Confirmed: Samsung is not shipping keyloggers

http://www.f-secure.com/weblog/archives/00002133.html

by illdave • 15 years ago

448 76 15 years ago

nickolai• 15 years ago

I'm no expert of Antivirus software, but figuring whether something is a threat by its _folder name_ ??? With all the money going into the industry? That has to be some sort of april fool's prank gone really bad.

JoachimSchipper3• 15 years ago

Anti-virus software is essentially useless against attackers writing their own code anyway (evading a few signatures is not that hard).

Of course, these guys are not even trying.

jpr• 15 years ago

Isn't the whole "security industry" a prank gone bad?

JoachimSchipper3• 15 years ago

Not everything is useless. Code auditing is not necessarily useless; looking at the physical security of smart cards is not necessarily useless (but it looks like they could use some tougher certifications); pentesting/social engineering can have its uses.

That said, "security appliances" and other magical solutions tend to be rather imperfect. tptacek (of http://insecure.org/stf/secnet_ids/secnet_ids.pdf) may have something to say about that, too.

tptacek• 15 years ago

There are a whole lot of charlatans in the field. Certifications and credentials are often a good tip-off.

darren_• 15 years ago

AV software is written to pass the tests of AV software reviewers. This is subtly but importantly different from "written to accurately detect and block malware"; in particular, it's extremely difficult for a reviewer to test an AV's ability to block completely novel malware (unless they're a malware author themselves or connected with someone who is). So, people tend to set the AV software to scanning a folder full of known samples and judging the software on how many it detected (this is a nice, easy metric: you can make bar graphs out of it!) - in this situation, if chucking in a signature for C:\windows\SL gives you an easy extra malware detection at the cost of a false positive (that no reviewer's going to spot anyway), it's a no brainer.

ryan-allen2• 15 years ago

This has got to get to 400+ points. For those who took the day off and will continue to believe the sensationalism before it pops off the front page? To be damned!

EDIT: I mean, this is the only tech news site I read. I don't know if I'm in the same boat so to speak.

Devilboy• 15 years ago

Got your wish, 400+ now!

16s• 15 years ago

False positives are the bane of IT security products in general. I would say that 90% of issues reported are FPs and the end user is expected to figure that out, confirm then double confirm before reporting it as a potential issue.

CaptainZapp• 15 years ago

I can't help it. But the whole "security software" business really reminds me of the mob.

Nice laptop you have here; would be a shame if something would happen to it!

alecco2• 15 years ago

You mean the "antivirus software" industry.

burgerbrain3• 15 years ago

Since when have these guys limited themselves to just being antivirus vendors?

Construct• 15 years ago

This is a good reminder to always do your homework before making such a strong accusation. Samsung's reputation is probably largely undamaged, other than among people who just read the headlines on news aggregator sites. Even searching for 'Samsung Key Logger' pulls up mostly articles about the false alarm situation.

Mohamed Hassan [MSIA, CISSP, CISA and graduate of the Master of Science in Information Assurance (MSIA) program from Norwich University in 2009 as the original article prominently states], on the other hand, is probably not so lucky. Any Google search on his name from now on will probably reveal this whole debacle. Furthermore, I wouldn't be surprised if he just opened himself up to legal action by Samsung.

grannyg00se• 15 years ago

To be fair, Mohamed Hassan did contact Samsung support and they didn't clear up the issue. In fact, I believe they may have even confirmed that there was a key logger installed! At that point his due dilligence has been done and he has confirmation. He doesn't need to do anything further than that. Shame on Samsung support for such a pathetic showing.

dereg2• 15 years ago

He did not fulfill his due diligence. Not if they're going to add this to the article: "Mohamed Hassan, MSIA, CISSP, CISA is the founder of NetSec Consulting Corp, a firm that specializes in information security consulting services. He is a senior IT Security consultant and an adjunct professor of Information Systems in the School of Business at the University of Phoenix."

If they're going to pass him off as an expert, then he better be doing analysis that a normal lay-man can't do. If he has the credentials, then why is he basing his claim off of a conversation with low-level customer support?

baltcode• 15 years ago

He did talk to customer support, and once in a while, I'd rather have a false alarm (keeping it to the level of information, rather than lawsuits) now and then, than something like this actually happening and kept under the radar.

scott_s• 15 years ago

I don't expect customer support to know what a keylogger is, much less know if their own systems have them installed.

recoiledsnake3• 15 years ago

>To be fair, Mohamed Hassan did contact Samsung support and they didn't clear up the issue. In fact, I believe they may have even confirmed that there was a key logger installed! At that point his due dilligence has been done and he has confirmation. He doesn't need to do anything further than that. Shame on Samsung support for such a pathetic showing.

Extraordinary claims require extraordinary evidence. Especially when the person making claims is the founder of a security company. His due diligence consisted of things like "The software I used is false-positive proof since I am using it from 6 years". "I have done this on two different laptops with same results, so it must be Samsung's fault". Huh?

dereg2• 15 years ago

Everything that he did was just shameful. Suggesting class-action, writing two articles essentially saying the same thing (in a "2-part series"), shoving our faces with his credentials (that obviously didn't do much for him), claiming that his anti-virus program never had false positives, drawing comparisons to the Sony rootkit debacle, etc.

I hope this guy has it coming to him. If he's going to put his creds up like that, he's putting himself out there as an informed source. You expect that sort of sensationalism from journalists, not from a security "expert". Shameful work, overall.

recoiledsnake3• 15 years ago

He's founder of NetSec Consulting Corp. I am sure this is great advertisement for it. Or maybe it was orchestrated to generate publicity.

w1ntermute• 15 years ago

> Any Google search on his name from now on will probably reveal this whole debacle.

Actually, he has a sufficiently common name that those results will be relegated to the 2nd or 3rd page of search results within a few weeks:

http://www.google.com/search?q=Mohamed+Hassan

cubix• 15 years ago

Probably not if you throw in a few relevant keywords like 'security'.

JamieEi• 15 years ago

It should also be a good reminder to all of the people on HN who jumped to the conclusion that this guy was right on very sketchy evidence. This place is influential. We should do better.

gphil• 15 years ago

I agree completely with this sentiment. It's important to remember that the vast majority of "journalism" on the web isn't conducted very professionally.

jedsmith2• 15 years ago

I think the vast majority of top-level comments on that item considered the information dubious or were holding out for independent confirmation; I don't think HN leapt to a conclusion. My comment, one of the less obvious, was more from a good-idea perspective instead of assuming the story was true -- I had not decided yet.

Overall in that item I think HN did better than you imply, unless you mean the upvotes the item received.

albedoa• 15 years ago

Thankfully, it looked to be very few people. His article was written--and his tests were conducted--just about as poorly as they could have been. It was a huge show, and HN caught on quickly as far as I can tell.

machrider2• 15 years ago

HN had many skeptical comments right off the bat. I guess simply publicizing this story before its confirmed is bad, but it's also how you shine light on an issue - in this case, clearing Samsung of any wrongdoing.

Reddit fared much worse, IMO, in that people continued to upvote the wrong story after the truth was out. The correction has been posted but isn't anywhere near the front page.

drzaiusapelord• 15 years ago

I did my part and questioned this from the beginning only to be 'corrected' by other HN commentators. A competent person would have displayed logs, packet captures, stacktraces, etc. This guy just said "my infallible tools caught it" and those who want to believe in conspiracy theories just believed it. It was obvious from the get go that Mr. Credentials was just using an off the shelf definition based scanner.

Meanwhile, the shitty media outlets that irresponsibly spread this got all the ad impressions they wanted. The problem with truth is that its not as profitable as BS. How many people will ever read the corrections?

levigross• 15 years ago

certificate fail!

tiki-tiki• 15 years ago

Well, I'm not longer buying Samsung anyway. That's for sure.

estel• 15 years ago

Care to explain why?

richbradshaw• 15 years ago

They named a folder SL. Two letter folder name on a non unix system?

getsat• 15 years ago

Are you also avoiding Toyota automobiles?

cake• 15 years ago

If you Google http://www.google.com/search?q=samsung+keylogger+monitor+the...

You'll have thousands of quotes from a so-called "Samsung supervisor" who "said it's used to "monitor the performance of the machine and to find out how it is being used."

What is this bullshit ? From where did the quote come from ?

Amazing how most are just copy-paste. It just prove that very few online news websites verify their source if the keylogger claim is false.

originalgeek• 15 years ago

"It is better to remain silent and be thought a fool than to open one's mouth and remove all doubt." --Abraham Lincoln

falcolas3• 15 years ago

Perhaps I read it wrong, but the article never says Samsung didn't ship a keylogger, it just indicates that the AV software can make false positives based on a folder.

Can we get a link to an article that actually checks a Samsung laptop (and lists their methodology, not this "Duh, there were not any keyloggers") instead of anecdotal evidence and attacking the previous reseaerchers methods?

Even if the previous guy was wrong, at least he listed all his methods for review.

kenjackson3• 15 years ago

The article says two things:

1) The whole saga was caused by a bad antivirus alert. This story never even happens if not for that.

2) They checked a set of Samsung laptops and found no trace of keylogger software. See http://www.f-secure.com/weblog/archives/00002132.html

Is there more you'd like to see be done?

falcolas3• 15 years ago

Yes (I did see the link back to the original article). Specifically, I'd like some more information about their methodology.

1) How did they verify there were no key loggers (is their AV program set to identify StarLogger instances) 2) What subset of Samsung laptops did they check 3) Did they check from more than one source 4) Did they verify that the laptops they checked haven't been wiped & reimaged with the local store's base computer image (such as with Best Buy)

With out some of this basic data, their findings are perhaps more suspect than the original article (not that I believe Samsung is doing this, I just disagree that their conclusions are as cut and dried as they, and the link title, indicate).

natch• 15 years ago

Yes.

1) What was in the SL directory? F-Secure claims the certified guy never inspected it. What about them, did they inspect it? They could have easily asked Hassan for a copy (insert appropriate caveats here about trusting sources). Sounds like they didn't even find one on their own, so how can they assert they know what it does not contain? They might not have gotten one of the laptops with the payload; that doesn't mean they don't exist.

2) How did the SL directory get there? F-Secure didn't even offer a theory.

3) Is Samsung installing keyloggers on a subset (random sample) of their machines?

4) I'd like to see it stated clearly, with no weasel words: Is F-Secure under contract with Samsung or do they have any business relationship with Samsung whatsoever? If not, are they angling for one?

nate23342• 15 years ago

Customer service Reps would NEVER have the authority to tell you that there is secret Key Logger on your computer. So if a customer Rep is telling you something like that, he is either trying to get fired or there is a miscommunication.

pkteison• 15 years ago

The laptop story yesterday led me to learn about CarrierIQ on my cell phone, which was equally disturbing. Maybe the laptop was a false alarm, but my Samsung cell phone did indeed have a keylogger on it. So I'm not inclined to cut them a lot of slack right now. http://forum.xda-developers.com/showpost.php?p=11763089

crististm• 15 years ago

Great news... but what's with the SL folder? The report does not say what SL folder contains on a new laptop. Anyway, pretty dumb to check for viruses by folder name.

jws• 15 years ago

Slovene language support files. SL is their ISO 639-1 code.

http://www.samsungtomorrow.com/1071

lell• 15 years ago

there's a separate folder in C:\Windows for every supported language? that seems so messy.

perspective• 15 years ago

I sure hope someone got fired for that one snicker

todd3834• 15 years ago

"The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the years."

Mohamed's lesson: Just because you were unable to prove a false-positive with the same program for 6 years doesn't mean there weren't any.

unreal37• 15 years ago

"A lie can travel halfway round the world while the truth is putting on its shoes." -- often attributed to Mark Twain

The original article was so poorly fact checked. It really reflects poorly on Mohamed Hassan (and all his fancy yet meaningless credentials) and M. E. Kabay (who apparently worships Mr Hassan unquestioningly). I will not hold my breath out for a public apology from either of those two, although they are the ones who owe Samsung one.

And the irony is in fact delicious. A security expert finds a virus using an anti-virus scanner tool, and confirms it with some call center employee with the company. What does being a "security expert" have to do with any of that? My 10 year old nephew could have done that!

Trufa• 15 years ago

Though it is easy to say now, looking back, Mr. Hassan's investigation was far less in depth that it should have been for such a serious accusation.

visakhcr• 15 years ago

From the original post which started all this:http://www.networkworld.com/newsletters/sec/2011/032811sec2....

"After an in-depth analysis of the laptop, my conclusion was that this software was installed by the manufacturer, Samsung. I removed the keylogger software, cleaned up the laptop, and continued using the computer."

So, the author, Mohamed Hassan was able to uninstall a software which was never installed? I think he would have deleted the folder in question and called that un-installing!!

elessar0x3• 15 years ago

I like this whole debacle. I think it ended well. HN, and the power of news aggregating/forum/linking sites wield a decent amount of media power. I like that - because it's one of the instances where the collective mind has greater intelligence than any one individual. It confirms the notion that tech producers need to pay attention to the tech community and shortens the distance between the two, which I think is a good thing.

zachahack• 15 years ago

Certs after your name are no substitute for common sense and good practices.

spacemanaki• 15 years ago

Wow, what a waste of everyone's time:

> [UPDATE 3/31/11: Mich Kabay writes: A Samsung executive personally flew from Newark, N.J., to Burlington, Vt., carrying two unopened boxes containing new R540 laptop computers. These units were immediately put under seal and details recorded for chain-of-custody records. At 17:40, Dr Peter Stephenson, Director of the Norwich University Center for Advanced Computing and Digital Forensics, began the detailed forensic analysis of the disks. We expect results by Monday.]

http://www.networkworld.com/newsletters/sec/2011/040411sec1....

Confirmed: Samsung is not shipping keyloggers

Related Stories