Samsung installs keylogger on its laptop computers

[thanks_imjustlurking]

In the fall of 2005, the security and computer world was abuzz with what was at the time dubbed as the "Sony BMG rootkit Fiasco." Sony BMG used a rootkit, computer program that performs a specific function and hides its files from the regular user, to monitor computer user behavior and limit how music CDs were copied and played on one's computer.

Some in the computer security industry had hoped that the criminality of the act that Sony BMG had engaged in together with the huge business costs associated with the settling of the case with consumers and federal authorities would act as a deterrent to any company which might want to monitor computer usage. Others, including Mark Russinovich, the developer and blogger who first discovered the rootkit, were not so sure. In fact Mr. Russinovich warned that "Consumers don't have any kind of assurance that other companies are not going to do the same kind of thing (as Sony)" (Borland, 2005).

How right has Mr. Russinovich been!

While setting up a new Samsung computer laptop with model number R525 in early February 2011, I came across an issue that mirrored what Sony BMG did six years ago. After the initial set up of the laptop, I installed licensed commercial security software and then ran a full system scan before installing any other software. The scan found two instances of a commercial keylogger called StarLogger installed on the brand new laptop.

http://www.networkworld.com/newsletters/sec/2011/032811sec2.html


Samsung responds to installation of keylogger on its laptop computers

On March 1, 2011, I called and logged incident 2101163379 with Samsung Support (SS). First, as Sony BMG did six years ago, the SS personnel denied the presence of such software on its laptops. After having been informed of the two models where the software was found and the location, SS changed its story by referring the author to Microsoft since "all Samsung did was to manufacture the hardware." When told that did not make sense, SS personnel relented and escalated the incident to one of the support supervisors.

The supervisor who spoke with me was not sure how this software ended up in the new laptop thus put me on hold. He confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."

In other words, Samsung wanted to gather usage data without obtaining consent from laptop owners.

http://www.networkworld.com/newsletters/sec/2011/040411sec1.html#

[Ian David]

1. Samsung makes laptops? Who knew? n/t

[snagglepuss]

2. Will Samsung be charged? Is it likely that all companies are doing this?

[thanks_imjustlurking]

5. Everything I know is in the articles I linked to.

I sure hope so. I hope they get hit hard, like Sony.

[CreekDog]

15. After the feds get done talking about Barry Bonds' hat size

oh and after they try to put those DADT protestors away for 6 months.

then maybe, maybe... :eyes: :wtf:

[SlimJimmy]

3. Just for the record, the winSL.exe file can be located and removed

from any system by simply searching for it while using the *display hidden files* option. Once found it is easy to remove/delete.

[thanks_imjustlurking]

4. Yes, but a lot of people won't even know it is there.

Hopefully this kind of exposure will make companies think twice before even trying stuff like this, but probably not - just better ways to hide it.

[SlimJimmy]

9. I agree, and that's why they should run anti-rootware/malware like

Hitman pro or SuperAntiSpyware on a regular basis to find these types of rootkits and hidden malware. Both of these programs offer a free version, so it's not like they're going to have to spend a bunch of money. I've used (and still do) Spybot S&D and Hijackthis on a regular basis, but the two I mentioned are a great addition to those and will find the rootkit type malware that they don't. Just my 2 cents. :)

[Babel_17]

6. Samsung investigating report

"Samsung spokesman Jason Redmond said that his company is looking into Hassan's allegations. "We take these claims very, very seriously," he said. He had not previously heard of the problem, or heard of de Willebois Consulting, the company that makes the StarLogger software that Hassan said he found on the laptop. "We have no understanding of a relationship with this company and we have no prior knowledge of this software being on our laptops," he said."

http://www.computerworld.com/s/article/9215367/Samsung_investigating_report_of_keylogger_on_its_laptops

[snagglepuss]

8. That statement beggers belief. How could they possibily not know what's

on their computers?

[Wickerman]

10. Reading the comments

it seems that the logger isn't replicated on some other laptops of the same model recently purchased. Be interesting to follow this and see if it is in fact a problem there or if the logger got inserted mid-stream retail.

[hobbit709]

7. wonder how many companies are doing this.

I bet it's in the bundled software.

[Babel_17]

11. Updates

http://www.networkworld.com/newsletters/sec/2011/040411sec1.html

Edit: Trying again to include some quotes. Edit 2: Can't do it. :(


http://sunbeltblog.blogspot.com/2011/03/samsung-laptops-do-not-have-keylogger.html

"Samsung Laptops do not have a keylogger (and it was our fault)"

"A Slovenian language directory for Windows Live is causing us considerable headaches this morning, and we have no one to blame but ourselves."

The fog clears.

[Krakowiak]

14. Confirmed. This is hysteria by one blogger. There is no keylogger.

[JoePhilly]

12. Whether this is a scray thing or not depends ...

I work in high tech and at times we look for ways to "instrument" the software, not to track what an indivudal user does, but to understand where our software fails as a user tries to complete some task.

Software user interfaces can be confusing, and so understanding how user tried to traverse from screen to screen and task to task can help you redisgn the interface to help people.

It is very important when you do this that (a) you make sure users know what you are looking at, and (b) you only look at "aggregate patterns" not at individual user actions.

I'd compare it to software that monitors traffic patterns, you do not look at the individual cars, but at the overall patterns.

If Samsung is looking at individual data, rather than aggregate, this might be a big deal.

[thanks_imjustlurking]

13. I figure that's probably what the Samsung guy who replied to the blogger was confirming.

Sounds like the blogger kind of went off half-cocked. Thanks for the updates upthread.