Feeds

Testing confirms Samsung keylogger rumour just a false alarm

Keep calm and carry on

High performance access to file storage

Updated Antivirus testers have backed up Samsung's protestations that the detection of keylogging software on brand-new Samsung laptops was just a false alarm.

Mohamed Hassan, founder of security consultancy NetSec, raised the alarm after a scan revealed that two newly purchased Samsung laptops were infected with StarLogger, a commercial keylogger. Hassan investigated the matter before working on a story for NetWork World that compared the incident to the infamous Sony BMG rootkit fiasco of 2005.

It was suggested that Samsung was using underhand methods to extract market research, monitoring user activity without their knowledge or consent in the process. Hassan was eventually put through to a Samsung support centre manager who told him that Samsung had pre-loaded software to "monitor the performance of the machine and to find out how it is being used".

Samsung quickly denied it was doing anything of the sort before issuing a more detailed statement saying that the confusion stemmed from the installation of the Microsoft Live! application suite. The Slovenian language version of the suite creates a folder called C:\Windows\SL, the same folder name as is used by the StarLogger application and it was this that was causing alarm bells to ring.

Testing by antivirus researchers this morning confirmed that VIPRE Antivirus detects 'StarLogger' after creating a 'SL' folder on a clean PC. Even an empty folder with no files in it creates this behaviour, as illustrated in a test screenshot here.

Although the whole incident (which excited a great deal of commentary from antivirus vendors – examples here and here) has therefore been revealed as a false alarm, encountered in good faith, it does raise a couple of secondary questions. Firstly, why VIPRE Antivirus, from GFI Software, detects malware in empty folders simply because of their name, and secondly about the quality of information provided by Samsung's tech support staff. ®

Update

GFI, which publishes VIPRE, has confirmed that the whole kerfuffle was down to a false alarm.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.