5 ms·

The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the

by albedoa 16y ago

The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the years. Thus, it is false-positive proof? Why wouldn't he test it against other tools? Why wouldn't he try to find out as much about this as you can before writing an accusatory article? Further, why is he running a full-system security scan on a fresh installation of Windows? Is that normal? If this is a genuine accusation of wrongdoing, then I think that the actual sequence of events and his entire methodology should be disclosed.

drzaiusapelord 16y ago
Wow, that's a lot of faith in the AV industry and definition based AV. Perhaps Mr. Security Consultant should realize the limitations of his tools and the importance of doing random samples. He seriously saw this on one laptop and is accusing Samsung of a conspiracy? Not that I put anything above big multinational companies, but some due dilligance would be nice. I guess its all about selling ad impressions. Facts, accuracy, and responsibility come last.
- capstone 16y ago
  He seriously saw this on one laptop and is accusing Samsung of a conspiracy? He saw it on TWO laptops. Not that I put anything above big multinational companies, but some due dilligance would be nice. He called Samsung to report the issue and had Samsung supervisor confirm that keyloggers are knowingly installed on Samsung laptops in order to monitor usage.
  - danielsoneg 16y ago
    He saw it on TWO laptops. Using the same methodology and the same software - granted, it's "false-positive proof", but there are variables here he didn't account for. Methodology matters. Samsung supervisor No, Samsung SUPPORT supervisor. I'm comfortable going out on a limb and hypothesizing that: A) The Samsung Support Supervisor knew exactly as much about the situation as the author - that is, Nothing. He called telephone support, not the engineering department. B) It's entirely possible said supervisor bullshitted something that sounded plausible and positive. Again, it's a call center support supervisor, not a press release or any sort of official statement by the company. The author has an extremely small sample, a very small amount of extremely limited evidence, and nothing that could be called a credible statement from Samsung. IF Samsung is knowingly doing this it's a terrible policy and a serious problem. IF it's for the reason the supervisor said, it's Incredibly bad policy. IF the article is true, it's possibly criminal. We don't have enough evidence to claim that yet, and until more testing is done and Samsung makes a statement, it's not an Incident, it's a curious event that certainly calls for further investigation.
  - drzaiusapelord 16y ago
    Really? Confirmation from a 1-800 support monkey? We're really grasping at straws here.
sorbus 16y ago
> Further, why is he running a full-system security scan on a fresh installation of Windows? Is that normal? If you're a bit paranoid or don't trust the manufacturer (with good reason, apparently) it makes perfect sense to run a scan on a fresh system after initial setup. It's probably not a normal thing to do - pausing all usage of the system to check it for malware - but it makes sense. > the actual sequence of events and his entire methodology should be disclosed. Eh, not really. We just need to run the same scans (using lots of different software) on other Samsung laptops, both the same and different models, and see if it detects the logger. If the logger is found, then he's right, if it's not than he's wrong (and probably it's his own software which is infected). His methodology only matters if no supporting evidence for infection is found.
- albedoa 16y ago
  > If you're a bit paranoid or don't trust the manufacturer (with good reason, apparently) it makes perfect sense to run a scan on a fresh system after initial setup. That's what I mean. If he had reason to not trust them, then he should share his reasoning. It would help us to understand why he was conducting a post-installation scan in the first place. It is not normal behavior otherwise. > Eh, not really. We just need to run the same scans (using lots of different software) on other Samsung laptops, both the same and different models, and see if it detects the logger. Very true. I meant that it would help us to maximize our success with duplicating his method, which would translate into a higher detection rate if the logger actually exists. If one isn't found, it would help us figure out why he might be seeing what he sees.
  - BrandonM 16y ago
    > That's what I mean. If he had reason to not trust them, then he should share his reasoning. From the end of the article: > Mohamed Hassan, MSIA, CISSP, CISA is the founder of NetSec Consulting Corp, a firm that specializes in information security consulting services. Most likely a client discovered what appeared to be a keylogger and brought it to NetSec for investigation. Part of that process would have likely been to purchase a new Samsung laptop as part of a simulation to figure out how the keylogger may have been installed. Finding it on a fresh purchase must have been quite surprising!

by albedoa 16y ago

drzaiusapelord 16y ago

Wow, that's a lot of faith in the AV industry and definition based AV. Perhaps Mr. Security Consultant should realize the limitations of his tools and the importance of doing random samples. He seriously saw this on one laptop and is accusing Samsung of a conspiracy? Not that I put anything above big multinational companies, but some due dilligance would be nice. I guess its all about selling ad impressions. Facts, accuracy, and responsibility come last.

capstone 16y ago
He seriously saw this on one laptop and is accusing Samsung of a conspiracy? He saw it on TWO laptops. Not that I put anything above big multinational companies, but some due dilligance would be nice. He called Samsung to report the issue and had Samsung supervisor confirm that keyloggers are knowingly installed on Samsung laptops in order to monitor usage.
- danielsoneg 16y ago
  He saw it on TWO laptops. Using the same methodology and the same software - granted, it's "false-positive proof", but there are variables here he didn't account for. Methodology matters. Samsung supervisor No, Samsung SUPPORT supervisor. I'm comfortable going out on a limb and hypothesizing that: A) The Samsung Support Supervisor knew exactly as much about the situation as the author - that is, Nothing. He called telephone support, not the engineering department. B) It's entirely possible said supervisor bullshitted something that sounded plausible and positive. Again, it's a call center support supervisor, not a press release or any sort of official statement by the company. The author has an extremely small sample, a very small amount of extremely limited evidence, and nothing that could be called a credible statement from Samsung. IF Samsung is knowingly doing this it's a terrible policy and a serious problem. IF it's for the reason the supervisor said, it's Incredibly bad policy. IF the article is true, it's possibly criminal. We don't have enough evidence to claim that yet, and until more testing is done and Samsung makes a statement, it's not an Incident, it's a curious event that certainly calls for further investigation.
- drzaiusapelord 16y ago
  Really? Confirmation from a 1-800 support monkey? We're really grasping at straws here.

sorbus 16y ago

> Further, why is he running a full-system security scan on a fresh installation of Windows? Is that normal? If you're a bit paranoid or don't trust the manufacturer (with good reason, apparently) it makes perfect sense to run a scan on a fresh system after initial setup. It's probably not a normal thing to do - pausing all usage of the system to check it for malware - but it makes sense. > the actual sequence of events and his entire methodology should be disclosed. Eh, not really. We just need to run the same scans (using lots of different software) on other Samsung laptops, both the same and different models, and see if it detects the logger. If the logger is found, then he's right, if it's not than he's wrong (and probably it's his own software which is infected). His methodology only matters if no supporting evidence for infection is found.

albedoa 16y ago
> If you're a bit paranoid or don't trust the manufacturer (with good reason, apparently) it makes perfect sense to run a scan on a fresh system after initial setup. That's what I mean. If he had reason to not trust them, then he should share his reasoning. It would help us to understand why he was conducting a post-installation scan in the first place. It is not normal behavior otherwise. > Eh, not really. We just need to run the same scans (using lots of different software) on other Samsung laptops, both the same and different models, and see if it detects the logger. Very true. I meant that it would help us to maximize our success with duplicating his method, which would translate into a higher detection rate if the logger actually exists. If one isn't found, it would help us figure out why he might be seeing what he sees.
- BrandonM 16y ago
  > That's what I mean. If he had reason to not trust them, then he should share his reasoning. From the end of the article: > Mohamed Hassan, MSIA, CISSP, CISA is the founder of NetSec Consulting Corp, a firm that specializes in information security consulting services. Most likely a client discovered what appeared to be a keylogger and brought it to NetSec for investigation. Part of that process would have likely been to purchase a new Samsung laptop as part of a simulation to figure out how the keylogger may have been installed. Finding it on a fresh purchase must have been quite surprising!