Samsung Keylogger Stories a False Alarm 183
Trailrunner7 writes "The panic that arose yesterday about Samsung allegedly shipping laptops that contained a pre-installed keylogger turns out to have been a complete mistake after further investigation by security researchers and the company itself. In fact, the controversy was the result of a false positive from one commercial antimalware suite and nothing else. Several outlets reported on Wednesday that Samsung laptops had been found to contain a keylogger known as StarLogger right out of the box from the factory. However, upon closer inspection by security companies, the folder on the laptops that supposedly contained the malware was actually a directory that is part of Windows' multi-language support."
epic FAIL (Score:5, Insightful)
Re: (Score:2)
wait for it
Re:epic FAIL (Score:5, Interesting)
- an antivirus software that rise alarm base on a two letter directory name inside \Windows , even when it is empty.
- a "security researcher" that take the alarm at face value and never check if is actually there, check if the process run, what kind of content it was logging and where it is sending them.
- a low level support manager confirm the software's existence, probably thinking about the fan speed and temperature monitoring software.
Re: (Score:2)
The folder being empty could simply mean rootkit, though it would be a terrible fail of a rootkit not to hide the folder itself. The fact that the folder is actually a standard part of Windows is the worst fact.
Re:epic FAIL (Score:5, Funny)
Re:epic FAIL (Score:4, Informative)
First line of the article:
Mohamed Hassan, MSIA, CISSP, CISA is the founder of NetSec Consulting Corp, a firm that specializes in information security consulting services. He is a senior IT Security consultant and an adjunct professor of Information Systems in the School of Business at the University of Phoenix
Then a whole lot of fluff about the Sony root kit fiasco.
The money quote:
The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the years.
That seems to be some very concrete proof.
Then some ramblings about how a class action lawsuit will come out of this. I too smell a lawsuit but not against Samsung.
Re: (Score:2)
- a "security researcher" that take the alarm at face value and never check if is actually there, check if the process run, what kind of content it was logging and where it is sending them.
He didn't take it at face value, he did an 'in-depth analysis' and concluded that the malware was 'undetectable', you insensitive clod!
Re: (Score:3)
Heh I remember reading the line where he said that it definitely wasn't a false positive because it had never had one before, and going .... "what? Well, the part where he captures the network information or at the very least sees the log files on his disk somewhere must be coming soon." Nope! Just another credulous fool. By the end I was wondering how the hell he could claim that Samsung was logging every keystroke, when even if it was installed, in all likelihood Starlogger can be configured to do a numbe
Re: (Score:2)
Apparently there is some sort of information-gathering going on, and any at all without clear prior notice to the user and the user's acceptance is ... unacceptable.
That's copmletely unsubstantiated.
Re: (Score:2)
Yeah, that wasn't worded great, it sounds like too strong of a suspicion. By "apparently" I meant "it appears that", which is not the same as "it is certain". The admission was from a Samsung tech, according to the person who posted the unsubstantiated accusation in the first place. That part of his claim I don't doubt, but who knows what the tech thought he was referring to. It is odd enough that I think it bears looking into though, especially if you are or plan on being one of their customers. They would
Re:epic FAIL (Score:5, Insightful)
Basically the qualifications of the author aren't technical and he's commenting on a technical topic and the story was lacking on details so such a big claim couldn't (and shouldn't) be taken at face value without independent validation.
In this case the independent validation seems to very strongly refute the claim, which is unfortunate for the author's reputation
Re: (Score:2)
Basically the qualifications of the author aren't technical and he's commenting on a technical topic and the story was lacking on details so such a big claim couldn't (and shouldn't) be taken at face value without independent validation.
Congratulations, you've just described 99% of /. posters
Re: (Score:2)
I too was sceptical of the story, but unfortunately I have no such proof of my scepticism. Instead of posting about my scepticism, I just passively accepted that it was part of slashdot's long slide into uselessness, and into its current position as the Fox News for nerds.
Mod me flamebait if you like, but at least I'm on topic.
Re: (Score:2)
Re: (Score:2)
I've used VIPRE for years now. It actually is a quality product.
Except for when it false-positives over the presence of an empty folder which is actually a part of a correct Windows installation in certain circumstances.
(Having said that, if I were to blacklist a piece of software every time I found one stupid bug, I'd very soon run out of software I could run)
Re: (Score:2)
FAIL on the part of everyone who blindly believes some slashdot story that doesnt name the supervisor, or any details of methodology, or any details beyond the finders name.
I mean seriously, do people really take all slashdot stories at face value?
Re: (Score:2)
Of course. Especially the ones posted tomorrow.
FUD Campaign (Score:2)
I've seen a few people mention it already in previous articles but I'm actually beginning to wonder myself if this is an orchestrated FUD campaign against Samsung. The actors story was, well, a complete fucking non-story too.
Rogue Apple fanboy, or Apple PR getting a bit twitchy about Android and Samsung's Galaxy phones and tablet perhaps?
Will be interesting to see if this anti-Samsung FUD continues or if it's mere coincidence that two FUD stories have been posted about Samsung in such a short period.
Re: (Score:2)
If he was paid to write that I hope for his sake it was enough to retire on because now his credibility in the field is effectively negative (ie. people will avoid him). For me the worst thing he's done is t
Re: (Score:2)
We believed someone who used a 3rd rate antivirus and didnt verify with a kernel debugger? FAIL on all our parts especially the "security researcher" who so thoroughly researched this one
Agreed, though I'm quite happy with the results of this FAIL - it showed what would happen if indeed, Samsung installed a keylogger. Sooner or later a company would have decided this to be a good idea. So it's kind of nice to have this small shitstorm without actual damage. The linked article uses such strong wordings as "the panic that arose yesterday" ... good! Companies should be reminded from time to time how sensitive this issue is...
Re: (Score:2)
Yet it did not stop every Blog and media outlet on the planet, including Slashdot, from picking up the story. Welcome to the blogs-as-news era.
Re: (Score:2)
Re: (Score:2)
From what I read, it wasn't even question of a binary. The mere presence of a _folder_ with the offending name triggered the AV. That AV's gotto be the new benchmark as far as being crappy goes.
Re: (Score:2)
No, wait, let me guess: the folder name was system32 and the AV recommended to delete it! [knowyourmeme.com]
Re: (Score:2)
The mere presence of a _folder_ with the offending name triggered the AV. That AV's gotto be the new benchmark as far as being crappy goes.
Sort of like writing an anti-virus program which checks for files called "virus.exe" and calling it secure. Reminds me of mod_security for Apache, and how it blocks things called "shell.php" (and possibly other extensions) from executing just based on the same. Pretty retarded view of "security". It took me forever to figure out why the PHP files that were hosting our Flash courseware shells weren't running when everything else was. Turns out it was a "security" measure, thanks to mod_security. It real
Re: (Score:2)
Re: (Score:2)
Reminds me of my days as a NetWare admin. For those that might not know, NetWare servers use DOS to bootstrap, then run a program called "server.exe" to launch the server OS.
I was applying a service pack to a NW6 server, and part of that SP was an updated "server.exe". Well, MacAfee decided that "server.exe" was a virus and just silently deleted it after it was extracted, without even telling me. Killed two servers before I figured out what was going on.
And yes, I know that MacAfee AV is TRWTF...but it w
Re: (Score:2)
The mere presence of a _folder_ with the offending name triggered the AV. That AV's gotto be the new benchmark as far as being crappy goes.
It's hardly anything new. There was this notorious case from 8 years ago [interesting-people.org], when the RIAA sent threatening C&D letters to Professor Peter Usher at Penn State, because his web site contained files with "Usher" in their name, including several .mp3 files. So the RIAA concluded that he was illegally distributing songs by the band Usher. As in this case, they looked only at the file names, and couldn't be bothered to check the files' contents. You can read lots about this case by googling "Professor Ushe
Re: (Score:2)
Re: (Score:2)
IT World standard practice (Score:3)
My initial reaction was more along the lines of "That sounds unlikely" than "Burn them!".
My initial response was;
It's a Network World/IT World article, so its probably made up garbage that will be debunked within hours.
And look at that... it was. Shocking.
I have a friend who likes to sent me IT World articles. It's become a running joke how bad their articles are written. Well, a joke to me at least, he still thinks they are some sort of reputable news source for all things IT and that I am just 'picking on them'.
Re: (Score:2)
Or maybe it's part of a 3-day countdown type event.
So tomorrow we'll probably have a story about a real keylogger that was discovered somewhere else in a Samsung (or maybe another company's) product. But nobody will believe it because of the date, so the password harvest will proceed until a few million people are victims of identity theft.
Then why the adminision of guilt? (Score:2, Insightful)
Re: (Score:3)
Yeah, but wasn't the admission of guilt quoted from an email of the original finder? It's not like we saw a Samsung press release on this.
Re: (Score:3, Insightful)
This is why they didnt give you a supervisors name, or any further details on the phone call. There was nothing resembling evidence; it was all rumor and assertion.
Re: (Score:2)
Of course, it would be better to say "I will report it and we may investigate why it happened.", which is just as short.
Re: (Score:2)
I see no admission of guilt. Instead I see an answer to a question that probably didn't use the word 'keylogger'.
Re: (Score:2)
Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."
Do you think this was official Samsung statement, or customer's interpretation of some random answer he received from a random person (that probably had no idea what he was talking about, but wanted to get rid of annoying customer asap) in a random call center?
I actually can't believe this story was taken seriously for even a split second, considering complete lack of any research or evidence.
Oh well, anything is news these days.
Appropriate quote (Score:5, Insightful)
The following fortune quote accompanied this story for me:
Disturbingly appropriate, considering the story is about people jumping all over a false assumption. But I'm constantly surprised at the number of times a Windows installation with full multilingual support trips anti-malware or anti-virus software. Don't these guys even use their MSDN subscriptions to get a full set of Windows installs to test against?
where is the outrage? (Score:3)
Turn on the TV. Go to any "News" site. Everything is designed to make you react in some way. They especially like to find the most "outraged" person and interview them. /., where is the outrage for things that matter?
It is a bit sad. People will freak out about stuff like this and demand action, yet your government erodes your rights and destroys your country a little bit more each day and the same people are quite.
Tell me
Re: (Score:2)
Or alternatively: "Before pointing fingers, properly research first", which is terser, less pretentious, and made in 20 seconds by yours truly. Also it has the advantage that it doesn't come from a book with lots of false information.
Re: (Score:2)
Problem is, in the ever-changing world, one of the thing is to accuse first and ask questoins later, in order to get those website hits and oh-so-sweet advertiser revenue.
The first ones to break the stories gets the hits and eyeballs. The ones to do the research get left by the wayside, mostly unread while everyone else spreads mistruths because they never saw the followup, read beyond the headline, etc. Hell, it happens on /. too.
Re: (Score:2)
Windows 7 installs its Slovenian information in C:\Windows\sl-SI... so no, a Windows installation with full multilingual support would not trip up this anti-malware/anti-virus scanner (apparently VIPRE)
Don't these guys even use their MSDN subscriptions to get a full set of Windows installs to test against?
Your suggestion actually fails to fix the problem at all.
Re: (Score:2)
Re: (Score:2)
Antivirus are a useful second line of defense, the first line being "keep your crap up to date". I mean, otherwise you cant protect yourself from that 0-day that the vendor wont have a patch for for 2 weeks, even though all the AV firms have a definition out tomorrow.
And if a virus attempts to spread through network share (by replacing folders with EXEs with folder icons), having an AV that detects it is really useful.
Re:Appropriate quote (Score:5, Informative)
I have found that AdBlock does far more to keep malware off a system than any antivirus program out there. Couple that with a decent firewall/NAT box/router, common sense about not running downloaded stuff, and a solid backup system, and that will pretty much make for malware-free computer usage. Using sandboxie doesn't hurt either.
Re: (Score:3)
Or apply the Sagan standard "extraordinary claims require extraordinary evidence".
Unfortunately, "Company puts spyware on their products" is no longer an extraordinary claim
Oh noes (Score:2)
Quick! Call the worldwide boycott off before the entire company loses its 13.5Billion revenue.
On a related note, could Samsung sue the journalists for libel?
Re: (Score:3)
Even if they could, which I doubt, why would they want to bring extra attention to this when it'll just go away tomorrow?
Re: (Score:2)
Because apparently only Slashdot users know about the Streissand effect. Governments and every business on the planet seem not to have heard of it.
Re: (Score:3)
The Streisand effect is generally associated with people doing something silly, realising their mistake and then trying to shut the door after the proverbial horse has bolted.
In this case, I think the thing most likely to invoke the Streisand effect would be if the blogger tried to cover up the whole sorry episode by trying to bully sites mentioning either the original article or the subsequent debunking. I reckon Samsung, OTOH, could sue the blogger with relatively little fear of Streisanding. As long as
Re:Oh noes (Score:5, Insightful)
Could? More like should.
The title of the article was not "Did Samsung install keylogger on its laptop computers?"
No, the title was "Samsung installs keylogger on its laptop computers", though it looks like they've updated it now to
"UPDATE: Samsung keylogger could be false alarm"
Great journalism there. Leap out of the gate screaming "keylogger!!!!" with zero fact checking, but later back off and say "oops we could be wrong"
Re: (Score:2)
Re:Oh noes (Score:5, Insightful)
Everyone who left a comment decrying Samsung in the last article is just as much to blame. You give approval to such antics by your reaction.
Good for Slashdot for following up (Score:5, Insightful)
At least Slashdot has the journalistic ethics to post the follow-up. Good for them. I note that Network World is doing the same.
Yes, I said "journalistic" in the same sentence as "Slashdot." It's important.
Re: (Score:2)
Yet the original story still has not been updated to correct the error.
So much for journalistic ethics.
Re: (Score:2)
the "Part two" on the story has been updated. http://bit.ly/ib5R38 [bit.ly]
UPDATE 3/31/11: Samsung has issued a statement saying that the finding is false. The statement says the software used to detect the keylogger, VIPRE, can be fooled by Microsoft's Live Application multi-language support folder. This has been confirmed at F-Secure and two other publications, here and here. Still no explanation for why Samsung originally confirmed the keylogger's existence to Hassan, as seen below.
UPDATE 3/31/11: GFI Labs, the m
Re: (Score:2)
Then you say, "GFI Labs, the maker of VIPRE, has issued an explanation and apology"
So why do you think Samsung confirmed the existence of a Samsung installed keylogger?
Re: (Score:2)
Re:Good for Slashdot for following up (Score:4, Insightful)
Wouldn't it be better if they updated the *original* story with the correction, instead of posting a new one?
Anybody linking to this story on Slashdot is still linking to an uncorrected version. It's not enough to correct the article; you have to correct the article at the same URL.
Re: (Score:2)
Re: (Score:2)
At least Slashdot has the journalistic ethics to post the follow-up. Good for them.
They're not posting this as penance, they haven't apologised or retracted the original story; they're doing it to gain hits. Same reason they posted the first story without confirmation.
Slashdot has no claim to being described as "journalism", or has any demonstrable professional ethics.
Makes no sense (Score:4, Insightful)
The earlier article quoted Samsung as admitting to placing the software on their computers to gather information. Either that part of the earlier story is false or the current one is. This is not good journalism.
Re: (Score:3, Informative)
It was confirmed by a low level support person who may or may not have understood what was going on.
All the PR and Legal depts had "No Comment" till it was more thoroughly researched.
Re: (Score:2)
That's what they want you to believe. This is obviously a smear campaign to cover up their keylogger.
Re: (Score:2)
I don't care about facts. (Score:5, Funny)
I still hate the keylogging bastards that they are, and I want to see the whole company in jail...
So the keylogger (Score:2)
is a Microsoft product?????
What about their use of Carrier IQ on Android? (Score:3)
http://yro.slashdot.org/comments.pl?sid=2061772&cid=35672358 [slashdot.org]
Notes to self: (Score:2)
Pick up milk and eggs
Pick up dry-cleaning
Don't use VIPRE.
Wife's Laptop (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2)
You did more research, but this idiot got all the press. He thought he had something, so he ran to the media with it, and they ate it up. Of course, he looks really stupid now, but that's only because others were more thorough.
Inb4... (Score:3)
Inb4 all of the commenters from the previous Samsung article come in here and act like they didn't assume that the keylogger was real, didn't yell about how Samsung should/will be persecuted for this, and didn't ask for people to boytt Samsung ;)...
I always hear Slashdotters complaining about "moral panic" and complaining about the "idiots" who don't do their research before making claims... How is this any different? Really, it's no different. Is the level of "corporate hate" on Slashdot really that high as to exclude any common sense (apparently not so common) when dealing with a subject like this where it's impossible to tell whether he was right? He said he was right in the previous article, but why did you blindly trust him? All it takes for a simple, non-assuming comment is to add "If this is true," to the beginning of your comments. It isn't very hard and it doesn't make you look like an idiot when the entire reason you said those things turned out to be bullcrap.
Won't slow down your PC! (Score:3)
The tagline for VIPRE AntiVirus is 'Finally Antivirus Software That Won't Slow Down Your PC!'.
I guess we know why. Who wants to spend all those CPU cycles searching through binaries both in RAM and on disk, comparing them against a database of virus patterns, and performing advanced heuristics checks when it's so much easier to match directory names and call it a day?
Slovenian StarLogger (Score:4, Insightful)
Re:Slovenian StarLogger (Score:4, Informative)
Re: (Score:2)
I checked my newly purchased Samsung laptop last night after I saw the article and it had the /sl folder on it, but it took about half a second and an ounce of brainpower to notice that there was a large number of similar directories that all looked like language/country codes. And they all had the same kind of non-executable file in them.
I'm not Slovenian.
J
What kind of files? Were they all "*.mui"? Windows 7 (and Windows Vista) use c:\Windows\sl-SI for the Slovenian localizatons...
IANS either, but I have just installed the Slovenian Windows 7 language pack, and Slovenian Windows Live Essentials.
Re: (Score:2)
Correction: Windows Live Photo Gallery installs a screensaver to the root Windows directory, which produces a C:\Windows\SL directory if you have the Slovenian language pack installed. However, this shouldn't be exactly hard to check if this is the case, since it's a single MUI file...
77c443b0c85b67a89bb57edcca491d66 *WLXPGSS.SCR.mui
Anything else in there is not from Windows or Windows Live Essentials.
Security Expert? (Score:2)
And is now the laughing-stock of the IT security world.
Nice job moron!
antimal-ware (Score:2)
I don't think it will ever be appropriate to remove the hyphen from "anti-malware". "Antivirus", sure, but "antimal" will always be too close to "animal" for easy parsing as a compound word.
Knee-jerk response is awesome (Score:5, Informative)
John Graham-Cumming has an excellent, level-headed response [jgc.org] to Mohamed Assan's entire "research."
Also confirmed at F-Secure [f-secure.com].
Who will apologize for the pitchforks and torches? (Score:2)
As for individual posters: How many of the people who screamed vitriol at Samsung will now apologize? How many of those who vowed to boycott Samsung in yesterday's thread will admit they were wrong?
I'll bet very few.
We live in a society where people treat indignation like a drug, always ready to believe the negative, always looking to be a victim. Sad times for the species indeed. Will people learn from this, and
Someone some where needs to get sued. (Score:2)
A Simple Mistake? (Score:2)
That's what they'd like you to believe . . .
It is tellingly sad (Score:2)
Re: (Score:2)
But the original writer and now famous Security researcher is MSIA, CISSP, CISA ... That must say something no ?
what do you mean Security Certification are worthless ?
I believe you forgot LOL, SOL and GTFO.
Re: (Score:2)
Re: (Score:2)
Re:So much for being a CISA CISSP MSIA ... (Score:5, Insightful)
Not to mention these gems:
I installed ... security software ... The scan found two instances of a commercial keylogger called StarLogger ... This key logger is completely undetectable ...
So, this program found something which couldn't be found. Check.
After an in-depth analysis of the laptop, my conclusion was that this software was installed by the manufacturer, Samsung. I removed the keylogger software, cleaned up the laptop
Removed the keylogger by removing the folder? Check.
I found the same StarLogger software in the c:\windows\SL folder of the new laptop. The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the years.
So, "false-positive proof." Good to know that your extensive experience running an anti-virus program has yielded perfect results. Don't worry about the fact that you don't actually know what you're talking about.
... logged incident 2101163379 with Samsung Support (SS). First, as Sony BMG did six years ago, the SS personnel denied ... SS changed its story ... SS personnel relented and escalated the incident ...
Can we claim Godwin here? I have a feeling Samsung Support doesn't refer to itself as the SS.
You obviously have some kind of agenda, Mohamed Hassan, MSIA, CISSP, CISA. I know now to never trust anything NetSec Consulting Corp does. Also, congrats on being an "adjunct professor of Information Systems in the School of Business at the University of Phoenix."
Re: (Score:3)
Removed the keylogger by removing the folder? Check
I'm guessing that by 'removing the keylogger', he meant 'let the anti-virus' software do its default recommended action'.
Re: (Score:2)
Can we claim Godwin here? I have a feeling Samsung Support doesn't refer to itself as the SS.
No [wikipedia.org]. The National Socialists don't own the registered trademark on "SS".
Re: (Score:2)
Could have been the poor tech in India had no idea what the question was to begin with...
That quote could have been attributed to system monitoring software used to conserve battery usage for instance.
Re: (Score:2)
Do we even have confirmation that Samsung's tech support is India-based, or is this more FUD/speculation?
Re: (Score:3)
Where did the quote come from? It came from an idiot, apparently. If it was true, only an idiot would admit to it. If it was not true, only an idiot would say it was. I tend to discount what idiots say, as should you.
All those who knew that this was obviously false when it was posted yesterday, raise your hands and link to your comments:
"This is not believable." [slashdot.org] Oh, and let me reiterate. Anyone who actually believed a company would do something like this, is a god damned moron. I mean seriously, what the
Re: (Score:2)
1) The purpose of Sony's rootkit, while unethical, at least made sense. A catch-all keylogger makes no fucking sense. There's "evil with a purpose" and then theres "fucking insano poking at the dragon cuz I'm coked up." What Sony did was the former. What Samsung was alleged to have done is clearly the latter.
2) Sony got smacked down for it. They had to recall their CDs, they were sued in various class actions and various countries. They admitted it was a fuckup and they got slammed for it.
Critical thinking,
Re: (Score:2)
Are you always this much of a worthless, piece-of-shit, asshole?
If my expectation of some minimal level of brain activity in people who make potentially defamatory claims counts as that, then yes.
Re: (Score:3)
Is "One" the slovenian translation of the English word "Three"?
Re: (Score:2)
Because it doesn't install there. I just installed the Slovenian Windows Live Essentials, and there is no C:\Windows\SL directory, there is a C:\Windows\sl-SI directory though from installing the Slovenian language pack.
Modern Windows versions use languagecode-COUNTRYCODE for all of its localizations. There would never be a reason why a modern version of Windows would put localization data in C:\Windows\SL...
Re: (Score:2)
Corrections: Windows Live Photo Gallery installs a Screensaver (which all have to be in C:\Windows, or Windows can't find them... retarded, right?) and that for some godforsaken reason uses a bare languagecode directory for its MUI files. (Even though the rest of Windows has moved on from that, since you know, pt-PT and pt-BR are actually both equally supported... I think they're tier three.)