Are There Keyloggers On Samsung Laptops?

allheart55 (Cindy E) · Mar 31, 2011

by Elinor Mills

A security researcher says he discovered keylogging software installed on two brand-new Samsung laptops that could be used to monitor all activities on the computer remotely.

Mohamed Hassan, founder of NetSec Consulting, discovered StarLogger software on Samsung laptops with model numbers R525 and 540 after running security scanning software
on the systems when he bought them last month, he writes in a guest column in Network World posted today. Windows-based StarLogger starts up when the computer is turned on,
records all keystrokes made on the computer, can be difficult to detect, and can be set to periodically send surreptitious e-mails with information gleaned from the computer to a
predetermined e-mail address, with screen capture images attached. A Samsung representative told CNET this afternoon that the company would looking into the matter. Late this
evening, Samsung Australia said in a statement that the keylogger reports were "not true. Our findings indicate that the person mentioned in the article used a security program called
VIPRE [antivirus software] that mistook a folder created by Microsoft Live Application for...key logging software, during a virus scan." Hassan said when he called and logged an incident
report with Samsung on March 1, support personnel initially denied that keylogging software was on Samsung laptops and then referred him to Microsoft, saying "all Samsung did was
manufacture the hardware," he writes. Eventually, a supervisor got on the phone and confirmed that Samsung put the software on the laptop to monitor machine performance "and to find
out how it is being used." "In other words, Samsung wanted to gather usage data without obtaining consent from laptop owners," Hassan wrote.

Related:

• How to detect and remove StarLogger He said he contacted three public relations representatives at Samsung for comment and went public with the matter after they failed to reply
after one week. The incident could incur the wrath of customers similar to the backlash that occurred after Sony BMG Music Entertainment sold copy-protected compact discs that
installed so-called rootkit software hidden inside computers in 2005 . Sony was forced to recall 4.7 million of the discs.

http:/ ews.cnet.com/8301-27080_3-20048896-245.html

KlickKatt · Mar 31, 2011

Cindy,

I wonder which information is more current. The following is from a newsletter this afternoon, from
PCWorld | Daily Technology News http://www.pcworld.c....nl_dnx_t_crawl

Samsung Cleared of Laptop Keylogger Accusation

It turns out an antivirus suite mistakenly classified a Microsoft folder as a keylogger
By Jeremy Kirk, IDG News Mar 31, 2011 9:19 am

Samsung Electronics' laptops do not contain a secret program that logs keystrokes, security researchers have found, chalking the problem up to a mistake by an antivirus program.

An IT consultant based in Toronto, Mohamed Hassan, said on Wednesday he bought a Samsung R525 and later a R540 laptop and found the StarLogger program made by a company called de Willebois Consulting. StarLogger can log all keystrokes and capture screenshots.

But Samsung and the security company F-Secure did further research and found that the VIPRE antivirus software mistakenly associated a Windows root directory folder called "SL" with StarLogger.

In a statement on its website , Samsung said the SL folder is a Microsoft Live Application folder for multi-language support. The "SL" stands for the Slovenian language, and other folders are installed depending on language, such as "KO" for Korean and "EN" for English.

"Our findings indicate that the person mentioned in the article used a security program called VIPRE that mistook a folder created by Microsoft's Live Application for a key logging software, during a virus scan," Samsung said.

F-Secure bought and tested a series of Samsung laptops -- the R540, RF710, QX310, SF510, X125 and NF310 -- and didn't find StarLogger.

GFI Software, which makes VIPRE, could not be immediately reached for comment.
Click to expand...

KlickKatt · Feb 4, 2014

I just noticed in the same newsletter that I mentioned above - the following article appeared:

Samsung Investigating Report of Keylogger on Its Laptops
By Robert McMillan, IDG News Mar 30, 2011 6:20 pm

.Samsung Electronics is investigating allegations that some models of its R Series laptops contain keylogging software that could be used to record anything typed on the laptop computers.

Mohamed Hassan said he became aware of the issue last month, when he purchased a Samsung R525 at a Best Buy in Toronto. The laptop had keylogging software on it, which he deleted immediately. Two weeks later, Hassan decided he wanted a more powerful machine, so he returned the R525 and bought a new model -- the R540, at a local FutureShop. To his surprise, the keylogger was there too, Hassan said in an interview Wednesday.

Samsung R525 laptop"These were new systems. They weren't used for anything," he said. "I could give them the benefit of the doubt on the first one. But then when I got a second model, a different model from a different store, that tells me that Samsung is aware of the problem."

Hassan, an IT consultant based in Toronto, said that Samsung tech support told him: "We just put it there to find out how the computer is being used."

Samsung Investigates
Samsung spokesman Jason Redmond said that his company is looking into Hassan's allegations. "We take these claims very, very seriously," he said. He had not previously heard of the problem, or heard of de Willebois Consulting, the company that makes the StarLogger software that Hassan said he found on the laptop. "We have no understanding of a relationship with this company and we have no prior knowledge of this software being on our laptops," he said.

De Willebois Consulting did not respond to messages seeking comment for this story. On its website, the company says StarLogger "is completely undetectable and starts up whenever your computer starts up. See everything being typed: emails, messages, documents, web pages, usernames, passwords, and more." The software can also capture screen images, the website says.

Hassan's allegations were published Wednesday in Network World.

If Samsung is responsible for putting the keylogger on the machines, Samsung could be in big trouble, according to Cindy Cohn, legal director for the Electronic Frontier Foundation. "They shouldn't be installing keyloggers on devices that they're selling to the general public. Even if Samsung isn't using it, you're basically setting up someone else to use it," she said.

Samsung R540 laptopAs with Sony BMG's notorious rootkit software, discovered in 2005, if Samsung secretly installed keyloggers on customers' computers, it could lead to civil lawsuits or charges that the company is violating state consumer protection laws. "There are serious criminal offenses possible if they're actually using this device to spy on their customers, but I don't see any evidence of that," Cohn said. "This could be chalked up to poor thinking, or it could be illegal. We just need more information to be able to figure out where it is on this scale."

Keyloggers are commonly used by hackers to steal sensitive information including usernames and passwords from hacked computers, but de Willebois' website describes some legitimate uses for its software: monitoring children's Internet activity or recovering text in the event of a computer crash, for example.

IDG, the parent company of the IDG News Service, also publishes Network World.

Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert's e-mail address is robert_mcmillan@idg.com"]robert_mcmillan@idg.com[/email]
Click to expand...

Perhaps we need to wait for a few more shoes to drop.

allheart55 (Cindy E) · Mar 31, 2011

KlickKatt said: ↑

Cindy,

I wonder which information is more current. The following is from a newsletter this afternoon, from
PCWorld | Daily Technology News http://www.pcworld.c....nl_dnx_t_crawl
Click to expand...

Your article is the most current Klick. The one I posted is dated March 30, 2011 - 1:52 pm.
The article you found is dated March 31, 2011 - 9:19 am. Great find! I'm glad the
topic is, " Are there keyloggers on Samsung laptops?" I guess the answer is, "No there are not!"
Yup, Color my face red......

allheart55 (Cindy E) · Mar 31, 2011

KlickKatt said: ↑

I just noticed in the same newsletter that I mentioned above - the following article appeared:

Perhaps we need to wait for a few more shoes to drop.
Click to expand...

Well, Perhaps I spoke too soon. Very interesting indeed!

BeeCeeBee · Mar 31, 2011

Well, Perhaps I spoke too soon
Click to expand...

Nope! If the original release was wrong then it was they who spoke too soon. We are not the investigators here. Our job is to keep our members informed. So thanks to you both.

KlickKatt · Mar 31, 2011

I just received an email from GFI Labs that would seem to put an end to the story:

Sunbelt Blog

Samsung Laptops do not have a keylogger (and it was our fault)

Posted: 31 Mar 2011 08:31 AM PDT

A Slovenian language directory for Windows Live is causing us considerable headaches this morning, and we have no one to blame but ourselves.

A Network World article has alleged Samsung laptops of having a keylogger. Unfortunately (and to our dismay), the evidence was based off of a false positive by VIPRE for the StarLogger keylogger.

The detection was based off of a rarely-used and aggressive VIPRE detection method, using folder paths as a heuristic. I want to emphasize “rarely”, as these types of detections are seldom used, and when they are, they are subject to an extensive peer review and QA process. (It’s not common knowledge, but folder path detections are actually used by a good number of antimalware products, but are generally frowned upon as a folder that looks clearly like one for malware has the potential of generating just this kind of result — a false positive.)

The directory in question was C:\WINDOWS\SL, and is the Slovenian language directory for Windows Live. This same directory path is used by the StarLogger keylogger.

How does this happen? A researcher has a number of tools at his or her disposal to detect a piece of malware. These include a broad range of detection types based on the malware in question. Sometimes, a simple signature is fine; other times, a more carefully crafted detection is needed. In VIPRE, among some of the detection types are heuristic (meaning, using a method of pattern analysis on the file); behaviorial (looking at the behaviour of a file in VIPRE's emulator to see if it does anything malicious) or signature-based (simply creating a file signature for the file). Part of the heuristic toolkit used might be any number of types of analyses, and these can include looking at the contents of the file for specific patterns that indicate malware. A researcher can also (but rarely) use a folder path as part of a more comprehensive detection set. Imagine you're a researcher: You see the folder name "C:\windows\sl". This is, indeed, something one would never find on a Windows system at the time the detection was written, so the researcher added this folder path to his heuristics for this keylogger. It was peer-reviewed and tested against a broad range of Windows platforms, including every foreign language set. Everything is fine and dandy... except that at some point several years after the original detection was written, Windows Live started using that directory to install Slovenian language files for Windows Live. Samsung started pre-installing Windows Live, including all the languages, and there you have the problem we're having today.

We apologize to the author Mohamed Hassan, to Samsung, as well as any users who may have been affected by this false positive.

False positives do happen, it’s inevitable and like all antivirus companies, we continually strive to improve our detections, while reducing any chance of a false positive. This one (admittedly, an incredibly embarrassing one) made it through our processes, and I have met with the senior managers in the area this morning to handle what happened and to continue to improve our processes.

The false detection is fixed in definition set 8878.
Click to expand...

allheart55 (Cindy E) · Mar 31, 2011

I betcha Samsung is royally ticked off about the bad press they have received over this blunder!
Many consumers will remember only the keylogger story, never hearing about the "false positive"
detection that actually created the vicious rumor.....:unsure:

I don't imagine the explanation and apology will mean to much to much in the scheme of things...
Thanks, Klick. :up:

Plastic Nev · Apr 2, 2011

If you take this line into consideration=

"Everything is fine and dandy... except that at some point several years after the original detection was written, Windows Live started using that directory to install Slovenian language files for Windows Live."

You could say it is Microsoft who are really at fault for creating that language file and using "SL" as the file name.
Back to the old problem of a lack of communications between Microsoft and third party anti virus vendors.
As usual the elbow doesn't know what the knee is doing.

Log in or Sign up

Are There Keyloggers On Samsung Laptops?

allheart55 (Cindy E) Administrator Administrator

KlickKatt Inactive Staff Member

KlickKatt Inactive Staff Member

allheart55 (Cindy E) Administrator Administrator

allheart55 (Cindy E) Administrator Administrator

BeeCeeBee ADMINISTRATOR IN MEMORY

KlickKatt Inactive Staff Member

allheart55 (Cindy E) Administrator Administrator

Plastic Nev SUPER MODERATOR IN MEMORY

Share This Page

Log in or Sign up

Are There Keyloggers On Samsung Laptops?

allheart55 (Cindy E) Administrator Administrator

KlickKatt Inactive Staff Member

KlickKatt Inactive Staff Member

allheart55 (Cindy E) Administrator Administrator

allheart55 (Cindy E) Administrator Administrator

BeeCeeBee ADMINISTRATOR IN MEMORY

KlickKatt Inactive Staff Member

allheart55 (Cindy E) Administrator Administrator

Plastic Nev SUPER MODERATOR IN MEMORY

Share This Page

Useful Searches