leads me to believe that he did not purchase the second laptop from the same store.

"I returned that laptop to the store where I bought it and bought a higher Samsung model (R540) from another store."

I will wait for confirmation/proof in either direction before drawing any conclusion regarding possible "defamation" on the authors part.

loganlinn2• 15 years ago

Indeed, we shouldn't jump to any conclusions. My point was that the author appears to already have, especially given the article's title. There are lots of situations that could explain to origin of the malware (reseller, pre-installed bloatware, etc), but the author chose one.

Bo1020103• 15 years ago

This strikes me as dubious at best. I think a more likely explanation is that his detection software is flagging anything with the path "c:\windows\SL" as malware.

He says "This key logger is completely undetectable," which is clearly untrue (he has allegedly detected it).

If it's logging his keystrokes, it's either storing them locally or sending them off somewhere else, or both. If he's as qualified as he says, he should be able to find out which (find a file that increases in size after a lot of keystrokes, use Wireshark...).

mmazing• 15 years ago

Yeah, except Samsung admitted that they installed it in the followup article.

Bo1020103• 15 years ago

I stand corrected, and should have read the followup article.

I don't think the Samsung "confirmation" brings me to 50% confidence that Samsung actually was logging and capturing people's keystrokes, though.

I would still like to see what the keylogger is actually doing - storing, transmitting, what?

bennysaurus• 15 years ago

Uh no they didn't, this guy has said this is what he was told on a phone call. Samsung has not released a public statement saying this is what they actually do.

Without confirmation from anyone else that has a Samsung laptop (have just checked my brother's bought 2 months ago and found nothing) this really should be taken with a grain of salt.

BrandonM2• 15 years ago

> I think a more likely explanation is that his detection software is flagging anything with the path "c:\windows\SL" as malware.

"SL" stands for "Samsung Laptop," some manufacturer-specific software?

smiler• 15 years ago

You called it =)

Bo1020103• 15 years ago

According to http://www.f-secure.com/weblog/archives/00002133.html , the "SL" path thing was exactly right!

16s2• 15 years ago

Off-topic: I wrote a very primitive passive keystroke logger a few years ago (just to demonstrate how they work). I still have the source code and folks email me about it often:

https://github.com/16s/16k

My example is really trivial and it only works on Windows, but it works well and demonstrates the concept of passive keystroke logging. Unlike system wide hooks, passive logging just monitors the key states. Sort of like when you are playing a video game and press the 'P' key. The game pauses because it's monitoring the P key's state (up or down) and can tell when it changes. Extend that concept to the entire keyboard and you have a passive keystroke logger.

Passive loggers are more challenging to detect as well and they run just fine as a normal user (no need to be root).

Havoc• 15 years ago

Stumbled across the same function (GetAsyncKeyState) when I was a kid....mainly because I couldn't figure out hooks.

They are not difficult to detect though. Emulate an (obscure) keystroke, wait 5sec and do you own GetAsyncKeyState. If its cleared then another app pulled the keystate via GetAsyncKeyState.

barrkel• 15 years ago

A low-level keyboard hook (that's a specific kind of Windows hook) does not need root either. It still only monitors the session that the hooking app is running in the context of.

getsat4• 15 years ago

Just use SetWindowsHookEx() with WH_KEYBOARD_LL. Here's some ancient proof of concept code I wrote for detecting user activity (keyboard and mouse):

https://gist.github.com/a95f198292c9e453e054

This was originally to be used with malware that needs to run when the user is away from their workstation. You can access p->vkCode in KeyboardProc() to see which keys are pressed.

One interesting thing to note is that if you remove the invisible window/message pumping loop, the program behaves erratically when processing the low-level inputs. I never looked into this.

_b8r02• 15 years ago

This is really really easy to detect for malware analysts. One of the first things you look for in memory on a compromised system is hooking. Most rootkits use hooks at different levels to hide or monitor things.

Strangely, on a clean system most hooks tend to be from the Antivirus (usually hooking filesystem calls for on demand scans).

dotBen• 15 years ago

"Here's some ancient proof of concept code I wrote for detecting user activity .. This was originally to be used with malware that needs to run..."

Are you implying that you wrote malware?

burrows2• 15 years ago

This is a very naive implementation.

Better off using a keyboard hook or GetAsyncKeyState as someone suggested.

And if you want to write a 'real' implementation, you write a keyboard filter driver. Or hook NtUserGetAsyncKeyState.

16s2• 15 years ago

It does use GetAsyncKeyState. Did you not read the source code? It works extremely well too (with regard to accuracy). Try the pre-compiled binary.

// From the source code:

ks = GetAsyncKeyState( kiter->first );

derrida• 15 years ago

So, has ANYONE verified this independently yet?

rheide• 15 years ago

Could be any number of reasons for this. The store may have messed up and had its computers infected by a virus. Or Samsung itself. Or user error, like other people pointed out already.

What I would be interested to know is if the logger actually phones home, and if so, to where. That would give fairly conclusive proof if Samsung did it or someone else. If it's just logging stuff locally then what's the point? Maybe Samsung (if Samsung is indeed the culrpit) could claim it's for tech support reasons?

jedsmith7• 15 years ago

Am I the only one that wipes the OEM operating system as soon as I buy a computer? Even if I'm putting Windows right back on it?

I started doing it because of the crap they bundle in there, but this seems like an unintended good reason to do so as well.

wewyor3• 15 years ago

The only problem is that now you have to find a way to download the iso's from microsofts' servers to do it now because most laptop manufacturers only give recovery media that gives you all the crapware when you reinstall.

It wasn't that long ago that you got actual windows install media when you bought a computer.

Silhouette• 15 years ago

> It wasn't that long ago that you got actual windows install media when you bought a computer.

Oh, I'm afraid that was actually quite a long time ago.

However, the last time I checked, Microsoft did impose a condition that mostly affected laptop manufacturers, such that they were required to provide any genuine Windows customer with real Windows media on request, rather than just some not-quite-real-Windows recovery media. Is this no longer the case?

If that is still a requirement for installing OEM Windows on laptops for sale, maybe a campaign where a significant fraction of Samsung laptop customers suddenly started demanding real media would attract the attention of whatever fool thought this was a good idea. This is not mutually exclusive with an expensive class action lawsuit, of course. }:-)

kmfrk• 15 years ago

CS and engineering students should be able to obtain this for free through MSDNAA.

nikcub• 15 years ago

If you request an original copy from your retailer they have to (are supposed to) give it to you and can only charge you a fee for the media, which is usually $10-25.

This applies for the first few months, thereafter you can call Microsoft and within a few prompts they will send it out to you, often for free.

Should work in most countries, and is a bit of a backdoor way of getting original install disks.

There is also a way in the EU to get a free linux distro disk if you request it, which was part of the EU antitrust settlement but I can't remember what that was (all of these consumer rights features were part of one settlement or another)

donohoe2• 15 years ago

Yes. The majority of regular people would never do that, or even know where to start.

jamaicahest• 15 years ago

Unfortunately not just regular people. Last time a new employee was hired to my team, the teamlead said just give him this laptop previously used by an external consultant, don't bother formatting it or removing old profiles, just make sure it works. And we're the software development division in the company.

d2• 15 years ago

You may be. I'm an experienced software dev and I've never done that with any of our family's windows machines. That'll be changing.

anon1385• 15 years ago

http://www.networkworld.com/newsletters/sec/2011/040411sec1....

Samsung responds to installation of keylogger on its laptop computers

In other words, Samsung wanted to gather usage data without obtaining consent from laptop owners.

[…]

We contacted three public relations officers for Samsung for comment about this issue and gave them a week to send us their comments. No one from the company replied.

blinkingled3• 15 years ago

Thank heavens this was software based - now imagine if they shipped keyboard firmware with a built in keylogger! Who knows, may be some do - that would be nearly impossible to detect as they can encrypt it.

On a related note - My bank requires me to use a on-screen virtual keyboard to log into the online account. The keys of this virtual keyboard are randomly rearranged every time it is invoked. That could certainly beat keyloggers.

JakeSc• 15 years ago

Which bank? That is very smart. Is the virtual keyboard built into the website (i.e., Javascript)?

blinkingled3• 15 years ago

Citibank - you can try it here - http://www.online.citibank.co.in/ . AFAICT it is JavaScript based - don't see any plugin used on the login site.

brown9-2• 15 years ago

ING Direct has something similar for entering your PIN.

darren_• 15 years ago

You'd think so, but actually there exist keyloggers that take screenshots on mouseclicks, precisely to bypass this.

blinkingled3• 15 years ago

Of course :) On the other hand, security is about putting as many deterrents as practically possible - nothing can be 100% secure. So to that extent it is still better to have measures like on screen keyboard than not. And then even if you somehow perfected the on-screen keyboard to not give out screenshots - there is always browser based malware that can send your session or creds to the attacker without bothering about keylogging!

shrikant• 15 years ago

I've played around with a few, and imho most of the common ones easily available on public torrent trackers have the ability to take screenshots on mouseclicks, with a nice little animation pointing out where the mouse pointer was when the click event happened too.

'Keystroke' logs include text, pictures and even videos in these toolkits.

Basically if you've been taken over by keystroke logging malware, it'd be safest to assume that everything on the machine's been compromised.

naner• 15 years ago

My bank requires me to use a on-screen virtual keyboard to log into the online account.

That is ridiculous.

jrockway• 15 years ago

But cheaper than sending each user a $1 SecurID token.

sedachv2• 15 years ago

This is why the insistence of people like RMS and Theo de Raadt on completely open firmware and drivers is important.

Binary blob drivers aren't "convenient," they are a violation of your privacy.

The ACPI and EFI firmware interfaces in newer PCs are particularly bad in this respect.

listic• 15 years ago

Can you please explain in wihich respect ACPI and EFI is worse than BIOS ?

jgrahamc2• 15 years ago

Samsung's response is here: http://www.networkworld.com/newsletters/sec/2011/040411sec1....

kwis• 15 years ago

Well, this rules out my plan to buy a Series 9 for travel.

Hopefully the supervisor he talked to was just blowing smoke and trying to get him to go away. If this is legitimately approved by Samsung, somebody needs their head examined.

Or failing that, they should loan me their laptop after they've done some banking and online shopping on it.

pbhjpbhj2• 15 years ago

That's kinda mind blowing.

Use of such a laptop in the UK would appear to contravene the Computer Misuse Act (on at least a count of unauthorised computer access), if you have a Samsung with this software I suggest you hire a good lawyer and shop around for investment opportunities for your payout.

What are the chances that Samsung have also breached government secrets acts with this in several countries!?

jedsmith7• 15 years ago

What's mind blowing is that anybody believes what a support department says.

motters3• 15 years ago

The second part is more interesting, but it doesn't give any indication as to whether the keylogger was installed on a small number of internal test machines which then accidentally escaped into consumerland, or whether this is a more widespread practice. If it is widespread then Samsung are really entering a world of pain in terms of lawsuits.

narrator• 15 years ago

This isn't the first time Samsung did this kind of thing. On their android phones, they have a system called CarrierIQ that is deeply embedded into the system and can monitor practically all aspects of phone usage.

http://forum.xda-developers.com/showpost.php?p=11763089

tikna2• 15 years ago

If you think logically, why they would even do that? What can they get out of logged data. Can you give me the answer?

I think you are exaggerating this thing too much.

bbommarito• 15 years ago

Let me pull on a conspiracy theorists hat here, and give one possible reason:

When you purchase a laptop, at least in my experience, it records the serial number of the laptop purchased. Now, generally you don't purchase a laptop in cash (At least in the states, but that really has to do with overzealous cops who think anything over a hundred dollars is drug money), you use a credit/check card. What this means is at checkout they have an address, and name (From the card) and a serial number.

You go home, and type away, log in to Facebook, do whatever you normally do, all the while keylogger is running away in the background. NSA walks over to Samsung and says "Hey, can we get those keylogger results? Great, here's your million dollars", takes those, then sees that John Doe is searching for poison on Google. They run off, and arrest him.

Basically, that information would be NSA's wetdream.

Is this true? Probably not, but it's one possible motive.

unreal37• 15 years ago

I am skeptical this is true. Some phone tech support guy overseas is not official confirmation of official policy. I would like to see more widespread confirmation ('happened to me too!') before people start dumping on Samsung.

Also missing, evidence it was turned installed and running at bootup, evidence it was sending information anywhere. It should be fairly easy to use the laptop, connect to the internet, and see what data is sent to what server, owned by whom. THAT is evidence. These are just random unimportant files in some random directory until then.

helmut_hed• 15 years ago

Here's a plausible scenario under which Samsung is innocent:

1) Starlogger is part of the security software Hassan installed, and 2) The Samsung person he reached didn't know what he was talking about

I have no idea if this is really what happened, but consider:

Hassan says After the initial set up of the laptop, I installed licensed commercial security software and then ran a full system scan before installing any other software.

This could simply be an embarrassing mistake, compounded by the ignorance of some call center person... I'm waiting for confirmation from others with Samsung systems.

mulander2• 15 years ago

I own a HP laptop which recently had its mother board replaced. The machine came with an OEM installation of MS Windows Vista - I didn't reinstall / remove but I did lock out and changed the password for the 'Administrator' account. To my surprise when the laptop came back from repair (official HP on warranty repair) the Administrator account was unlocked and the recent activity on that account indicated that video files were being run recently from it.

I assume that they must have a way to unlock the account I just hope it's not a full time remote control like mentioned in this article. You can be sure of one thing - I will never buy from HP again.

MichaelGG• 15 years ago

You realise you can unlock/reset passwords just by booting a CD? Locked is just a small setting in a file on disk.

As far as playing video files, that seems like it might have been part of testing - making sure it can handle a tiny bit of stress.

mulander2• 15 years ago

By booting an OS from a CD - yes I knew about this. I just hope it isn't a built in 'unlock' utility.

If that was the case then OK. I also understand running things to check if they work - that's why I didn't make a problem out of it.

I am not OK in changing/running things on the machine without contacting the owner. This makes a user uncomfortable.

bigohms• 15 years ago

Does this mean a Samsung exec will get some jail time just like the Utah University student who did the same thing and changed his grades?

http://findarticles.com/p/articles/mi_qn4188/is_20070107/ai_...

azal• 15 years ago

It sucks when companies start to impose crapware on consumers and defend it as useful.

westbywest2• 15 years ago

"The statements that Samsung installs keylogger on R525 and R540 laptop computers are false.

"After investigating into this matter, it was found that the software installed was in fact Vipre, not the commerical keylogger called StarLogger. The confusion arose because Microsoft's Live Application multi-language support folder, 'SL' folder, was mistaken for StarLogger

"(Live Application is Microsoft's application which provides messenger, email, video, photo gallery functions. Depending on the language, under C:\windows folders 'SL' for Slovak, 'KO' for Korean, 'EN' for English are created.)"

http://www.samsungtomorrow.com/1071

tikna2• 15 years ago

I am trying to find "Mohamed Hassan" on Internet. Now there is a doubt in my mind that he is even a real person?

mooky• 15 years ago

One user reporting an incident does not a story make. Lazy journalism.

Also: a possible publicity attack from someone who has just started up a security consultancy... But this could rebound on him due to his EXTREMELY sloppy work and total lack of forensic skill.

Samsung installs keylogger on its laptop computers

Related Stories