Dr Guy Dr Guy

If the Hackers were not Bad enough - False Alarm

▼

If the Hackers were not Bad enough - False Alarm

With Apologies to Samsung.

http://antivirus.about.com/b/2011/03/30/samsung-installs-keylogger.htm?nl=1
from JoeUser Forums

A  report out by NetSec Consultants Corp. is reporting that Samsung is installing a hidden keylogger on all their new laptops!  While no official statement has been forthcoming from the company, a support person at the company has confirmed it.

The key logger is invisible to the user and records every keystroke the user(s) makes.  It can then send that information to any email it is set up to work with (or to any email that is hijacked by it).  Keyloggers in a class room (or a marital situation) are one thing.  Perhaps necessary in some cases, the programs are a severe security threat and really bad news!  It can steal all of your credit card information, bank account information, and just about everything that makes you unique (if you do anything on a computer).

I have not bought Samsung laptops in the past.  Given this revelation, I will not be buying any in the future either.  This is one of the biggest blunders a company has done in recent memory.  They have destroyed any trust they may have had with their clientele.

182,238 views 63 replies
Reply #26 from JoeUser Forums Top

Quoting Uvah, reply 8
I'm running Sophos root-kit. So far it has identifed several unknown hidden files. Some of them from DesktopX widgets 7, ObjectDesktop 1, Raimeter 4, Glary Utilities 1, I stopped the scan for a looksee. Apparently you have to let the scan finish before you view any of the files. I'll resume it or barring that, do another when there is more time.

Thanks for QTing the sophos product!  I do trust them and figure it will be a good one given Doc's recommendation.

Quoting tazgecko, reply 9
Why?

The only reason I can think of is the government asked them to. Perhaps the South Korean government wanted a way to spy on others. What a stupid move.

taz is now looking, with suspicion, at his Samsung phone

 

Or it can be innocent - they just wanted to have a good tool for the tech calls.  A really stupid innocent move, but do not always attribute to evil what can easily be explained by stupidity (I forget who said that).

 

Reply #27 from JoeUser Forums Top

Quoting DisturbedComputer, reply 10
and that's way Sony don't get my MONEY any more Now Samsung won't get any More of my MONEY  EVER and that's how you tell a company too stick it TAKE your money else where 

You have a weapon against them.  As I told a colleague, I do not since I have never bought one of their products (yet, so now it will be ever).

Quoting kku, reply 11
I will never buy another Samsung product!

2 for 2 - it seems Samsung shot themselves in the foot - over this and other practices.

Quoting tazgecko, reply 12
Samsung denial http://www.samsungtomorrow.com/1071

 

It could be - but I will wait for a followup from the firm that found them. They do not seem like one that would make a mistake like that, but no one is perfect.

Elemental: Reforged
Reply #28 from WinCustomize Forums Top

As always the consumer is presented with a very real problem, just who do you believe.  :annoyed:

Reply #29 from JoeUser Forums Top

Quoting DrJBHL, reply 18
I believe this more than I believe Samsung would do anything so ...well, stupid.

THe question then becomes why did they get confirmation from the support guy?

Ford built the Edsel and GM built the Volt.  Sometimes companies do stupid things.

Quoting Island, reply 21
This was identified as a false positive.  Shoddy tech journalism from these sites who published this.

 

It got my dander up.

Quoting DrJBHL, reply 24
Precisely. Or someone with an axe to grind. Don't let this affect your use of Samsung products. That would be punishing the victim, wouldn't it.

If it turns out to be false, I will issue Samsung an apology.  I am going to wait for the rest of the story.

Reply #30 from WinCustomize Forums Top

FALSE ALARM Testing confirms Samsung keylogger rumour just a false alarm
http://www.theregister.co.uk/2011/03/31/samsung_keylogger_rumour_debunked/

Antivirus testers have backed up Samsung's protestations that the detection of keylogging software on brand-new Samsung laptops was just a false alarm.

Mohamed Hassan, founder of security consultancy NetSec, raised the alarm after a scan revealed that two newly purchased Samsung laptops were infected with StarLogger, a commercial keylogger. Hassan investigated the matter before working on a story for NetWork World that compared the incident to the infamous Sony BMG rootkit fiasco of 2005.

It was suggested that Samsung was using underhand methods to extract market research, monitoring user activity without their knowledge or consent in the process. Hassan was eventually put through to a Samsung support centre manager who told him that Samsung had pre-loaded software to "monitor the performance of the machine and to find out how it is being used".

Samsung quickly denied it was doing anything of the sort before issuing a more detailed statement saying that the

Quote:
confusion stemmed from the installation of the Microsoft Live! application suite. The Slovak language version of the suite creates a folder called C:\Windows\SL, the same folder name as is used by the StarLogger application and it was this that was causing alarm bells to ring.



Testing by antivirus researchers this morning confirmed that VIPRE Antivirus detects 'StarLogger' after creating a 'SL' folder on a clean PC. Even an empty folder with no files in it creates this behaviour.

 



Reply #31 from Elemental Forums Top

Remember how long it took for hotels to admit that all your comings and goings into your hotel room were being logged every time you swiped your card?   What happened to the good old days when you were given a key?  Some hotels still don't admit it to this day, and if you ask, they'll ask why you're asking.

Reply #32 from WinCustomize Forums Top

Quoting tetleytea, reply 31
Remember how long it took for hotels to admit that all your comings and goings into your hotel room were being logged every time you swiped your card?   What happened to the good old days when you were given a key?  Some hotels still don't admit it to this day, and if you ask, they'll ask why you're asking.

I actually prefer this, as it gives the hotel information in case you come back to your room and something is missing, they will know where to start to find out who took it.  Does not matter to me though if they know when I come and go, it is their hotel after all, and this just seems as a very good means of security.

Reply #33 from WinCustomize Forums Top

Quoting Dr, reply 25
High praise form the Guru of geekdom! Thanks And thanks for the link as well.

I guess we have to be vigilant on the phones. Hopefully this company or another like it is doing the same thing with smart phones.

Honestly? I was just kidding about the phone thing. I have a 'bent' sense of humor.

As for 'the guru of geekdom'... lol... thanks, but you'd be amazed (or maybe not, lol) at how little I know.  I.D. is the Techno-Evangelist, not I.

Quoting LightStar, reply 32
and this just seems as a very good means of security.

I agree, and could be exculpatory: If something happens elsewhere it could keep you 'off the hook' (partially) for it.

Reply #34 from JoeUser Forums Top

Quoting OldMsgt, reply 30
FALSE ALARM Testing confirms Samsung keylogger rumour just a false alarm
http://www.theregister.co.uk/2011/03/31/samsung_keylogger_rumour_debunked/


Thanks - yes I verified it was a false alarm.  Sorry for the rhubarb.

Reply #35 from JoeUser Forums Top

Quoting DrJBHL, reply 33
Honestly? I was just kidding about the phone thing. I have a 'bent' sense of humor.

But we already know that they are vulnerable and bugs have been released.  It is just a matter of time before they pull  a stunt like that on the phones.  That is what I thought you meant.  Not that this one was infecting the Samsung phones (different OS and all).

Reply #36 from WinCustomize Forums Top

Quoting Heavenfall, reply 13
Laptops usually come with a ton of bloatware, seems Samsung are no different. Format, format, format.

Only one problem with that. If you buy a PC it comes with a restore DVD that in most cases one has to make themselves. If you reinstall Windows it reinstall the bloatware. They quit giving out copies of "just" Windows some time ago. So one has to spend hours getting rid of the bloatware. A format would not help much.

Reply #37 from WinCustomize Forums Top

No-one seems to be answerable to the issue of false-positives.  It's seemingly OK to SLANDER a company's reputation by getting it wrong because your program is profoundly defective/wanting - hitting the INNOCENT Company's bottom-line as well.

This sort of SHIT happens to many.  It's time something better than "sorry, we fucked up" results.

I'd like to see SERIOUS financial compensation awarded as a deterrent.

"c:\SL" = Starlogger rootkit?  Are these people just plain STUPID or what?  Test your bloody programs before you release them.

Reply #38 from WinCustomize Forums Top

Oh....BTW...it's 'LIBEL', really as it's the 'written word'.

Reply #39 from JoeUser Forums Top

Wish we could get Jafo's opinion on this.

Reply #40 from WinCustomize Forums Top

It's a worry that a 'security expert' could be confused by a false-positive. Considering that it happens all the time with programs, you think he would research further before throwing it on the net.

 

Quoting kona0197, reply 36
Only one problem with that. If you buy a PC it comes with a restore DVD that in most cases one has to make themselves. If you reinstall Windows it reinstall the bloatware. They quit giving out copies of "just" Windows some time ago. So one has to spend hours getting rid of the bloatware. A format would not help much.

One of the reasons I buy the full version of an OS. 

Reply #41 from WinCustomize Forums Top

Quoting tazgecko, reply 40
One of the reasons I buy the full version of an OS.

On top of buying a PC that already has a Windows OS on it? Waste of money...

Reply #42 from WinCustomize Forums Top

Quoting Daiwa, reply 39
Wish we could get Jafo's opinion on this.

OK...I'll elucidate.....;)

Reply #43 from WinCustomize Forums Top

Quoting Jafo, reply 42
Wish we could get Jafo's opinion on this.

OK...I'll elucidate.....

Can you elaborate on your elaborate opes elucidate   :rofl: :rofl:

Reply #44 from JoeUser Forums Top

Quoting Jafo, reply 37
This sort of SHIT happens to many. It's time something better than "sorry, we fucked up" results.

I'd like to see SERIOUS financial compensation awarded as a deterrent.

For reckless and irresponsible reporting I agree.  But for the innocent stuff, no.  And the rub is how do you figure the difference.  Samsung has a recourse against Netsec, and that is the courts.  Proving it is not so easy, but then given the respective pockets of the 2 companies, the odds favor Samsung should they pursue it.

Quoting tazgecko, reply 40
It's a worry that a 'security expert' could be confused by a false-positive. Considering that it happens all the time with programs, you think he would research further before throwing it on the net.

I agree strongly with this view.  While my job is Network security, I do not have the skills or time to investigate every alarm raised, so I trust others to do it for me.  When they screw up big time, like this one, it makes my job harder in knowing who to trust. 

The end result is that Samsung got hurt, but I suspect Netsec got a fatal blow for their early false positive.  Had they been right, they would be kings of the castle.  As it is, their reputation just took a very bad blow.

Reply #45 from WinCustomize Forums Top

Netsec looks like an incompetent retard....Samsung is made to look like a 'criminal'.

It's time incompetence was penalized to the point of eradication.

Reply #46 from WinCustomize Forums Top

If it were only that easy. *sigh.

Reply #47 from JoeUser Forums Top

Why you wanna go so easy on 'em, Jafo?

Reply #48 from WinCustomize Forums Top

Unfortunately shit happens.

Reply #49 from JoeUser Forums Top

Nothing 'unfortunate' about it.  Shit's value-neutral.  Until you reach a certain age...

Reply #50 from Stardock Forums Top

Quoting tazgecko, reply 40
It's a worry that a 'security expert' could be confused by a false-positive. Considering that it happens all the time with programs, you think he would research further before throwing it on the net.

 

Which goes to show, experts know nothing.