Samsung blames security software false positive for StarLogger issue.

http://www.tgdaily.com/security-features/55096-samsung-denies-preinstalling-spyware

by nickolai • 15 years ago

118 49 15 years ago

tgdaily.com

tikna• 15 years ago

Now Networkworld and Mr. Hassan should answer why they made such a baseless allegations?

Someone working in Security firm (NetSec Consulting) should have idea of they are saying.

ghaff2• 15 years ago

Assuming things are as they appear to be from the Samsung response (as, IMO, seems very likely), one of the things that strikes me here was that the "research" that a security "expert" conducted seems incredibly sloppy.

Did he actually look in the Windows/SL directory? Did he compare the contents to those that StarLogger actually installs (a trial version is available for download)? This seems like pretty basic stuff. Did he ask Microsoft what a Windows/SL directory might be?

dereg2• 15 years ago

This situation reminds me of the HBGary incident. This guy is actually paid to know what he's talking about, and he has no clue what he's talking about. And this isn't cake-making, it's security! Preposterous.

JeremyBanks• 15 years ago

I was curious, so I Googled their website.

http://www.nesecc.com/

Not impressed.

unreal37• 15 years ago

Thats his web site? OMG.

Best thing about that site: he charges $60 flat rate for virus removal.

http://www.nesecc.com/Flyer.htm

Damaging his reputation, that of his friend the writer, and of NetworkWorld: free.

_b8r0• 15 years ago

My guess is that Mr Hassan is an independent consultant, and NetSec Consulting is his contracting vehicle.

To be fair to him, Samsung did turn around and say, "Yeah we're keylogging, problem?" or words to that effect. If he's not a technical security consultant then that might be enough for him to go to the press (especially if he felt stiffed by Samsung).

Not all security roles are technical, not all consultants are either, it's entirely possible that he's a policy or risk kind of guy.

jerf2• 15 years ago

'To be fair to him, Samsung did turn around and say, "Yeah we're keylogging, problem?" or words to that effect.'

May I observe that the only reason we think that Samsung confirmed this is from the words of a source that is now appearing not to be trustworthy in the first place? If this "security consultant" couldn't verify the actual existence of a key logger in the first place, why do we trust him to accurately relay a conversation with support? I don't really accept it as fact that Samsung confirmed anything in particular at any point; the possibility that this guy heard what he wanted to hear is too significant to ignore.

bstar• 15 years ago

Not only that, but the guy continues to use the same install of windows after discovering the issue. He then has more issues with the laptop and returns it for ANOTHER Samsung.

First off, if I even remotely sense that there is malware on my machine it gets an immediate format. Second, why in Thor's name would you buy from Samsung again? I get the impression he's a guy with a little knowledge that thinks he has this whole computer thing figured out. If you are going to make these types of allegations and publish them, you have to approach it scientifically and verify your results.

trotsky• 15 years ago

Maybe I'm cynical, but I'm going to tend towards "guy becomes very unhappy with samsung for unknown reason, guy lies about keylogger".

Because I agree - if you were going to tend to make a big fuss about this (as I would) and I had determined it looked like Samsung installed the first one (as he claimed) in no way would I ever get samsung laptop #2. Not to mention, not even checking the contents of the directory before reporting it widely.

Pretty decent approach to tarnish their reputation too, if it happened that way. To get an estimate of reach, the HN story "Samsung installs keyloggers" currently has 477 votes - it seems quite unlikely the retraction will get that much exposure.

maukdaddy• 15 years ago

The security industry is full of quacks like this. In fact, I'd say the number of frauds and snake oil salesmen FAR outweigh the number of legitimate and intelligent security folks.

rhizome• 15 years ago

"Scare 'em and snare 'em."

Maakuth• 15 years ago

F-Secure didn't find it either, and hasn't seen a peak in StarLogger detections: http://www.f-secure.com/weblog/archives/00002132.html

nickolai2• 15 years ago

Next entry actually deals with this exact issue :

http://www.f-secure.com/weblog/archives/00002133.html http://news.ycombinator.com/item?id=2391289

It's even getting triggered by an empty SL folder apparently. Looks a lot like some sort of poor taste april fool's prank to me. Come on! A security warning from a folder name... _Really?_

minalecs• 15 years ago

If this is true, sadly the damage has already been done. How many people are going to think Samsung ships with a keylogger ?

fname• 15 years ago

Agreed and now Samsung may be the ones who lauch the lawsuit. Though, how many people will hire NetSec consulting after blindly following the output of security scanning software? I mean, did he even look in the SL folder?

dereg2• 15 years ago

The damage done to Samsung via this false accusation will far outweigh the costs borne by NetSec. I'm against frivolous lawsuits, but I wouldn't mind if Samsung delivered one his way.

reemrevnivek• 15 years ago

The scary thing is that this publicity might, somehow, be good for the security company.

dionysianstanza• 15 years ago

Mr Hassan's research, which appears to grow in tenuousness with each passing hour, was the sole basis for countless technology news articles that cited this alleged security issue yesterday.

To go public with such questionable supporting evidence seems unfathomable from someone who is, ostensibly, qualified enough to know better.

I sincerely hope any forthcoming apology and subsequent abjuration is given an equal amount of publicity.

ja27• 15 years ago

Well he did graduate from the Master of Science in Information Assurance (MSIA) program at Norwich University in 2009.

GiraffeNecktie• 15 years ago

Norwich is apparently a military college http://en.wikipedia.org/wiki/Norwich_University

billpg2• 15 years ago

I only took it seriously after I read that someone at Samsung had confirmed the presence of "auditing software". If it's not StarLogger, what was this person refering to?

ghaff2• 15 years ago

Even assuming that the conversation took place and was accurately recorded, I don't put a lot of credence in it. It's front-line tech support we're talking about here after all. Some guy has called them up and is trying to find out something about a Windows\SL directory and monitoring software and so forth and they just want him off the phone.

I've had plenty of nonsense spouted to me when a tech support person doesn't understand my problem or how to deal with it.

billpg2• 15 years ago

That's probably exactly what happened. They may have been thinking of the Samsung software updater that came installed on my NC10.

pbhjpbhj5• 15 years ago

>It's front-line tech support we're talking about here after all.

In the report it was second line and they consulted some other authority (manual, person, we don't know; could have lied) in order to provide an answer to the question of whether the keylogger was installed by Samsung.

Why do they want him off the phone, don't they get paid according to customer contact time? The longer he's on the phone the more money the company makes.

motters• 15 years ago

The moral of the tale here is that if you're going to be making allegations of this kind you really need to be quite confident about your research, and be able to back it up with detailed information such as the contents of the relevant directory and comparisons of the files therein. Not engaging in a certain amount of diligence leaves the journalist open to both reputational risk and the possibility of libel litigation.

pbhjpbhj5• 15 years ago

>"Not engaging in a certain amount of diligence leaves the journalist open to both reputational risk and the possibility of libel litigation."

// Samsung gave an authoritative answer via their senior support personnel corroborating the [false] positive report of an installed key-logger from a previously trustworthy system analysis tool. I'd say that was diligent.

I don't think Samsung can win a libel case against someone who published what they themselves confirmed to be the truth (despite this revelation that they in fact lied).

This does leave the possibility that the report that it was confirmed by senior support was fabricated; in which case a libel suit would be back on.

jarek2• 15 years ago

I don't run a security consultancy, but I'd have considered checking if another tool says anything. Or just looking in the directory using another OS to see what's actually in the dreaded C:\Windows\SL.

jarin• 15 years ago

Maybe a good followup article should be "Security Researcher Uses Dumbest Antivirus Program Ever"

lylejohnson• 15 years ago

As of this writing, Network World has updated the original story's title to read "Samsung keylogger could be false alarm". I guess they're not quite ready to give up.

kenjackson• 15 years ago

"Obama birth certificate may be legit. But eyewitnesses at his birth have still not come forward. And several potentials have died over the past 50 years. Suspicious? You decide."

simonsquiff• 15 years ago

A number of people here pointed out that the writer's original claim to be false positive proof simply because he'd used the tool for a long time was ridiculous. Unfortunately for him he's learning this the hard way.

"The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the years."

grammaton• 15 years ago

So if Samsung isn't shipping key loggers, then why did one of their people act as if they were?

nickolai2• 15 years ago

Because he hasn't got a clue as to what a keylogger actually is?

rayval• 15 years ago

They didn't. Instead, a harried customer support person answered a confusing question with a nondescript answer. One could paraphrase it as: "Well, Mister Caller, I have no idea what software you are talking about, but if there is any such software on the system, it would be to make sure the system is running properly."

neurolysis• 15 years ago

Wow... to accuse such a major corporation of something as serious as installing keyloggers on their client's PCs without evidence is one thing, but to then change your story entirely when it turns out you have completely fudged the facts is another, and speaks volumes about the integrity of both the author and Network World...

notphilatall• 15 years ago

What is going on with Samsung? This should have (a) raised all PR alarms as soon as it got traction on the internet, and (b) should NOT have taken >24h for someone to track down what they're installing in C:\windows\SL

At least it reminds us why the underdog sometimes has the upper hand, I suppose.

Samsung blames security software false positive for StarLogger issue.

Related Stories