14 ms·
Confirmed: Samsung is not shipping keyloggers
- nickolai 16y agoI'm no expert of Antivirus software, but figuring whether something is a threat by its _folder name_ ??? With all the money going into the industry? That has to be some sort of april fool's prank gone really bad.
- JoachimSchipper 16y agoAnti-virus software is essentially useless against attackers writing their own code anyway (evading a few signatures is not that hard). Of course, these guys are not even trying.
- jpr 16y agoIsn't the whole "security industry" a prank gone bad?
- JoachimSchipper 16y agoNot everything is useless. Code auditing is not necessarily useless; looking at the physical security of smart cards is not necessarily useless (but it looks like they could use some tougher certifications); pentesting/social engineering can have its uses. That said, "security appliances" and other magical solutions tend to be rather imperfect. tptacek (of http://insecure.org/stf/secnet_ids/secnet_ids.pdf http://insecure.org/stf/secnet_ids/secnet_ids.pdf) may have something to say about that, too.
- ryan-allen 16y agoEveryone I've met who's been working in the "IT Security Industry" have been exceptionally coy about what they test for and how. After a few drinks I've managed to get out that they're testing for "XSS, and SQL injection, you know things like that". It stinks of proprietary crap and I wonder what it would look like if they took a more OSS approach? When you can't even talk about XSS testing without a bit of prodding as if it's something exceptional it really makes me wonder what on earth these guys are selling.
- JoachimSchipper 16y agoI've never done anything with them, but e.g. http://www.rootlabs.com/engineer-job.html http://www.rootlabs.com/engineer-job.html sounded a lot more interesting than what you describe. On the open-source front, you find stuff like Metasploit, nmap, Snort, previously Nessus (forked as OpenVAS), web stuff like Nikto, etc. Don't forget that lots of "programmers" are barely-skilled and working on VBA macros - one label can cover a wide range of skill.
- maigret 16y agoI've met some guys who were pretty fit in encryption topics / key management etc on whole corporations. And it actually works, so you rarely hear about that. Quite some skills are needed to master that actually.
- tptacek 16y agoThere are a whole lot of charlatans in the field. Certifications and credentials are often a good tip-off.
- darren_ 16y agoAV software is written to pass the tests of AV software reviewers. This is subtly but importantly different from "written to accurately detect and block malware"; in particular, it's extremely difficult for a reviewer to test an AV's ability to block completely novel malware (unless they're a malware author themselves or connected with someone who is). So, people tend to set the AV software to scanning a folder full of known samples and judging the software on how many it detected (this is a nice, easy metric: you can make bar graphs out of it!) - in this situation, if chucking in a signature for C:\windows\SL gives you an easy extra malware detection at the cost of a false positive (that no reviewer's going to spot anyway), it's a no brainer.
- ryan-allen 16y agoThis has got to get to 400+ points. For those who took the day off and will continue to believe the sensationalism before it pops off the front page? To be damned! EDIT: I mean, this is the only tech news site I read. I don't know if I'm in the same boat so to speak.
- Devilboy 16y agoGot your wish, 400+ now!
- 16s 16y agoFalse positives are the bane of IT security products in general. I would say that 90% of issues reported are FPs and the end user is expected to figure that out, confirm then double confirm before reporting it as a potential issue.
- CaptainZapp 16y agoI can't help it. But the whole "security software" business really reminds me of the mob. Nice laptop you have here; would be a shame if something would happen to it!
- alecco 16y agoYou mean the "antivirus software" industry.
- burgerbrain 16y agoSince when have these guys limited themselves to just being antivirus vendors?
- alecco 16y agoPrecisely.
- Construct 16y agoThis is a good reminder to always do your homework before making such a strong accusation. Samsung's reputation is probably largely undamaged, other than among people who just read the headlines on news aggregator sites. Even searching for 'Samsung Key Logger' pulls up mostly articles about the false alarm situation. Mohamed Hassan [MSIA, CISSP, CISA and graduate of the Master of Science in Information Assurance (MSIA) program from Norwich University in 2009 as the original article prominently states], on the other hand, is probably not so lucky. Any Google search on his name from now on will probably reveal this whole debacle. Furthermore, I wouldn't be surprised if he just opened himself up to legal action by Samsung.
- grannyg00se 16y agoTo be fair, Mohamed Hassan did contact Samsung support and they didn't clear up the issue. In fact, I believe they may have even confirmed that there was a key logger installed! At that point his due dilligence has been done and he has confirmation. He doesn't need to do anything further than that. Shame on Samsung support for such a pathetic showing.
- dereg 16y agoHe did not fulfill his due diligence. Not if they're going to add this to the article: "Mohamed Hassan, MSIA, CISSP, CISA is the founder of NetSec Consulting Corp, a firm that specializes in information security consulting services. He is a senior IT Security consultant and an adjunct professor of Information Systems in the School of Business at the University of Phoenix." If they're going to pass him off as an expert, then he better be doing analysis that a normal lay-man can't do. If he has the credentials, then why is he basing his claim off of a conversation with low-level customer support?
- deleted 16y ago[deleted]
- raghava 16y agoWait, University of Phoenix? Isn't it the same university associated with scams and sham degrees, am I wrong?
- tiki-tiki 16y agoWell, I'm not longer buying Samsung anyway. That's for sure.
- estel 16y agoCare to explain why?
- richbradshaw 16y agoThey named a folder SL. Two letter folder name on a non unix system?
- burgerbrain 16y agoNice try at a cheap jab, but 3 or 4 character directory names are typical of unix systems, not 2. https://secure.wikimedia.org/wikipedia/en/wiki/Filesystem_Hierarchy_Standard https://secure.wikimedia.org/wikipedia/en/wiki/Filesystem_Hi... Not a single 2 letter directory name.
- mootothemax 16y agoThey named a folder SL. Read the article - that's Microsoft's work, not Samsung's.
- getsat 16y agoAre you also avoiding Toyota automobiles?
- cake 16y agoIf you Google http://www.google.com/search?q=samsung+keylogger+monitor+the+performance+of+the+machine http://www.google.com/search?q=samsung+keylogger+monitor+the... You'll have thousands of quotes from a so-called "Samsung supervisor" who "said it's used to "monitor the performance of the machine and to find out how it is being used." What is this bullshit ? From where did the quote come from ? Amazing how most are just copy-paste. It just prove that very few online news websites verify their source if the keylogger claim is false.
- originalgeek 16y ago"It is better to remain silent and be thought a fool than to open one's mouth and remove all doubt." --Abraham Lincoln
- ricarr 16y agoNot his most honest statement. "One's mouth", he says, but obviously he means "your mouth".
- falcolas 16y agoPerhaps I read it wrong, but the article never says Samsung didn't ship a keylogger, it just indicates that the AV software can make false positives based on a folder. Can we get a link to an article that actually checks a Samsung laptop (and lists their methodology, not this "Duh, there were not any keyloggers") instead of anecdotal evidence and attacking the previous reseaerchers methods? Even if the previous guy was wrong, at least he listed all his methods for review.
- kenjackson 16y agoThe article says two things: 1) The whole saga was caused by a bad antivirus alert. This story never even happens if not for that. 2) They checked a set of Samsung laptops and found no trace of keylogger software. See http://www.f-secure.com/weblog/archives/00002132.html http://www.f-secure.com/weblog/archives/00002132.html Is there more you'd like to see be done?
- falcolas 16y agoYes (I did see the link back to the original article). Specifically, I'd like some more information about their methodology. 1) How did they verify there were no key loggers (is their AV program set to identify StarLogger instances) 2) What subset of Samsung laptops did they check 3) Did they check from more than one source 4) Did they verify that the laptops they checked haven't been wiped & reimaged with the local store's base computer image (such as with Best Buy) With out some of this basic data, their findings are perhaps more suspect than the original article (not that I believe Samsung is doing this, I just disagree that their conclusions are as cut and dried as they, and the link title, indicate).
- kenjackson 16y agoAt this point we have no more evidence that Samsung has keyloggers than Thinkpads or MacBook Pros. We really should be doing what you suggest for all brands and models of laptops. There's no evidence to suggest a specific issue with Samsung at this point. Even the antivirus manufacturer who detected the problem has acknowledged they made a mistake. http://sunbeltblog.blogspot.com/2011/03/samsung-laptops-do-not-have-keylogger.html http://sunbeltblog.blogspot.com/2011/03/samsung-laptops-do-n... A pretty first class post in my opinion. It would be like a newspaper reporting that "Falcolas kills 5 people!" And then turns out that you actually saved five people from drowning, and the newspaper prints a retraction. But then someone says, "But can you prove he didn't also kill five people at some point along the way? No one has really come out to say that he's never killed five people." Sure you may have, but at that point we have no reason to believe you have moreso than anyone else.
- nate23342 16y agoCustomer service Reps would NEVER have the authority to tell you that there is secret Key Logger on your computer. So if a customer Rep is telling you something like that, he is either trying to get fired or there is a miscommunication.
- pkteison 16y agoThe laptop story yesterday led me to learn about CarrierIQ on my cell phone, which was equally disturbing. Maybe the laptop was a false alarm, but my Samsung cell phone did indeed have a keylogger on it. So I'm not inclined to cut them a lot of slack right now. http://forum.xda-developers.com/showpost.php?p=11763089 http://forum.xda-developers.com/showpost.php?p=11763089
- crististm 16y agoGreat news... but what's with the SL folder? The report does not say what SL folder contains on a new laptop. Anyway, pretty dumb to check for viruses by folder name.
- perspective 16y agoI sure hope someone got fired for that one snicker
- Trufa 16y agoThough it is easy to say now, looking back, Mr. Hassan's investigation was far less in depth that it should have been for such a serious accusation.
- todd3834 16y ago"The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the years." Mohamed's lesson: Just because you were unable to prove a false-positive with the same program for 6 years doesn't mean there weren't any.
- unreal37 16y ago"A lie can travel halfway round the world while the truth is putting on its shoes." -- often attributed to Mark Twain The original article was so poorly fact checked. It really reflects poorly on Mohamed Hassan (and all his fancy yet meaningless credentials) and M. E. Kabay (who apparently worships Mr Hassan unquestioningly). I will not hold my breath out for a public apology from either of those two, although they are the ones who owe Samsung one. And the irony is in fact delicious. A security expert finds a virus using an anti-virus scanner tool, and confirms it with some call center employee with the company. What does being a "security expert" have to do with any of that? My 10 year old nephew could have done that!
- ricarr 16y agoPerhaps being naive but this is a classy move by GFI Labs. Also somewhat pointed, if you read between the lines, but am not sure if saying "it was our fault" was/is legally sound? http://sunbeltblog.blogspot.com/2011/03/samsung-laptops-do-not-have-keylogger.html http://sunbeltblog.blogspot.com/2011/03/samsung-laptops-do-n... (source) [edit to make quote clear] -- quote -- GFI LABS Blog: Samsung Laptops do not have a keylogger (and it was our fault) A Slovenian language directory for Windows Live is causing us considerable headaches this morning, and we have no one to blame but ourselves. A Network World article has alleged Samsung laptops of having a keylogger. Unfortunately (and to our dismay), the evidence was based off of a false positive by VIPRE for the StarLogger keylogger. The detection was based off of a rarely-used and aggressive VIPRE detection method, using folder paths as a heuristic. I want to emphasize “rarely”, as these types of detections are seldom used, and when they are, they are subject to an extensive peer review and QA process. (It’s not common knowledge, but folder path detections are actually used by a good number of antimalware products, but are generally frowned upon as a folder that looks clearly like one for malware has the potential of generating just this kind of result — a false positive.) The directory in question was C:\WINDOWS\SL, and is the Slovenian language directory for Windows Live. This same directory path is used by the StarLogger keylogger. How does this happen? A researcher has a number of tools at his or her disposal to detect a piece of malware. These include a broad range of detection types based on the malware in question. Sometimes, a simple signature is fine; other times, a more carefully crafted detection is needed. In VIPRE, among some of the detection types are heuristic (meaning, using a method of pattern analysis on the file); behaviorial (looking at the behaviour of a file in VIPRE's emulator to see if it does anything malicious) or signature-based (simply creating a file signature for the file). Part of the heuristic toolkit used might be any number of types of analyses, and these can include looking at the contents of the file for specific patterns that indicate malware. A researcher can also (but rarely) use a folder path as part of a more comprehensive detection set. Imagine you're a researcher: You see the folder name "C:\windows\sl". This is, indeed, something one would never find on a Windows system at the time the detection was written, so the researcher added this folder path to his heuristics for this keylogger. It was peer-reviewed and tested against a broad range of Windows platforms, including every foreign language set. Everything is fine and dandy... except that at some point several years after the original detection was written, Windows Live started using that directory to install Slovenian language files for Windows Live. Samsung started pre-installing Windows Live, including all the languages, and there you have the problem we're having today. We apologize to the author Mohamed Hassan, to Samsung, as well as any users who may have been affected by this false positive. False positives do happen, it’s inevitable and like all antivirus companies, we continually strive to improve our detections, while reducing any chance of a false positive. This one (admittedly, an incredibly embarrassing one) made it through our processes, and I have met with the senior managers in the area this morning to handle what happened and to continue to improve our processes. The false detection is fixed in definition set 8878. Alex Eckelberry General Manager, GFI Security
- visakhcr 16y agoFrom the original post which started all this:http://www.networkworld.com/newsletters/sec/2011/032811sec2.html http://www.networkworld.com/newsletters/sec/2011/032811sec2.... "After an in-depth analysis of the laptop, my conclusion was that this software was installed by the manufacturer, Samsung. I removed the keylogger software, cleaned up the laptop, and continued using the computer." So, the author, Mohamed Hassan was able to uninstall a software which was never installed? I think he would have deleted the folder in question and called that un-installing!!
- elessar0x3 16y agoI like this whole debacle. I think it ended well. HN, and the power of news aggregating/forum/linking sites wield a decent amount of media power. I like that - because it's one of the instances where the collective mind has greater intelligence than any one individual. It confirms the notion that tech producers need to pay attention to the tech community and shortens the distance between the two, which I think is a good thing.
- zachahack 16y agoCerts after your name are no substitute for common sense and good practices.
- spacemanaki 16y agoWow, what a waste of everyone's time: > [UPDATE 3/31/11: Mich Kabay writes: A Samsung executive personally flew from Newark, N.J., to Burlington, Vt., carrying two unopened boxes containing new R540 laptop computers. These units were immediately put under seal and details recorded for chain-of-custody records. At 17:40, Dr Peter Stephenson, Director of the Norwich University Center for Advanced Computing and Digital Forensics, began the detailed forensic analysis of the disks. We expect results by Monday.] http://www.networkworld.com/newsletters/sec/2011/040411sec1.html http://www.networkworld.com/newsletters/sec/2011/040411sec1....