Samsung installs keylogger on its laptop computers
networkworld.com
networkworld.com
I started doing it because of the crap they bundle in there, but this seems like an unintended good reason to do so as well.
It wasn't that long ago that you got actual windows install media when you bought a computer.
Oh, I'm afraid that was actually quite a long time ago.
However, the last time I checked, Microsoft did impose a condition that mostly affected laptop manufacturers, such that they were required to provide any genuine Windows customer with real Windows media on request, rather than just some not-quite-real-Windows recovery media. Is this no longer the case?
If that is still a requirement for installing OEM Windows on laptops for sale, maybe a campaign where a significant fraction of Samsung laptop customers suddenly started demanding real media would attract the attention of whatever fool thought this was a good idea. This is not mutually exclusive with an expensive class action lawsuit, of course. }:-)
More recently, helping a friend with a Dell purchase, I could no longer find that option in the online order flow. Maybe if you call them and ask...
(I'm not a regular Dell purchaser.)
With HP, I wasn't even able to pay for an install disc of any sort, and since the recovery portion of the HD was gone I had to buy a copy of Windows. I'll never buy an HP computer for this reason.
(I'm hesitant to download an image from an unknown source.)
I don't know about Windows 7 -- I seem to recall reading that installation disks for it work somewhat differently, but I don't recall the details.
These have worked for my OEM licenses, XP though I remember you needed to use the disk with the correct service pack to install with your software key. (A sp1 key wouldn't work with a sp2 disk and vica versa.)
The links that say msft-dnl.digitalrivercontent are the same as when you buy online (at least when I bought my win 7 professional license for my desktop the iso linked is the same as the one I downloaded).
Those are probably the only ones I would trust, make sure you are indeed going to digitalrivercontent website, download appropriate language and version/arch (prof, home prem 64 or 32)
http://www.windowsvalley.com/unlock-all-editions-from-window...
To get all editions-
4. Just delete the file and finally create the bootable ISO and burn your unlocked disc.
In my case, I'm in the position of occasionally needing to support others who have e.g. Win 7 (most recently, actually, someone with Vista). Sometimes, it's simplest to simply back up their data and re-install. But I may need to supply an installation disk; even if they have one, part of the solution may be installing from a disk minus all the crapware.
I don't do this work regularly, so I'm not part of a community that's constantly, physically swapping disks and utilities and whatnot.
http://answers.microsoft.com/en-us/windows/forum/windows_7-w...
This applies for the first few months, thereafter you can call Microsoft and within a few prompts they will send it out to you, often for free.
Should work in most countries, and is a bit of a backdoor way of getting original install disks.
There is also a way in the EU to get a free linux distro disk if you request it, which was part of the EU antitrust settlement but I can't remember what that was (all of these consumer rights features were part of one settlement or another)
I believe that we are close to being able to 'check-out' a system image that would be downloaded as a VM to a machine (physical machine) where it runs locally as a fully installed OS - but then can be 'checked in' and released once done. A new physical machine comes along and we check out our image.
We can further abstract the user profile data and have it follow the user (there is a company that was recently bought that does this piece... I cant recall the name).
The idea is high-layer virtualization. Where we had virtualized machine, OS, APP and recently infrastructure such as storage - we have virtualized profiles as well. Soon we will have virtual installs.
There is a hybrid model I wrote about some years ago, posted recently to HN as well - which is similar to the Atrix concept. You have all your user profile data on the mobile device and you effectively check-in to a KVM for better screen and input.
I am not sure about the dock of the Atrix, if it has a CPU and GPU for bigger/faster/better -- but this is what I am referring to.
The data profile is tied to the person. Everything else floats - when the use-case calls for better CPU/GPU you check-out the physical device...
My example is really trivial and it only works on Windows, but it works well and demonstrates the concept of passive keystroke logging. Unlike system wide hooks, passive logging just monitors the key states. Sort of like when you are playing a video game and press the 'P' key. The game pauses because it's monitoring the P key's state (up or down) and can tell when it changes. Extend that concept to the entire keyboard and you have a passive keystroke logger.
Passive loggers are more challenging to detect as well and they run just fine as a normal user (no need to be root).
They are not difficult to detect though. Emulate an (obscure) keystroke, wait 5sec and do you own GetAsyncKeyState. If its cleared then another app pulled the keystate via GetAsyncKeyState.
https://gist.github.com/a95f198292c9e453e054
This was originally to be used with malware that needs to run when the user is away from their workstation. You can access p->vkCode in KeyboardProc() to see which keys are pressed.
One interesting thing to note is that if you remove the invisible window/message pumping loop, the program behaves erratically when processing the low-level inputs. I never looked into this.
Strangely, on a clean system most hooks tend to be from the Antivirus (usually hooking filesystem calls for on demand scans).
[1] - http://www.dc4420.org/
Are you implying that you wrote malware?
Better off using a keyboard hook or GetAsyncKeyState as someone suggested.
And if you want to write a 'real' implementation, you write a keyboard filter driver. Or hook NtUserGetAsyncKeyState.
// From the source code:
ks = GetAsyncKeyState( kiter->first );
However there are many known problems with implementations using GAKS. Bad implementations make heavy use of CPU and it's easily detectable. The methods I suggested later in my post are far superior.
It also very wrong to claim that _this_ is how keyloggers are implemented. This technique has been deprecated some time ago.
"After investigating into this matter, it was found that the software installed was in fact Vipre, not the commerical keylogger called StarLogger. The confusion arose because Microsoft's Live Application multi-language support folder, 'SL' folder, was mistaken for StarLogger
"(Live Application is Microsoft's application which provides messenger, email, video, photo gallery functions. Depending on the language, under C:\windows folders 'SL' for Slovak, 'KO' for Korean, 'EN' for English are created.)"
He says "This key logger is completely undetectable," which is clearly untrue (he has allegedly detected it).
If it's logging his keystrokes, it's either storing them locally or sending them off somewhere else, or both. If he's as qualified as he says, he should be able to find out which (find a file that increases in size after a lot of keystrokes, use Wireshark...).
Without confirmation from anyone else that has a Samsung laptop (have just checked my brother's bought 2 months ago and found nothing) this really should be taken with a grain of salt.
I don't think the Samsung "confirmation" brings me to 50% confidence that Samsung actually was logging and capturing people's keystrokes, though.
I would still like to see what the keylogger is actually doing - storing, transmitting, what?
"SL" stands for "Samsung Laptop," some manufacturer-specific software?
And what does he mean by "After the initial set up of the laptop"? What exactly did he do? Couldn't it just mean that the security software he is using to do the scan or the media he is using is infected? I just think this sounds fishy until he's verified it with a completely different set of tools.
EDIT: Sorry for scaring people. Listen, I HATE keyloggers and other invasive software. Here:
My point was that I can see a legit need for low-level auditing by whoever owns the PC. Including such a package that's turned off by default, might be better than forcing a worried parent to sift through 12 keyloggers on Google, half of which are malware, a quarter of which don't work, in order to find out if her 12-year-old is composing YouTube dances and uploading them to 4chan.
His comment is not spam.
His comment caused discussion.
His comment is an opinion, not a false fact.
There are no personal attacks of any kind in his comment, and his language is fine.
His argument is simply unpopular.
None of your responses indicate any of the usual legitimate reasons for downvoting.
So why the downvotes? Do you really want HN to be an echo chamber instead of an arena of civil discussion?
That said, I didn't downvote him, I simply didn't vote. I don't feel a need to vote on everything, and that extends to downvoting.
Yup, there are. Here: http://ycombinator.com/newsguidelines.html
(A clear deviation of the guidelines deserves a downvote, a clear compliance does not. Like any law, there is a grey area in between requiring some amount of judgement. But these guidelines still stand to ground the discussion around what is/isn't a "usual, legitimate" reason for downvoting.)
I actually believe that it's okay to use voting to express whether you agree or disagree with a point. Where's the harm?
I think that the experience of reading HN is enhanced when there's contrast between popular and unpopular ideas. If a post is unpopular, it doesn't mean that I don't read it. If anything, I might pay more attention to it.
In some cases its lack of popularity might spark more debate; like it has in this case.
This is a bad point of view and is what is leading to the degradation of HN as a place for people who see the world through a different lens. We have already lost a lot of beautiful minds due to heard voting. Downvoating is for items that do not belong on HN, nothing more nothing less. If you downvote because you do not agree with an idea you are actively suppressing discussion, no matter how strongly you disagree. Many time from people more brilliant that ourselves.
On HN people I've found that many people use voting to signal whether they agree (or disagree) with something. If that wasn't the case, I'd see my karma rise - rather than rise, fall and fluctuate.
As far as I can tell, if something shouldn't be on HN, we have the ability to flag a post.
I can agree that a post shouldn't needless be hammered into negative space, just as a person's point of view shouldn't be needlessly trampled on in meat-space. But I think that down-voting in general has found a place.
We can say that it might be better to never down-vote - but many users have the ability, and it's a regular practice. Neglecting the fact is a little like ignoring the fact the emperor is wearing no clothes.
You cannot flag comments downvoting is there to discourage, trolls and abuse.
We can say that it might be better to never down-vote - but many users have the ability, and it's a regular practice. Neglecting the fact is a little like ignoring the fact the emperor is wearing no clothes.
I am well aware of that and it has lead to a decline in the standard that HN used to be (while my account may not reflect it I have been around here for a long time, and witnessed the decline first hand). It has been complained about on HN ad nasium. No one is neglecting the fact that it happens, I am just stating that doing so makes HN a worse place the results are obvious and have already lead to some valuable people leaving.
I think the decline is largely due to a rise in meta-discussion about HN and a rise in articles which are mainly designed to self-promote their authors.
I apologise for playing my part in the first ... ;P
Thank you, you learn something new every day.
Really this is all silly, if you upvote for agreement, why not the opposite?
For the record, I personally believe that you're right.
I don't believe down-voting discourages discussion .. I'd argue it often provokes it.
Not that I have been able to figure out the magic that gets you the ability to downvote, but I don't really feel the need.
But indeed it sinks discussions, since the points are one the ways (not the only one) to sort comments.
Not that I'm really worried about it one way or another, though.
That being said, I strongly believe that if a system is being misused, it is the system not the users which are at fault. In this case, my first suggestion (doubtless in need of refinement) is that there should be prominent agree/disagree buttons on every post to allow everyone to express their opinion, and then a separate "flag" link for people to mark spam or useless comments.
From a UI perspective, there are tradeoffs. Multiple vote options means better sorting, more thorough meaning. It also means more confusion and more work.
Also, instead of single vote tallies, has there been social experimentation with preferential voting systems on comments? (This still has the problem of needing more than one flavor of preference.)
I rarely ignore the comments at the bottom of a page - in fact, sometimes the least interesting comments are those that are highest ranked.
What's the difference between having upvote / downvote buttons and agree / disagree buttons?
But although the system never makes posts inaccessible (to do so would, I'm sure, elicit complaints of "censorship"), it does, if you're using a normally configured browser, grey out negative-voted comments so that they require deliberate effort to read (by -4, you need to highlight them with the mouse). It moves lower-voted posts down the page: even if you have time to read every post, which many people don't, you probably lose focus and pay less attention by the time you get down there. And it reduces the karma of people who make downvoted posts, which some people probably care about (e.g. because they lose/don't get the ability to downvote) and some people probably don't, but which is clearly intended as discouragement.
I think it's clear that the system is designed with the assumption that posts that get downvoted are posts that it intends to discourage. (And I think it's agreed for purposes of this discussion that spam and useless comments are deserving of discouragement in a way that comments one happens to disagree with are not.)
I wonder if this kind of metric is used in ycombinator interviews?
You should focus on upvoting. Downvotes should be reserved for abusive, trolling, or spam comments.
Downvoting posts you disagree with amounts to an attempt to suppress contrary opinion.
Someone who desires to keep track of a user's key strokes, for example a corporation. This is coming from someone who consents to monitoring every day.
While I agree it is not good for the singular, non-ignorant person, I'm sure there's a massive market for "Corporate Consumers" who'd like to save a buck instead of spending effort configuring a system.
About having the capability of auditing, I suppose it saves production costs to have one laptop with a switch, as opposed to two laptops with slight hardware or software differences.
I'm surprised you're getting voted up. As much as I disagree with most of the privacy agenda, a lot of their fights are the only thing stopping us from turning Orwellian.
Nothing to hide is pretty arbitrary, too; you mean you have nothing to hide under our current laws. So sure, let them bring the cameras in. Then they'll rewrite the law and you'll suddenly have something to hide.
Yes it was sarcastic. As other commenters said, it's a very common and senseless rhetoric used by anti-privacy politicians. Applying it to an extreme example (like camera in your home) was meant to demonstrate how daft such a stance is.
But I disagree, I think it was a very good spot for it: In my mind, some of the best irony is when it's nearly indistinguishable from truth. So I will take the swinging karma as a complement :D
Worried parents?! Now you're really getting dangerous. I hope you think long and hard before having children if this is the kind of treatment you expect to give them. If you have a 12 year old who is already uploading "dances" (?) to YT/chans, you have much bigger problems than a computer or the internet (hint: mirror).
* When told that did not make sense, SS personnel relented and escalated the incident to one of the support supervisors.
The supervisor who spoke with me was not sure how this software ended up in the new laptop thus put me on hold. He confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."*
http://www.networkworld.com/newsletters/sec/2011/040411sec1....
Just playing devil's advocate here but I wouldn't trust a "support supervisor" to know what he's talking about. He could be talking about the task manager for all we know. He could be just saying whatever he thinks will make this dude get off the phone so he can go grab lunch.
Samsung responds to installation of keylogger on its laptop computers
The supervisor who spoke with me was not sure how this software ended up in the new laptop thus put me on hold. He confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."
In other words, Samsung wanted to gather usage data without obtaining consent from laptop owners.
[…]
We contacted three public relations officers for Samsung for comment about this issue and gave them a week to send us their comments. No one from the company replied.
Really bad way to start an article. Who cares about all these qualifications? Did he find a key logger and how did Samsung respond?
Unfortunately, they have decided to make us wait for the response. That seems really lame IMHO.
Maybe they were trying to pull views from yahoo finance or something?
In the next article, Mr Hassan discusses how Samsung responded to his discovery.
http://www.networkworld.com/newsletters/sec/2011/040411sec1....
"He confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."
Thus, it is false-positive proof? Why wouldn't he test it against other tools? Why wouldn't he try to find out as much about this as you can before writing an accusatory article?
Further, why is he running a full-system security scan on a fresh installation of Windows? Is that normal? If this is a genuine accusation of wrongdoing, then I think that the actual sequence of events and his entire methodology should be disclosed.
If you're a bit paranoid or don't trust the manufacturer (with good reason, apparently) it makes perfect sense to run a scan on a fresh system after initial setup. It's probably not a normal thing to do - pausing all usage of the system to check it for malware - but it makes sense.
> the actual sequence of events and his entire methodology should be disclosed.
Eh, not really. We just need to run the same scans (using lots of different software) on other Samsung laptops, both the same and different models, and see if it detects the logger. If the logger is found, then he's right, if it's not than he's wrong (and probably it's his own software which is infected). His methodology only matters if no supporting evidence for infection is found.
That's what I mean. If he had reason to not trust them, then he should share his reasoning. It would help us to understand why he was conducting a post-installation scan in the first place. It is not normal behavior otherwise.
> Eh, not really. We just need to run the same scans (using lots of different software) on other Samsung laptops, both the same and different models, and see if it detects the logger.
Very true. I meant that it would help us to maximize our success with duplicating his method, which would translate into a higher detection rate if the logger actually exists. If one isn't found, it would help us figure out why he might be seeing what he sees.
From the end of the article:
> Mohamed Hassan, MSIA, CISSP, CISA is the founder of NetSec Consulting Corp, a firm that specializes in information security consulting services.
Most likely a client discovered what appeared to be a keylogger and brought it to NetSec for investigation. Part of that process would have likely been to purchase a new Samsung laptop as part of a simulation to figure out how the keylogger may have been installed. Finding it on a fresh purchase must have been quite surprising!
Not that I put anything above big multinational companies, but some due dilligance would be nice. I guess its all about selling ad impressions. Facts, accuracy, and responsibility come last.
He saw it on TWO laptops.
Not that I put anything above big multinational companies, but some due dilligance would be nice.
He called Samsung to report the issue and had Samsung supervisor confirm that keyloggers are knowingly installed on Samsung laptops in order to monitor usage.
Using the same methodology and the same software - granted, it's "false-positive proof", but there are variables here he didn't account for. Methodology matters.
Samsung supervisor
No, Samsung SUPPORT supervisor. I'm comfortable going out on a limb and hypothesizing that:
A) The Samsung Support Supervisor knew exactly as much about the situation as the author - that is, Nothing. He called telephone support, not the engineering department.
B) It's entirely possible said supervisor bullshitted something that sounded plausible and positive. Again, it's a call center support supervisor, not a press release or any sort of official statement by the company.
The author has an extremely small sample, a very small amount of extremely limited evidence, and nothing that could be called a credible statement from Samsung.
IF Samsung is knowingly doing this it's a terrible policy and a serious problem. IF it's for the reason the supervisor said, it's Incredibly bad policy. IF the article is true, it's possibly criminal. We don't have enough evidence to claim that yet, and until more testing is done and Samsung makes a statement, it's not an Incident, it's a curious event that certainly calls for further investigation.
I've poked around various locations on the machine and run some scans with a number of different tools, but I've discovered nothing untoward, as yet.
My attestation is somewhat of an irrelevance, however, as I've no way of accurately replicating the environment in which Mr Hassan carried out his research. It looks as though I shall simply have to wait and see how this all plays out over the coming days.
Use of such a laptop in the UK would appear to contravene the Computer Misuse Act (on at least a count of unauthorised computer access), if you have a Samsung with this software I suggest you hire a good lawyer and shop around for investment opportunities for your payout.
What are the chances that Samsung have also breached government secrets acts with this in several countries!?
Hopefully the supervisor he talked to was just blowing smoke and trying to get him to go away. If this is legitimately approved by Samsung, somebody needs their head examined.
Or failing that, they should loan me their laptop after they've done some banking and online shopping on it.
On a related note - My bank requires me to use a on-screen virtual keyboard to log into the online account. The keys of this virtual keyboard are randomly rearranged every time it is invoked. That could certainly beat keyloggers.
Binary blob drivers aren't "convenient," they are a violation of your privacy.
The ACPI and EFI firmware interfaces in newer PCs are particularly bad in this respect.
http://www.wilderssecurity.com/showthread.php?t=236384
http://archive.fosdem.org/2007/interview/ronald+g+minnich
ACPI drivers are bytecode blobs that the BIOS passes to the kernel, and expects the kernel to interpret in priveleged mode:
http://lwn.net/2001/0704/kernel.php3
With the old PC BIOS and APM, it is possible to implement a fully Free Software firmware, with no 3rd party binary crap or DRM malware. http://www.coreboot.org/ does this.
'Keystroke' logs include text, pictures and even videos in these toolkits.
Basically if you've been taken over by keystroke logging malware, it'd be safest to assume that everything on the machine's been compromised.
That is ridiculous.
On a machine he just bought, without installing anything else?
Besides, someone has to be first.
...
The supervisor confirmed that Samsung did knowingly put this software on the laptop to "monitor the performance of the machine and to find out how it is being used."
1) Starlogger is part of the security software Hassan installed, and 2) The Samsung person he reached didn't know what he was talking about
I have no idea if this is really what happened, but consider:
Hassan says After the initial set up of the laptop, I installed licensed commercial security software and then ran a full system scan before installing any other software.
This could simply be an embarrassing mistake, compounded by the ignorance of some call center person... I'm waiting for confirmation from others with Samsung systems.
Also missing, evidence it was turned installed and running at bootup, evidence it was sending information anywhere. It should be fairly easy to use the laptop, connect to the internet, and see what data is sent to what server, owned by whom. THAT is evidence. These are just random unimportant files in some random directory until then.
Btw, I am typing this from a Samsung R510 laptop. Fortunetaly I don't use crappy windows. I run Gentoo Linux.
I have a much classier Keyboard Concierge.
(Who came up with the idea to spin the fact that Macs are less attractive to black-hats into Macs being more secure anyway?)
A reasonable observation followed by a stupid effectively ad hominem attack. The reason your Linux PC is free from the Samsung keylogger (if it does exist) is only because there's little to no incentive to bother with attacking Linux users. Do you really believe Microsoft has spent billions in research and hiring the brightest minds in technology to create an inherently insecure OS, or is it more likely that the incredibly large userbase creates much greater incentives for security attacks?
I assume that they must have a way to unlock the account I just hope it's not a full time remote control like mentioned in this article. You can be sure of one thing - I will never buy from HP again.
As far as playing video files, that seems like it might have been part of testing - making sure it can handle a tiny bit of stress.
If that was the case then OK. I also understand running things to check if they work - that's why I didn't make a problem out of it.
I am not OK in changing/running things on the machine without contacting the owner. This makes a user uncomfortable.
"I returned that laptop to the store where I bought it and bought a higher Samsung model (R540) from another store."
I will wait for confirmation/proof in either direction before drawing any conclusion regarding possible "defamation" on the authors part.
Also: a possible publicity attack from someone who has just started up a security consultancy... But this could rebound on him due to his EXTREMELY sloppy work and total lack of forensic skill.
What I would be interested to know is if the logger actually phones home, and if so, to where. That would give fairly conclusive proof if Samsung did it or someone else. If it's just logging stuff locally then what's the point? Maybe Samsung (if Samsung is indeed the culrpit) could claim it's for tech support reasons?
I think you are exaggerating this thing too much.
When you purchase a laptop, at least in my experience, it records the serial number of the laptop purchased. Now, generally you don't purchase a laptop in cash (At least in the states, but that really has to do with overzealous cops who think anything over a hundred dollars is drug money), you use a credit/check card. What this means is at checkout they have an address, and name (From the card) and a serial number.
You go home, and type away, log in to Facebook, do whatever you normally do, all the while keylogger is running away in the background. NSA walks over to Samsung and says "Hey, can we get those keylogger results? Great, here's your million dollars", takes those, then sees that John Doe is searching for poison on Google. They run off, and arrest him.
Basically, that information would be NSA's wetdream.
Is this true? Probably not, but it's one possible motive.
If it was Samsung's responsibility (big if at this stage obviously) then I'd actually be more scared if they didn't install it on purpose.
I get that large corporations intentionally do bad things for money but I kind of assume that they're competent enough that they don't accidentally let their master install for a new laptop get infected with a key logger. I'm not saying that I believe them to be completely competent, just that the level of cock ups I expect from them doesn't run to this.
For me if they did install it accidentally then that's worse than them installing it deliberately for some ill considered audit or support purpose.
I don't believe any corporation can be 'good' or 'evil'. Corporations are comprised of people - some of whom will choose to do 'bad things'.
Digital technology provides a huge amount of power to those who have access to it. People are necessarily subject to human emotions and motivations - some will choose to do things which place people at risk.
Transparency and division of power within an organisation needs to be set-up and maintained to prevent abuses from occurring .. but I'd imagine, in most cases the stage has already been set to allow this kind of thing to happen without a corporation's knowledge.
"Never attribute to malice that which is adequately explained by stupidity."
I assume them to be broadly technically competent in so much as they won't let their master install get infected with a key logger.
I'm happy to accept that they may be incompetent when it comes to making decisions about whether it would be a good idea to install a key logger for support or audit purposes.
http://findarticles.com/p/articles/mi_qn4188/is_20070107/ai_...