also @ TechSpot: Building a Thin Mini-ITX PC: Small and Silent Performance

Samsung caught selling new computers with a keylogger (update: it was a false positive)

By

On March 30, 2011, 5:00 PM

Update: Samsung has issued a statement via its Samsung Tomorrow blog denying that its notebooks are shipping with any kind of keylogger software. It's been concluded that Vipre Antivirus was reporting a false positive on the folder C:WINDOWSSL, which corresponds to the Slovenian language directory for Windows Live. This same directory path is used by the StarLogger keylogger. We apologize for reporting this false information, although the original source had a Samsung technical supervisor confirming that the computers were shipping with logging software for performance monitoring purposes. Samsung has further stated that they launched an internal investigation as soon as the Network World report was brought to their attention. The original story is below.

If you own a computer manufactured by Samsung, you should run a scan with your preferred antivirus software immediately. According to a two-part report published by Network World, researcher Mohamed Hassan discovered that the company's 15.6-inch R525 and R540 notebooks ship with a commercial keylogger.

Called StarLogger, the software launches with Windows and runs in the background, making it tricky to detect without some form of antimalware program. StarLogger can record every keystroke made on the system and it's also capable of taking screenshots. That data is emailed to an address specified by the installer (i.e. Samsung).

After initially denying the claims, Samsung admitted to installing StarLogger on new computers to gather customer usage data -- without consent, mind you. It's unclear exactly what data StarLogger is collecting, but a Samsung supervisor said it's used to "monitor the performance of the machine and to find out how it is being used."


Besides that tidbit, the company has been incredibly quiet about the matter. Network World contacted three Samsung public relations offers for a comment, but none of them replied after a week. Likewise, other publications have sought a response from Samsung, but the company appears to be ignoring emails and phone calls.

In 2005, Sony BMG Music Entertainment sold music CDs with a copy protection scheme that installed rootkit software on computers. Customers were furious when they found out and quickly filed a class-action suit forcing Sony to recall 4.7 million CDs and pay $575 million in damages -- undoubtedly more than it gained by using the DRM.

User Comments: 50

Got something to say? Post a comment
  1. ^-- Formatting gets rid of this bloatware, and only installs via Windows Update..?

  2. This is why I always buy a new hard drive with every laptop I buy or recommend to a friend, plus I buy a decent spec one as well

    To guest saying it could come with a driver package, if that is true then Samsung really are breaking the law but I doubt it is in a driver package.

  3. Not only that Burty117 but also the hardware manufacturer and driver supporter would be as well.

  4. Here's a quick article on ZdNet reporting that this is a false positive [link] . If there really is anything to this, we should know today unless the key logger software was only installed on these two laptops.

  5. This is why I will always build my own. When I bought my laptop the first thing I did was format it.

    1) no bloatware

    2) don't have to worry about this kind of bull.

  6. Samsung is becoming the new Sony...

  7. Their excuse smells fishy to me. Why risk getting sued and paying millions in fines for some marketing data. I think there's more to this story or someone is lying.

  8. please please please tell me there is a class action law suit against these azz clowns.

    that is soooooo wrong.

    they need to pay.

  9. They should take down this article and apologize for Samsung as it was found out that this was a load of BS.

    http://www.engadget.com/2011/03/31/samsung-reportedly-instal
    ing-keylogger-software-on-r525-privac/

  10. Read this

    http://www.samsungtomorrow.com/1071

    (Gullibilty and paranoia still seem alive and well)

  11. @Techspot

    Remember - tomorrow - is April Fools Day

    Journalism standards ?

  12. I agree. Where did "Samsung admitted to installing StarLogger" come from? I followed this story on several sites, and the only place it got mentioned is here (though it might have been taken from somewhere). Considering that it turns out that StarLogger wasn't installed, I doubt that Samsung admitted to that, so it looks like it's pure libel.

  13. Sorry, my bad. The engadget story does say a company representative admitted to it.

  14. This post requires an update since the findings reported have been proven to be incorrect. There is no need to get all upset with Samsung, and this little mistake (not TechSpot's fault, mind you, but VIPRE's) is costing Samsung some serious PR.

  15. hm ... here's what I have found across the web:

    - The Samsung representative who "admitted" to the existence of a keylogger was a supervisor of a help desk call center. Perhaps my reason for pointing this out is purely anecdotal evidence, but I have met many help desk supervisors who are woefully misinformed. Furthermore, I find it unlikely that a truly knowledgeable representative of Samsung would admit to such a thing if it were true.

    - Mr. Hassan has not described his methodology, that I am aware of. He tested only two Samsung laptops (one R525 and one R540), but which software did he use and when did he use it in respect to first turning on the machines?

    - Why hasn't Mr. Hassan addressed Samsung's claim that his findings were a false positive incurred by a Windows Live folder (SL) for the Slovene language?

    - Others have attempted to replicate Mr Hassan's findings, yet I have seen none which have found StarLogger on any model of Samsung laptop.

  16. [link]

    VIPRE team apologizes for the false positive, what a shame. kudos back to Samsung.

  17. Yes Techspot, y'all do need to do an update article. I'm sure there are many who have read your article and turned away from Samsung, but have not read the comments here showing that there wasn't a keylogger installed.

    nismo91 posted a link to VIPRE's apology, but i'll do it again:

    [link]

    And from another site:

    [link]

  18. Yeah techspot you should really do a better article update and change the title of the article.

  19. I agree - I forwarded this article around the office already and a title change is in order - not just an (update) addendum. It's incredibly misleading (the update really could mean anything).

  20. haha Come on now, you can't just add "(update)" to an article's title that is still an unknown at best! Making this article's title into a question would suffice. For example, add the word "Was" at the beginning and a question mark at the end.

    Imagine for a moment how the current title would appear if it were describing a different crime. haha

    "Barack Obama caught stealing candy from a baby (update)"

  21. Yeah, adding "update: it was false positive" is kind of a lazy way out. You guys are here to educate us. People need to know what went on, what went wrong. I know some of us posted links to articles but it's not realy our job. I'm not meaning to tell you guys how to do your job, i just want to make sure Techspot stays a reliable source of news. I love the site and i love the articles, but this is not the way to do a proper update...just sayin. It's not a good way to keep subscribers.

    Sorry to be so forward, but as a heavy techspot user, i want to be sure i'm getting current, accurate, and up to date info. And i want to be sure i'm getting the whole story, even if that includes you linking me to another article. I may not like that you're doing that, but at least i'm gerting the full story.

    And now i step off of my soap box, lol.

  22. matrix86 said:

    Yeah, adding "update: it was false positive" is kind of a lazy way out. You guys are here to educate us. People need to know what went on, what went wrong. I know some of us posted links to articles but it's not realy our job. I'm not meaning to tell you guys how to do your job, i just want to make sure Techspot stays a reliable source of news. I love the site and i love the articles, but this is not the way to do a proper update...just sayin. It's not a good way to keep subscribers.

    Sorry to be so forward, but as a heavy techspot user, i want to be sure i'm getting current, accurate, and up to date info. And i want to be sure i'm getting the whole story, even if that includes you linking me to another article. I may not like that you're doing that, but at least i'm gerting the full story.

    And now i step off of my soap box, lol.

    +1, this deserved a new article, pretty big news considering the initial comments.

  23. It is disturbing to see how gullible people are. The initial reaction to this is typical of mob violence launched against innocent people based on a rumor. People really need to think things through and look for possible explanations of reports like this before circling the wagons.

  24. Ooops....

    I guess someone jumped the gun a little on this one.

  25. HAHAHA....the gullible ones are the people who wrote "I'll never buy Samsung products again!"

Recently commented stories

Post a new comment

Social Login & Guest Posting TechSpot Members
Login here or sign up for free,
it takes about a minute.
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.
TechSpot on:

Subscribe to TechSpot

Get free exclusive content, learn about new features and breaking tech news.