Confirmed: Samsung is not shipping keyloggers • Hacker News Board

Re: Confirmed: Samsung is not shipping keyloggers

#51

Post by falcolas » Thu, Mar 31, 2011, 3:25 PM UTC

kenjackson wrote: post #50

falcolas wrote: post #33

Perhaps I read it wrong, but the article never says Samsung didn't ship a keylogger, it just indicates that the AV software can make false positives based on a folder. Can we get a link to an article that actually checks a Samsung laptop (and lists their methodology, not this "Duh, there were not any keyloggers") instead of anecdotal evidence and attacking the previous reseaerchers methods? Even if the previous guy w…

The article says two things: 1) The whole saga was caused by a bad antivirus alert. This story never even happens if not for that. 2) They checked a set of Samsung laptops and found no trace of keylogger software. See http://www.f-secure.com/weblog/archives/00002132.html Is there more you'd like to see be done?

Yes (I did see the link back to the original article). Specifically, I'd like some more information about their methodology.

1) How did they verify there were no key loggers (is their AV program set to identify StarLogger instances) 2) What subset of Samsung laptops did they check 3) Did they check from more than one source 4) Did they verify that the laptops they checked haven't been wiped & reimaged with the local store's base computer image (such as with Best Buy)

With out some of this basic data, their findings are perhaps more suspect than the original article (not that I believe Samsung is doing this, I just disagree that their conclusions are as cut and dried as they, and the link title, indicate).

Re: Confirmed: Samsung is not shipping keyloggers

#52

Post by brudgers » Thu, Mar 31, 2011, 3:26 PM UTC

jedsmith wrote: post #38

brudgers wrote: post #26

Earlier quoted context omitted.

UoP is accredited by the same board which accredits University of Michigan. [ http://www.phoenix.edu/about_us/accreditation.html ] For whatever that is worth. They have experienced difficulty regarding the rates at which students receiving Federal Financial Aid graduate - i.e. their issues are based on low graduation rates and not based on being a diploma mill. Disclosure: my spouse teaches for UoP part time.

They have also received criticism for the large number of loan defaults, and lobbying to change how the loan default statistics are calculated to make their numbers look better (at least according to Frontline). Same program also mentioned private for-profit schools account for a quarter of all student aid in the country, a disproportionally high number since they are not a quarter of our schools.

Public universities have large numbers of lobbyists serving their interests as well.

UoP had about 400,000 students at the time the Frontline piece was produced - that's seven Ohio State Columbus's [http://www.osu.edu/osutoday/stuinfo.php] so number of schools is not perhaps the best measure.

Rightly or wrongly, because UoP has open enrollment they admit more students who are eligible for Federal Financial Aid than most schools because of the population they enroll.

And nothing in the Frontline piece accused UoP of being a diploma mill as was implied by the prior comment to which I responded. A criticism of their business model is a different indictment altogether.

Re: Confirmed: Samsung is not shipping keyloggers

#53

Post by burgerbrain » Thu, Mar 31, 2011, 3:26 PM UTC

jrockway wrote: post #49

gamble wrote: post #42

Earlier quoted context omitted.

Not sham degrees, exactly. They require the absolute minimum level of educational achievement necessary to edge over the fuzzy line between a diploma mill and legitimate education. Students go to UoP to get a piece of paper that helps their career and that they would generally be incapable of acquiring at a real university, while in exchange UoP is there to milk the students for every federally-guaranteed loan they c…

Students go to UoP to get a piece of paper that helps their career ... while in exchange UoP is there to milk the students for every federally-guaranteed loan they can qualify for. Wait, so just like a real university?

Selective quoting much?

Re: Confirmed: Samsung is not shipping keyloggers

#54

Post by burgerbrain » Thu, Mar 31, 2011, 3:29 PM UTC

alecco wrote: post #23

CaptainZapp wrote: post #8

I can't help it. But the whole "security software" business really reminds me of the mob. Nice laptop you have here; would be a shame if something would happen to it!

You mean the "antivirus software" industry.

Since when have these guys limited themselves to just being antivirus vendors?

Re: Confirmed: Samsung is not shipping keyloggers

#55

Post by burgerbrain » Thu, Mar 31, 2011, 3:36 PM UTC

richbradshaw wrote: post #17

estel wrote: post #12

Earlier quoted context omitted.

Care to explain why?

They named a folder SL. Two letter folder name on a non unix system?

Nice try at a cheap jab, but 3 or 4 character directory names are typical of unix systems, not 2.

https://secure.wikimedia.org/wikipedia/en/wiki/Filesystem_Hi... Not a single 2 letter directory name.

Re: Confirmed: Samsung is not shipping keyloggers

#56

Post by perspective » Thu, Mar 31, 2011, 3:43 PM UTC

I sure hope someone got fired for that one snicker

Re: Confirmed: Samsung is not shipping keyloggers

#57

Post by jws » Thu, Mar 31, 2011, 3:54 PM UTC

crististm wrote: post #47

Great news... but what's with the SL folder? The report does not say what SL folder contains on a new laptop. Anyway, pretty dumb to check for viruses by folder name.

Slovene language support files. SL is their ISO 639-1 code.

http://www.samsungtomorrow.com/1071

Re: Confirmed: Samsung is not shipping keyloggers

#58

Post by todd3834 » Thu, Mar 31, 2011, 3:56 PM UTC

"The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the years."

Mohamed's lesson: Just because you were unable to prove a false-positive with the same program for 6 years doesn't mean there weren't any.

Re: Confirmed: Samsung is not shipping keyloggers

#59

Post by kenjackson » Thu, Mar 31, 2011, 3:58 PM UTC

falcolas wrote: post #51

kenjackson wrote: post #50

Earlier quoted context omitted.

The article says two things: 1) The whole saga was caused by a bad antivirus alert. This story never even happens if not for that. 2) They checked a set of Samsung laptops and found no trace of keylogger software. See http://www.f-secure.com/weblog/archives/00002132.html Is there more you'd like to see be done?

Yes (I did see the link back to the original article). Specifically, I'd like some more information about their methodology. 1) How did they verify there were no key loggers (is their AV program set to identify StarLogger instances) 2) What subset of Samsung laptops did they check 3) Did they check from more than one source 4) Did they verify that the laptops they checked haven't been wiped & reimaged with the local…

At this point we have no more evidence that Samsung has keyloggers than Thinkpads or MacBook Pros.

We really should be doing what you suggest for all brands and models of laptops. There's no evidence to suggest a specific issue with Samsung at this point.

Even the antivirus manufacturer who detected the problem has acknowledged they made a mistake.

http://sunbeltblog.blogspot.com/2011/03/samsung-laptops-do-n...

A pretty first class post in my opinion.

It would be like a newspaper reporting that "Falcolas kills 5 people!" And then turns out that you actually saved five people from drowning, and the newspaper prints a retraction. But then someone says, "But can you prove he didn't also kill five people at some point along the way? No one has really come out to say that he's never killed five people." Sure you may have, but at that point we have no reason to believe you have moreso than anyone else.

Re: Confirmed: Samsung is not shipping keyloggers

#60

Post by unreal37 » Thu, Mar 31, 2011, 4:01 PM UTC

"A lie can travel halfway round the world while the truth is putting on its shoes." -- often attributed to Mark Twain

The original article was so poorly fact checked. It really reflects poorly on Mohamed Hassan (and all his fancy yet meaningless credentials) and M. E. Kabay (who apparently worships Mr Hassan unquestioningly). I will not hold my breath out for a public apology from either of those two, although they are the ones who owe Samsung one.

And the irony is in fact delicious. A security expert finds a virus using an anti-virus scanner tool, and confirms it with some call center employee with the company. What does being a "security expert" have to do with any of that? My 10 year old nephew could have done that!