Game Studio Found To Install Malware DRM On Customers' Machines, Defends Itself, Then Apologizes

from the that-was-quick dept

The thin line that exists between entertainment industry DRM software and plain malware has been pointed out both recently and in the past. There are many layers to this onion, ranging from Sony's rootkit fiasco, to performance hits on machines thanks to DRM installed by video games, up to and including the insane idea that copyright holders ought to be able to use malware payloads to "hack back" against accused infringers.

What is different in more recent times is the public awareness regarding DRM, computer security, and an overall fear of malware. This is a natural kind of progression, as the public becomes more connected and reliant on computer systems and the internet, they likewise become more concerned about those systems. That may likely explain the swift public backlash to a small game-modding studio seemingly installing something akin to malware in every installation of its software, whether from a legitimate purchase or piracy.

FlightSimLabs, a studio that specialises in custom add-ons for other company’s flight sims, has been found to be secretly installing a program onto user’s computers designed to check whether they’re playing a pirated copy of their software.

The code—basically a Chrome password dumping tool— was discovered by Reddit user crankyrecursion on February 18, and as TorrentFreak reportwas designed to trigger “a process through which the company stole usernames and passwords from users’ web browsers.”

Whatever fuzzy line might exist between DRM payloads and malware, this specific deployment appears to have crossed it in a very big way. The extraction of user names and passwords for infringers would be a step too far on its own, but the real problem is that the executable that does all of this was included in every copy of the software FlightSimLabs provided, including those from legit purchases.

Lefteris Kalamaras, who runs FlightSimLabs, admitted that the installation of a file named "test.exe" was included in the software installation, but insisted that it was only weaponized when a pirated copy of the software is detected.

First of all - there are no tools used to reveal any sensitive information of any customer who has legitimately purchased our products. We all realize that you put a lot of trust in our products and this would be contrary to what we believe.

If such a specific serial number is used by a pirate (a person who has illegally obtained our software) and the installer verifies this against the pirate serial numbers stored in our server database, it takes specific measures to alert us. “Test.exe” is part of the DRM and is only targeted against specific pirate copies of copyrighted software obtained illegally. That program is only extracted temporarily and is never under any circumstances used in legitimate copies of the product. The only reason why this file would be detected after the installation completes is only if it was used with a pirate serial number (not blacklisted numbers).

This attempt at an explanation failed to assuage the gaming community for understandable reasons. To include a program capable of extracting passwords in a flight simulator mod is flatly insane. The only proper description for such software would be malware and that malware was installed on the machines of customers of FlightSimLabs that had properly paid for its products. The claim that this malware remained dormant for those purchasing the mods would be the same as claiming that each of our homes have been outfitted with bombs without our knowledge, but those bombs will only be activated if the home builder thinks we're doing something illegal. This is all wide open for mistakes, abuse, and for other bad actors to swoop in on these customers and make use of the software for nefarious reasons.

Shortly after Kalamaras' "explanation", FlightSimLabs updated the mods in question with the malware removed entirely. The company also updated its community with an apology that still somewhat misses the mark.

We have already replaced the installer in question and can only promise you that we will do everything in our power to rectify the issue with those who feel offended, as well as never use any such heavy-handed approach in the future. Once again, we humbly apologize!

This isn't about "feeling offended", it's about the company breaking the trust of its customers by installing what is clearly malware on their machines. That isn't the type of bad act a company should be able to come back from.

Filed Under: drm, flight sim, keylogger, malware
Companies: flightsimlabs

Treasury Department Report Shows ComputerCOP Used Bogus Endorsement Letter To Get Police To Distribute Keylogger

from the bad-news dept

A little over three years ago, we wrote about a detailed investigation by Dave Maass at EFF to reveal that an app called ComputerCOP, that was given out by hundreds of police departments to parents supposedly for protecting their kids, was actually dangerous spyware that transmitted information typed by users (including kids) over the internet without encryption. Even worse, tax dollars were being used by police departments to "purchase" this software for distribution to unsuspecting parents. The details were ugly, and it even included ComputerCOP using a bogus "endorsement letter" from the Treasury Dept. -- leading the Treasury Department to put out a fraud alert about the software, stating:

Neither the Treasury nor the Treasury Executive Office for Asset Forfeiture endorses this or any other particular product and the use of equitable sharing funds does not in any way imply such an endorsement. A letter purporting to be from the Treasury Executive Office for Asset Forfeiture [link] is not genuine.

Incredibly, even after all of this was revealed, we noted that many police departments continued to stand behind the software and even claimed that EFF was "not credible" (and, bizarrely, said that the software would have "stopped Columbine").

Three years have gone by and Maass and EFF are back, noting that the original report spurred an investigation by the Treasury Department into the software which confirmed the EFF's reporting, even noting that the company had doctored a letter to claim that the software was endorsed by the Treasury Dept. From the report:

The investigation determined that the allegation is substantiated. Specifically, no less than three law enforcement agencies solicited by ComputerCOP reported the TEOAF memorandum in the solicitation influenced the law enforcement agency's decision in purchasing ComputerCOP's software. After discussions with TOIG, DOJ/U.S. Marshal Service, and Treasury Office Counsel, ComputerCOP agreed to post a disclaimer on their website to dissociate the Treasury Department from their products. Additionally, ComputerCOP agreed to immediately cease use of the altered letter from the Treasury Department.

However, as Maass also notes, ComputerCOP evaded prosecution because the three-year statute of limitations had run out. Of course, I'm curious how that's true, given the claim that the company had continued to use the letter until all of this was revealed.

New FOIA documents show that, after a multi-year investigation, the Inspector General concluded that ComputerCOP had indeed “altered the 2001 letter from TEOAF and made it appear to be blanket permission for all law enforcement agencies to use equitable sharing funds to purchase the software.” Indeed, ComputerCOP made this claim on the rate card it provided to agencies. 

As part of its investigation into the letter, Treasury investigators sent questionnaires to 240 agencies that had purchased ComputerCOP. Of the few dozen that responded, three law enforcement agencies—the Peabody Police Department in Massachusetts, the Alaska Department of Public Safety, and the Greene County Sheriff's Office in Missouri—told Treasury that the fraudulent letter had directly influenced their decision to purchase the product. 

The closed investigative report indicates the Treasury Inspector General was unable to send the case for prosecution “due to the fact that the three year statute of limitations on the offense had lapsed.” Instead, after discussions with the Justice Department and the U.S. Marshal Service, Treasury concluded it was enough for ComputerCOP to cease using the altered letter and to post a disclaimer on their website.

And Maass also notes that while ComputerCOP promised to post a disclaimer on its website, that disclaimer appears to have gone away -- and is still pushing misleading (at best) claims about the software.

Unfortunately, it may be time for the Treasury Department to re-open the case. While ComputerCOP did once advertise the disclaimer, EFF could no longer find that language anywhere on its website.  

Making matters worse, the company’s website now claims that the keylogging feature “is not intrusive in any way.” This is an outrageous claim considering that this type of technology is more commonly deployed by stalkers and malicious hackers, and, in certain circumstances, its use could violate wiretapping laws.

And, yes, incredibly, there are still police departments out there purchasing the software and handing it out to unsuspecting parents -- including just this summer when McGruff the Crime Dog was handing out the software on Long Island.

There are enough problems with police these days and how they interact with the public. They shouldn't be contributing to making computer security worse by handing out dangerous software.

Filed Under: computercop, forged letter, keylogger, treasury department
Companies: computercop

WIPO Gives EFF Control Over Bogus Domain Used To Distribute Keyloggers And Other Malware

from the more-than-mere-cyberquatting dept

The World Intellectual Property Organization (WIPO) has actually used its powers for good, stopping an Indonesian citizen from spreading malware while taking the name of the EFF in vain.

The Electronic Frontier Foundation's website is eff.org. The squatted-on domain was electronicfrontierfoundation.org. As the real EFF vigorously fights against exactly the sort of thing being distributed by the fake site (spyware and malware), it had a legitimate complaint against the cybersquatter that went far deeper than mere trademark-related confusion.

The disputed domain name was registered on August 4, 2015.

On August 13, 2015, the Complainant was informed that the disputed domain name was being used to confuse consumers by redirecting them to the Complainant’s official website only after surreptitiously installing malicious software on the computers of unsuspecting visitors. According to an affidavit of a Staff Technologist of the Complainant, the malicious code exploited a known vulnerability in the computer programming language Java, by disabling Java security settings which allows it to execute arbitrary Java code without having to ask for the user’s permission.

The incident was reported in the media, for instance in an article published on August 28, 2015 on the website of Ars Technica under the title “Fake EFF site serving espionage malware was likely active for 3+ weeks”.

The EFF's complaint against the cybersquatter also pointed out that the URL was being used in bad faith, implanting computers with keyloggers and being used as a backdrop for a spear phishing campaign.

The Complainant contends that these facts strongly suggest that the disputed domain name was registered for the purpose of supporting a phishing campaign, i.e. an attempt to discover sensitive information such as usernames, passwords or personal details, by confusing consumers into believing that the attacker, to whom information is actually being provided, is in fact a different, trustworthy entity to whom consumers desire to provide information.

WIPO found that the EFF's complaint satisfied multiple prongs of its domain name dispute resolution process. The trademark on the name itself dates back to 1993 and the use of the bogus site to deliver malware payloads added up to "bad faith" use.

The domain has been taken from Shawanda Kirlin of Bali, Indonesia, and given to the EFF for its own use. This will kill off one arm of a sophisticated malware campaign with possible ties to the Russian government and prevent further abuse of internet users looking for information on privacy and security.

Filed Under: cybersquatting, domains, keylogger, malware, wipo
Companies: eff

Law Enforcement Still Defending ComputerCOP: Says They'll Keep Distributing It Until After Someone's Been Hurt

from the say-what-now? dept

It appears that the police and other law enforcement folks who spent department money on the awful ComputerCOP spyware simply can't admit that they were handing out software that made kids less safe. Instead, they're sticking by their decision to do so. Given that the company personalized the software in the name of local law enforcement, and pitched it as the "perfect election and fundraising tool," you can understand their reticence to actually admit that they've been making kids a hell of a lot less safe. We already discussed San Diego District Attorney Bonnie Dumanis defending the software, even while issuing an "alert" telling parents how to disable the keylogging feature. Even more bizarre was the response of Limestone County, Alabama, Sheriff Mike Blakely, who simply questioned EFF's credibility in revealing the dangerous nature of the software.

Blakely appears to be doubling down on that argument. In an interview with Ars Technica, he again bizarrely claims that the EFF wants to protect pedophiles and predators, and then also endorses spying on kids:

With respect to the EFF he said, “I'm not against their criticism but I just think they're probably more interested in protecting predators and pedophiles than in protecting our children.”

“As sheriff, I went down [to schools] and met with kids and I taught them about bicycle safety and not to talk to strangers,” Blakely said, adding that handing out ComputerCOP was just another branch of the department's efforts to keep kids from being solicited online.

“If you and I were married and had a 14-year-old daughter, then yeah I could check on who you're talking to online and you could check who I'm talking to,” he said. “But if [ComputerCOP is] used properly, it's something we whole-heartedly endorse. Now if you're of the persuasion of the people of the EFF who would rather not do anything, then that's something that I can't help.”

That ignores, of course, that the keylogging sends information unencrypted, thus putting children much more at risk. When Ars did ask him about that, Blakely said that they'd have to talk to his "IT people."

It appears that other police departments and district attorneys are similarly trying to defend the fact that they've been distributing dangerous keylogging software that can pass unencrypted cleartext of any information typed by kids. Some law enforcement folks are not just standing by their decision to hand out the spyware, but are continuing to do so. Contra Costa District Attorney Dan Cabral, astoundingly, admits that he intends to continue distributing the software until after someone's been hurt.

Contra Costa Assistant District Attorney Dan Cabral said Friday that the office has no plans to recall the software it distributed.

"If it turns up later that there's some sort of breach we will do so, but right now we feel it serves its purpose and it assists parents in what its supposed to do," Cabral said Friday.

Steve Moawad, the Senior Deputy District Attorney working for Cabral, ridiculously argues the fact that so many other law enforcement folks got duped is somehow proof that the software must be okay.

"I am aware of several law enforcement agencies that have looked at the product before and after this report," Moawad said. "I believe the EFF is overstating the risk and, the fact that this program has been handed out by hundreds of law enforcement agencies over a period of 10 years and there's been no reported incidents of identity theft as a result of the use of the software is indicative of that (fact)."

There are many, many problems with this. Just because a specific breach can't be traced back directly to this software doesn't mean breaches haven't happened (and happened regularly). Based on how the software itself works (sending cleartext over the internet), there's really not going to be any indication that when a breach happens it's because of the software. Parents and kids just won't know how the leak of information happened.

Meanwhile, over in Loudon County, Virginia, the Sheriff's Office not only stood by the use of the software but announced plans to hand out more copies next year:

In a statement issued by the Loudoun County Sheriff's Office today, the agency said “ComputerCOP is very similar to other parental monitoring systems available on the market. The program does not operate without the CD inserted in the computer disk drive and does not allow access from any outside parties, including the Loudoun County Sheriff’s Office or ComputerCOP. The disks are not distributed without explanation from Loudoun County Sheriff’s Office personnel during our Internet Safety: What Parents Need to Know presentations. Parents are made aware at these presentations of the programs limitations and how it is intended to be used. Parents with questions about ComputerCOP are encouraged to attend one of our upcoming Internet Safety courses that will begin in early 2015 at area schools.”

First of all, the claim is misleading to the point of being disingenuous. While the software, by itself, does not "allow access from any outside parties," by sending cleartext copies of keylogging output over the internet, it's revealing that content to many, many potential outside parties. It appears the Loudon County Sheriff's office doesn't even understand the problem -- and yet they claim that they've properly explained the software to parents? That seems difficult to believe.

I'd be curious if the presentation includes an explanation of keylogging, encryption and the dangers of sending cleartext over the internet. Again, it seems doubtful. Hopefully, some parents in Loudon County who do understand this will head on over to the next set of Internet Safety classes, not to be educated, but to educate the police there.

Next up, there are the folks at the Maricopa County, Arizona, Attorney's Office. They, too, are not at all happy with the EFF, while remaining pleased as punch with ComputerCOP's software, despite it putting kids in danger. In an email to CNET's Seth Rosenblatt, the Maricopa County Attorney's Office says it's "ridiculous" to call the software spyware, and also (huh?) claims that EFF is only doing this because it offers "a competing product." Wait, what?

In short, this is a story filled with inaccurate information and numerous misrepresentations from an organization that just so happens to be offering a competing product. That fact alone warrants skepticism about its conclusions. Unfortunately however, several news outlets (and I am not including CNET here) have accepted and regurgitated the EFF report without making any effort to verify the information it contains or talk to someone who’s actually used the product, let alone checked it out first hand.

To call ComputerCOP "spyware" is ridiculous. This product is fundamentally no different than the parental controls that are available on countless digital devices and so ware used by kids today. In fact, most parents believe they have the right and responsibility to know what their children are doing online, and this product is a simple tool that allows them to do that.

First off, I had no idea that EFF offered its own spyware product. Second, whether or not the product is "fundamentally no different" kind of misses the point. If all such software have serious security problems, that should be an issue.

Unlike what most experts would term "spyware," ComputerCOP does not surreptitiously send information to third parties. The hysterical claim that ComputerCOP sends notifications emails without encryption... is utterly fatuous and disingenuous. The software uses a user's existing e-mail service to send notifications. A ComputerCOP notification has no greater potential for being compromised than any other e-mail a user sends.

That suggests a level of technical ignorance that is, well, kinda scary. The fact that ComputerCOP sends keylogger info without encryption is entirely accurate. It is neither fatuous nor disingenuous. In response to this bizarre claim from Maricopa County, the EFF's Dave Maass (who wrote the original report) asked Maricopa to hire an independent security team to evaluate the software. Also, despite its claims, Maass notes that over the weekend, Maricopa County appears to have removed their own website promoting ComptuerCOP. Perhaps the Maricopa County's Attorneys Office isn't quite as confident in the software as they claimed.

Meanwhile, one of the security researchers who the EFF used in its original report, Jeremy Gillula, went a step further. On Twitter, he issued a challenge to anyone defending ComputerCOP:

Challenge to all defending ComputerCOP as secure: you install it, connect to open wifi and login to your bank while I run wireshark. Any money I transfer out using your username and password from the packet logs gets donated to EFF. If I can't get any money, I retract all statements about ComputerCOP's keylogger being insecure. Sound like a deal?

Let's see if anyone takes him up on it.

Filed Under: computercop, contra costa, encryption, keylogger, law enforcement, limestone county, loudon county, maricopa county, mike blakely, spyware
Companies: computercop, eff

Sheriff Slams EFF As 'Not Credible,' Insists ComputerCOP Isn't Malware & Would Have Stopped Columbine

from the say-what? dept

Okay, so we thought the response from San Diego's District Attorney Bonnie Dumanis was pretty bad to the revelations about ComputerCOP. After all, she was responding to the news that she had purchased and distributed dangerous spyware masquerading as software to "protect the children" -- and the best she could come up with was that her "security" people still thought it would protect kids? But apparently Damanis has nothing on Sheriff Mike Blakely of Limestone County, Alabama.

Blakely, in a bit of unfortunate timing, just announced that his department had purchased 5,000 copies of the spyware earlier this week, so perhaps it's understandable that this "perfect election and fundraising tool" might actually turn into something of a liability. But Blakely's not going down without a fight. When presented with the news that he's proudly handing out tools that are making the children he's supposed to be protecting less safe, Blakely went with an ad hom the messenger approach, attacking EFF's credibility, and calling them "liberals."

Blakely referred to the EFF criticism politics as an "Ultra-liberal organization that is not in any way credible on this. They're more interested in protecting predators and pedophiles than in protecting our children."

Anyone even remotely familiar with EFF recognizes that basically every word in that statement is ridiculous, but what are you going to do? The idea that EFF isn't credible on security issues is laugh out loud funny (and, indeed, despite attending a conference and being in a room full of people, I literally laughed out loud upon reading it). However, Blakely insists his IT people are sure the software's fine:

"We have had the key logger checked out with our IT people. They have run it on our computer system." He said. "There is no malware."

Reread that a few times. "We had the key logger checked out... there is no malware." Dude. A keylogger is malware. That's what it does. From the description here, it sounds like his "IT people" ran some anti-malware software on the computer they installed ComputerCOP on, and because it didn't flag it, they insist it's not malware. But a keylogger is malware by definition. And the fact that this malware happens to pass unencrypted text, including passwords and credit card numbers, over the internet makes it really, really bad.

But don't tell that to Sheriff Blakely. He insists that ComputerCOP might have stopped Columbine. I'm not joking.

On the phone Wednesday he added "There are some parents out in Columbine Colorado, if they had this kind of software, things would have turned out differently."

That comment is so off it defies a coherent response.

Meanwhile, I'm sure that Sheriff Blakely's "IT People" are trustworthy, given that his website looks like it was designed in 1997 and hasn't been touched since. It even has a visitor counter and a "this site best viewed in Internet Explorer" badge. I'm not joking. And a scroll. The only thing it's missing is an under construction gif and the blink tag: And, uh, note that text there:

You are not permitted to copy, broadcast, download, store (in any medium), transmit, show or play in public, adapt or change in any way, the content of these web pages for any other purpose whatsoever without the prior written permission of the site webmaster.

And there's a copyright notice below it. Of course, anyone who views the website has copied, downloaded, stored and transmitted the webpage in some manner -- so, I'm not quite sure what to do other than to say, that most of those demands are completely bogus and not based on any actual law. As for the copyright -- well, while technically only federal government works are exempt from copyright, and state and local governments can get a copyright in some fashion, it's generally not considered the appropriate role of government officials to be copyrighting official government works. Furthermore, in such cases, there would likely be a very strong presumption of fair use for a whole host of reasons.

Oh, but it gets worse. Not only are you not supposed to copy any of the text on Sheriff Blakely's website, the terms of service on his website say he might put you in jail if you do:

The unauthorized use, copy, or reproduction of any content of this site inclusive, may be punishable by both fine and imprisonment.

Under what legal theory is that happening? As a sheriff, aren't you supposed to, you know, actually know what the law is? Maybe work on that before slamming the good folks at EFF while distributing dangerous spyware that makes kids less safe. And find someone who's built a website in the last decade.

Filed Under: computercop, keylogger, limestone county, malware, mike blakely
Companies: computercop, eff

San Diego District Attorney Issues Warning About Dangerous Spyware She Purchased & Distributed; But Still Stands By It

from the not-the-right-response dept

Yesterday, we wrote about the EFF's investigation into Computer Cop, the dangerous spyware/keylogger that is sold to police departments and other law enforcement folks as a "perfect election and fundraising tool" because the software gets branded with local law enforcement/politicians and they get to hand it out as a tool to "protect your children" by spying on how they use their computers. The software appears to be a very crappy search system and keylogger. Any keylogger is already a dangerous tool, but this one is especially dangerous in that it transmits the log of keystrokes entirely unencrypted to a server, meaning that all sorts of information, including passwords, credit cards, etc. are transmitted across the internet in the clear. The Computer Cop website looks like it was designed a decade ago and then left to rot (as does its software): The site is so bad that the company's own address in the footer of the website spells the city wrong. The company is based in Bohemia, NY, yet the site's own website spells it Bhomeia. Yes, that's more than one letter out of place: All of this should give you a sense of what's going on here. Rather than actually "protecting children," this is a cynical money-grab by a guy who is convincing politicians to use government money to make children less safe while pretending to "protect the children."

Given the powerful expose by the EFF, you'd think that some of the folks who bought into the bogus software and distributed this dangerous spyware to unsuspecting parents might be regretting their decision. Instead, they're... still playing politics. The San Diego District Attorney, Bonnie Dumanis, didn't apologize. She did release an alert warning about the very software she purchased and promoted and distributed to parents, but then still says the software is generally good and will continue to distribute it.

In a statement, Dumanis spokesman Steve Walker said the program was still a useful tool for parents.

“Our online security experts at the Computer and Technology Crime High-Tech Response Team continue to believe the benefits of this software in protecting children from predators and bullies online and providing parents with an effective oversight tool outweigh the limited security concerns about the product, which can be fixed,” Walker said.

Walker said that the District Attorney’s Office still has a few copies of the program left and will give them to families who request it.

There don't appear to be any actual redeeming qualities to the software. It doesn't protect anyone, but rather makes them less safe while giving parents a false sense of security. San Diego (and elsewhere) deserve much better, but apparently they're not going to get it.

The "warning" that was sent out just suggests disabling the keylogger part -- and doesn't appear to take any responsibility for purchasing and promoting the software in the past. As for how much money was spent? Apparently San Diego spent $25,000 on the software:

Dumanis spent $25,000 from asset forfeiture funds — money and property seized during drug and other prosecutions — on 5,000 copies of the program for public dissemination.

Ah, so rather than being directly taxpayer money, it's just money stolen via questionable forfeiture procedures. It's hard to see how that's any better.

Filed Under: bonnie dumanis, computercop, for the children, keylogger, protect the children, san diego, spyware
Companies: computercop, eff

Australian Tax Office To Use Keystroke Logger On Employees... But Just To Stop Repetitive Stress Injuries

from the oh-really-now? dept

Slashdot points us to the news that the Australian Tax Office is seeking software to monitor keystrokes and mouse clicks of their employees -- not to spy directly on what they're doing, but in an attempt to learn about why their employees keep coming down with repetitive stress injuries. Apparently, the ATO's insurance premiums were going way up because lots of employees were missing time due to such problems. Realizing this might look bad, the ATO is insisting that this will be "voluntary" (though, who's going to volunteer for that?) and that it would only count keystrokes rather than record them. Either way, I can't imagine most employees will be too excited about this.

Filed Under: australia, keylogger, repetitive stress injuries

Samsung Accused Of Installing Secret Keyloggers On New Laptops 'To Monitor Performance' [Updated]

from the that's-not-going-to-go-over-well dept

See update at the bottom

According to a report by Mohamed Hassan at Network World, Samsung has been installing secret keyloggers on laptops. After setting up a new laptop, he ran a scan and found an installation of StarLogger, a commercial keylogger program. It's a rather nefarious piece of software:

This key logger is completely undetectable and starts up whenever your computer starts up. See everything being typed: emails, messages, documents, web pages, usernames, passwords, and more. StarLogger can email its results at specified intervals to any email address undetected so you don't even have to be at the computer your[sic] are monitoring to get the information. The screen capture images can also be attached automatically to the emails as well as automatically deleted.

Hassan claims to have found the same keylogger on two separate laptops from Samsung, and after calling the company, finally had a supervisor claim that the company did it to monitor usage:

On March 1, 2011, I called and logged incident 2101163379 with Samsung Support (SS). First, as Sony BMG did six years ago, the SS personnel denied the presence of such software on its laptops. After having been informed of the two models where the software was found and the location, SS changed its story by referring the author to Microsoft since "all Samsung did was to manufacture the hardware." When told that did not make sense, SS personnel relented and escalated the incident to one of the support supervisors.

The supervisor who spoke with me was not sure how this software ended up in the new laptop thus put me on hold. He confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."

Of course, it's entirely possible that the supervisor was confused as well. Frankly, like some others, I find it hard to believe that Samsung corporate policy could be so clueless as to install secret keyloggers on all laptops. If it is true, however, I imagine the company will be facing one hell of a lawsuit in the very near future.

Update: It looks like my skepticism on this story may have been justified. Samsung is claiming that the researcher got a false positive, and confused a language folder for a keylogger:

"Our findings indicate that the person mentioned in the article used a security program called VIPRE that mistook a folder created by Microsoft�s Live Application for a key logging software, during a virus scan.

"The confusion arose because VIPRE mistook Microsoft's Live Application multi-language support folder, labelled 'SL,' as StarLogger. Depending on the language, under C:\Windows folders are created labelled 'SL' for Slovene, 'KO' for Korean, 'EN' for English."

Filed Under: keylogger, monitoring, rootkit
Companies: samsung

Should It Be Illegal To Sell A Keylogger? Or Just To Use It?

from the might-be-pushing-the-boundaries dept

A court has issued an injunction temporarily banning the sale of a keylogger product called RemoteSpy. The ruling probably makes sense under the current FTC law, but it does raise some questions about whether it really makes sense to ban the sale of such a program, versus just the use of one. I can certainly understand why you might want to ban the sale of such programs, because if they're sold, they're perhaps more likely to be used. However, it still seems wrong to make it illegal to sell some software because that software can be used for illegal activities. Shouldn't the liability belong to those who actually use the software for illegal purposes?

Filed Under: keylogger, legality, liability