Skip Links

Samsung responds to installation of keylogger on its laptop computers

Security Strategies Alert By M. E. Kabay and Mohamed Hassan Mohamed Hassan, Network World
March 30, 2011 11:15 AM ET
Sign up for this newsletter now!

The long view of security strategies for your network.

In the first part of this two-part report, MSIA 2009 graduate Mohamed Hassan told of discovering a keylogger on two different models of Samsung portable computers. Today he continues the story. Everything that follows is Mr Hassan's own work with minor edits.

* * *

On March 1, 2011, I called and logged incident 2101163379 with Samsung Support (SS). First, as Sony BMG did six years ago, the SS personnel denied the presence of such software on its laptops. After having been informed of the two models where the software was found and the location, SS changed its story by referring the author to Microsoft since "all Samsung did was to manufacture the hardware." When told that did not make sense, SS personnel relented and escalated the incident to one of the support supervisors.

The supervisor who spoke with me was not sure how this software ended up in the new laptop thus put me on hold. He confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."

In other words, Samsung wanted to gather usage data without obtaining consent from laptop owners.

While in the Sony BMG security incident described in the first article in this pair one had to buy and install the CD on one's computer, Samsung has gone one step further by actually preinstalling the monitoring software on its brand laptops. This is a déjà vu security incident with far reaching potential consequences. In the words of the of former FTC chairman Deborah Platt Majoras, "Installations of secret software that create security risks are intrusive and unlawful." (FTC, 2007).

Samsung's conduct may be illegal; even if it is eventually ruled legal by the courts, the issue has legal, ethical, and privacy implications for both the businesses and individuals who may purchase and use Samsung laptops. Samsung could also be liable should the vast amount of information collected through StarLogger fall into the wrong hands.

[Mich Kabay adds:]

We contacted three public relations officers for Samsung for comment about this issue and gave them a week to send us their comments. No one from the company replied.

Good luck, Samsung! We see a class-action lawsuit in your future….

* * *

Mohamed Hassan, MSIA, CISSP, CISA is the founder of NetSec Consulting Corp, a firm that specializes in information security consulting services. He is a senior IT security consultant and an adjunct professor of Information Systems in the School of Business at the University of Phoenix.

Read more about security in Network World's Security section.

M. E. Kabay, PhD, CISSP-ISSMP, specializes in security and operations management consulting services and teaching. He is Chief Technical Officer of Adaptive Cyber Security Instruments, Inc. and Associate Professor of Information Assurance in the School of Business and Management at Norwich University. Visit his Web site for white papers and course materials.

Twitter search results powered by Topsy
Comments (41)
Login
Forgot your account info?

Format, Fdisk, Reinstall (doo dah, doo dah)By Anonymous on March 30, 2011, 12:59 pmThe only "safe" option is to throw out the Samsung installed OS and install your own from trusted media, which will void your warranty. You might be able to seek...

Reply | Read entire comment

Spread the wordBy Anonymous on March 30, 2011, 1:40 pmEven if it's just a hint of "data-gathering/mining", you should spread this all over the net (Twitter, Facebook..etc) Get under Samsung's skin. If it hurts their...

Reply | Read entire comment

are you kidding me?By Anonymous on March 30, 2011, 2:02 pmYou found a keylogger and don't tell us the name of the binary / process or how to check if we have it, too?

Reply | Read entire comment

Reading comprehension fail.By Anon on March 30, 2011, 2:35 pmReading comprehension fail. Try reading part 1, where he mentions the name of the key logger, and where you can find the files it places on your disk.

Reply | Read entire comment

Keyloggers on SamsungBy Nathan B. on March 30, 2011, 3:45 pmI am using a Samsung Q430 laptop; has anyone heard of these keyloggers being found on this model? Also, would Microsoft Security Essentials discover and eliminate...

Reply | Read entire comment

Let me guess... Next statement from Samsung: "Most people, I thiBy Anonymous on March 30, 2011, 4:08 pmLet me guess... Next statement from Samsung: "Most people, I think don't even know what a Keylogger is, so why should they care?" Sony, Samsung... these companies...

Reply | Read entire comment

View all comments

Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed