Samsung Printer Keylogger Rant - Page 1
Forum section: electronics / general

author: Brutte
author_rank: Frequent Contributor
timestamp: October 11, 2014, 08:10:53 pm
content: I have bought aSamsung M2022 laser printerrecently.Adverts:easy installation, just connect power, plug USB, run driver, press “print”,end of story?Naah of course not.The driver itself (XP) installs seamlessly but at first print attempt it won't pass the data to the printer. Instead it displays the msgbox “proposing” an agreement on installing a Samsung keylogger software:Please trust us, closed source, we do our best, options available, of course not your personal data, kissmyass.You have two choices then:Accept keylogger agreement and get what you paid for, orrestart a computer (the “close” and “hide” window buttons are disabled) and reconsider the "proposition".I hoped that this was just one of those bad days. The next day, after reinstalling, that came up with same msgbox. After contacting Samsung support where I asked for “keylogger-less driver” I got a prompt reply (rough meaning):“No internet connection agreement - no printing”.

author: SeanB
author_rank: Super Contributor
timestamp: October 11, 2014, 08:20:54 pm
content: Note to self, do not buy Someshit printers ever. Wonder how much of thier stuff does an ET and phones home, and what you will get if you disable it.You think they have forgotten what happened to Sony with their software installs on CD's? That class action did hurt Sony both reputation wise and financially.

author: free_electron
author_rank: Super Contributor
timestamp: October 11, 2014, 08:27:19 pm
content: what makes you think this has a key logger ?

author: SeanB
author_rank: Super Contributor
timestamp: October 11, 2014, 08:34:52 pm
content: "Monitor user interaction" seems to mean looking at mouse activity, keyboard activity and active window at the time. Seems to fit the definition of a keylogger.If it was only sending info on the job like toner used, image density,pages used and nothing else, and sending without any machine identifier other than the router or NAT external IP then that would be legitimate data. Anything more is going to be identifiable.

author: Brutte
author_rank: Frequent Contributor
timestamp: October 11, 2014, 08:37:22 pm
content: Quote from: free_electron on October 11, 2014, 08:27:19 pmFrom the preamble of the agreement? How do you call a "software that may log user interactions and use your IP address and internet connection to transmit data (..)"?

author: mariush
author_rank: Super Contributor
timestamp: October 11, 2014, 08:48:10 pm
content: It means log user interaction with the printer ... how many pages you print, how many grayscale, how many color, how many landscape or potrait. how much toner is used to print each job ...The internet to transmit data part ... the control panel applet or whatever software is installed has a section where it suggests to buy toner ... maybe it reports the level of toner in the printer and i think when you press a button in that section it sends your IP to a server of theirs in order to do geolocation and suggest back stores from where to buy toner, drum, stuff like that.Doesn't mean it logs what you type or what you do with the computer...edit: i say this because i used to own a samsung ml-1700 printer, a similar text was with that driver as well and i remember the software had a section where you could click to buy toner or get a list of service locations. Now it's at my sister's place so I can't double check, I own a Lexmark printer now.

author: rdl
author_rank: Super Contributor
timestamp: October 11, 2014, 09:50:07 pm
content: Wow, that would be going right back to where ever I bought it if it was me. I would also let them know that I'd never buy another Samsung product again and would strongly suggest the same to everyone I meet for the rest of my life.

author: German_EE
author_rank: Super Contributor
timestamp: October 12, 2014, 08:53:41 am
content: Taking the printer back would be my preferred action as well, this is unacceptable.

author: kolonelkadat
author_rank: Regular Contributor
timestamp: October 12, 2014, 08:59:15 am
content: crying 'keylogger' is quite the bold accusation. Especially considering they explicitly state that they collect "device information and information regarding the life cycle of the toner cartridge (Printer model name, serial number, installation date, toner usage level and supplier ID). This information will be used as data to help Samsung provide better user environment.Under no circumstances shall we collect any information other than the information listed above."

author: true
author_rank: Frequent Contributor
timestamp: October 12, 2014, 09:06:05 am
content: Quote from: mariush on October 11, 2014, 08:48:10 pmHave younotseen the shit companies want these days? Assume nothing.Take the printer back and demand a refund.Quote from: kolonelkadat on October 12, 2014, 08:59:15 amPerhaps it is a bold accusation, but regardless if there is a keylogger or not,this is a fucking printer, it puts toner to paper, there isnoright reason to require an agreement like the one provided to use the printer. Brutte should be under no obligation to help Samsung's business to use a physical device. Yeah, you can argue software rights, etc butthis is a fucking printer, Postscript or even PCL is pretty fucking standardized and printing has been basic standard computing technology for decades, it shouldn't require sendinganydata or information orANYTHINGto Samsung to be able to print.

author: Bored@Work
author_rank: Super Contributor
timestamp: October 12, 2014, 09:23:03 am
content: You have at least two alternatives you could try:1. Don't install that shit coming on the Samsung driver CD. Instead, let Windows install the basic driver for that printer. This requires you have Windows configured to download recommended drivers.2. Install that shit coming on the Samsung driver CD. Then proceed and block the connections in your firewall.

author: miguelvp
author_rank: Super Contributor
timestamp: October 12, 2014, 09:24:34 am
content: Regardless on how you agreed or not you can prevent the software to communicate to home base. Doesn't everyone have a firewall that can exclude specific programs to communicate?Edit: bored beat me to the firewall.

author: kolonelkadat
author_rank: Regular Contributor
timestamp: October 12, 2014, 09:54:39 am
content: Quote from: true on October 12, 2014, 09:06:05 amIf that were the case, Id order a dozen and breed em for some serious profit.If you dont want it phoning home, open up itdrvn.dll in a hex editor, go down to 1F300h and change that 56 8B 74 to something like C2 10 00. I havent checked all the dlls but that seems like its the one responsible for phoning home.On the real though, with the amount of data that companies store and share about you, the amount of ink in your printer should be the least of your worries.

author: Brutte
author_rank: Frequent Contributor
timestamp: October 12, 2014, 10:00:06 am
content: Quote from: SeanB on October 11, 2014, 08:34:52 pmandQuote from: kolonelkadat on October 12, 2014, 08:59:15 amIf you do not mind I do not want to discuss about which of keyloggers are legitimate and what the keylogger definition is etc, because that greatly depends on the individual preferences of the user.The key point is that neither sellers nor Samsung provide this keylogger policy information to the customersbeforebuying agreement takes place. Neither on website, nor on the box, nor in manuals, etc.Their "gotcha policy" exploits the fact you buy the printer in belief the buying agreement contains all mutual obligations (that you give them money, they provide the software, hardware, warranty, support etc).Unfortunately after unboxing you have to face that nasty feeling someone is approaching you from the back. I am not really interested in the details of how deep the intercourse is going to be or is it kissing only -I just do not want it. Full stop.Do you believe I would ignore the"Warning: this printer comes with additional agreement (details on a CD) user has to accept, otherwise forget printing”?

author: mrflibble
author_rank: Super Contributor
timestamp: October 12, 2014, 10:27:00 am
content: Quote from: Bored@Work on October 12, 2014, 09:23:03 am3 - write script to poison statistics according to the fuck the fucking fuckers maxim.And after you have made sure said script will provide quality data to the nice people at Samsung, then you return that printer to wherever you bought it as per"does not do what it says on the box".Aren't there laws meant to protect consumers from precisely this sort of fun?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 12, 2014, 10:27:16 am
content: It's inexcusable for there not to be a "no thanks" option on something like this.

author: wraper
author_rank: Unknown
timestamp: October 12, 2014, 10:33:56 am
content: Quote from: Brutte on October 12, 2014, 10:00:06 amAccording to this, no smartphone or tablet shall you buy at all.

author: Brutte
author_rank: Frequent Contributor
timestamp: October 12, 2014, 10:48:00 am
content: Quote from: mikeselectricstuff on October 12, 2014, 10:27:16 amThere isn't. That is the part of their "gotcha policy".If you would like to check that yourself - install the driver from the Samsung website I linked and make the first print attempt (you do not need a printer itself for that agreement to appear). AFAIK this applies to all new Samsung printers (not tested).

author: mrflibble
author_rank: Super Contributor
timestamp: October 12, 2014, 10:53:42 am
content: Re-reading that "agreement", I wonder if Samsung can get a class action lawsuit for willfully selling defective equipment. Because apparently there is no way to use that printer to actuallyprintthings within the perfectly reasonable confines of NOT agreeing to have a printer driver send undefined types and amounts of data.What's next? Buy carton of milk, and then you only get to drink the milkafteryou agree to send your dna profile to whoever likes to collect datathistime? Yes yes, they promise to not use your data in <fill-in-excuse-here>. Excellent. Lets just pre-empt that by not sending data at all. Problem solved. May whoever thought of this join all other KPI checkbox checking bleepers, and live in interesting times.

author: kxenos
author_rank: Frequent Contributor
timestamp: October 12, 2014, 10:54:47 am
content: It's not something samsung-specific. This "we've got you by your balls" corporate mentality is found everywhere.

author: firewalker
author_rank: Super Contributor
timestamp: October 12, 2014, 11:00:09 am
content: They should send back the files the user prints...Alexander.

author: mrflibble
author_rank: Super Contributor
timestamp: October 12, 2014, 11:07:12 am
content: Quote from: kxenos on October 12, 2014, 10:54:47 amAs per corporate directive #3 they just try to find out what they can get away with. And with humans being such complacent monkeys that is quite a lot. Only way that works is feedback that hurts them financially. And public opinion, which again affects them financially.

author: Brutte
author_rank: Frequent Contributor
timestamp: October 12, 2014, 11:23:22 am
content: Quote from: mrflibble on October 12, 2014, 10:53:42 amBeing fair - I do not know all the details.The short preamble to the agreement I attached in opening post is just an excerpt of a lengthy full agreement you can read when you click on one of the links available.But as I mentioned earlier, no matter how interesting the agreement is, whether they offer me the only chance to win a Ferrari or not, if keylogger sends my IP, ID, toner level, DNA or only MAC number, if keylogger is customized or enabled once in a month, daily or permanently, that is not the point!The only important thing for me is thatI want to have the choice of rejecting that damned scam!

author: German_EE
author_rank: Super Contributor
timestamp: October 12, 2014, 11:26:39 am
content: If such a device was used in an office where medical records are printed would it be legal?

author: nitro2k01
author_rank: Frequent Contributor
timestamp: October 12, 2014, 12:21:04 pm
content: Quote from: Brutte on October 12, 2014, 10:00:06 amKeylogger has a clear definition - something that logs keystrokes from the keyboard. What this program does is something different, as far as we know. Perhaps terms like data mining or spyware would be more appropriate.This software looks dodgy, but I'd be interested in the three links on the bottom right. The first two will likely outline what data will be shared. The last link may offer a way to not install this feature.

author: Brutte
author_rank: Frequent Contributor
timestamp: October 12, 2014, 12:43:54 pm
content: Quote from: German_EE on October 12, 2014, 11:26:39 amThat is the question about the very details of the keylogger agreement, I suppose not contained in the preamble but hidden down deep in the full text that only lawyers can understand (and I do not even want to read that).Before posing that question, ask yourself why would you accept signing the agreement with someone who sells you such product without prior informing thatyou have to read all that agreement and accept it, no printing otherwise?Frankly, if the driver contained"Yes, I unconditionally trust Samsung" and"You are kidding with that keylogger, aren't you?"then what would be your choice then?

author: timb
author_rank: Super Contributor
timestamp: October 12, 2014, 01:08:22 pm
content: This isn't a fucking key logger, stop being so sensationalist. Data Mining is the word you're looking for.Sent from my Smartphone

author: all_repair
author_rank: Frequent Contributor
timestamp: October 12, 2014, 01:29:03 pm
content: Toner, so they can tell what type to buy, when to buy, and maybe how and where to buy.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: October 12, 2014, 01:30:51 pm
content: What happens when you "click the link to review or change the settings".... ?

author: Brutte
author_rank: Frequent Contributor
timestamp: October 12, 2014, 01:44:19 pm
content: Quote from: nitro2k01 on October 12, 2014, 12:21:04 pmI think some of you have missed key point of the topic.Why do you think it matters what the links offer and what are the conditions of that agreement?Guys, third time, that is not the point!!The problem here is that Samsung is selling a useless brick advertising it as a laser printer. Sure, you can use it for printing but that is explained to the buyerafter buying agreement and under some conditionsa buyer must agree upon to print.Sounds like for some of you there are such conditions that Samsung policy is fair/lawful/acceptable, namely if the restrictions it brings could be easily hacked, tweaked or firewalled. That is not very cheering, guys.Let me guess, now we are going to have a fruitless discussion about what conditions in such "gotcha policy" are acceptable and what conditions are not..

author: nitro2k01
author_rank: Frequent Contributor
timestamp: October 12, 2014, 02:18:46 pm
content: Quote from: Brutte on October 12, 2014, 01:44:19 pmMaybe the third link ("click here for setup options") has a simple checkbox that says "do not install the data logger". If that is just one click away in the installer, you can no longer argue that you are FORCED to install this feature to use the printer. Did you even try?

author: carl0s
author_rank: Unknown
timestamp: October 12, 2014, 11:19:46 pm
content: I was thinking the same. I'd like to hear the results!

author: Shock
author_rank: Super Contributor
timestamp: October 13, 2014, 12:44:55 pm
content: If you check out the bottom option you can probably turn off sending data to Samsung.Before you get too excited this type of licensing agreement is buried in all sorts of software. Some don't even ask for permission.I would like to see you prove it's actually logging keystrokes or gathering personal information before waving your hands in the air. You are free to return it if you don't like the agreement and buy something else. So I don't see what the big deal is.

author: microbug
author_rank: Frequent Contributor
timestamp: October 13, 2014, 04:14:35 pm
content: IDK about Windoze, but when I wanted to get my Samsung printer working on my Mac, I just went into settings and clicked on the printer. It found a driver and installed it, no keylogger/whatever involved.

author: linux-works
author_rank: Super Contributor
timestamp: October 22, 2014, 01:18:43 pm
content: I have a samsung laser printer. very cheap (price) and so far, has been working great. I hate samsung the company, though, but this was too good of a price and I needed one at the time.when I print from windows, you did have to accept their stupid license.HOWEVER, when I print via linux, there is no corporate driver and no 'agreement'.maybe it just makes sense to have linux (even a rasp-pi) be a front-end and have it receive print jobs and relay them to the printer. in fact, I may think about doing that. at the very least, a pi as a firewall (usb/ethernet as the 2nd interface) might be in order to give it a 'deny' for outbound IP comms and only let it receive print jobs from the pi, itself.

author: TheEPROM9
author_rank: Frequent Contributor
timestamp: November 12, 2014, 05:06:24 pm
content: Quote from: Brutte on October 11, 2014, 08:10:53 pmLooks like a printer that needs hacking to me, if that fails then pack it full of gun powder and send the shards back to Samsung with a letter that tells them what you think.

author: TheBay
author_rank: Unknown
timestamp: November 13, 2014, 10:27:47 pm
content: Spoof the data and flood their servers I say. Join them at their own game.

author: miguelvp
author_rank: Super Contributor
timestamp: November 13, 2014, 11:55:16 pm
content: Since the OP never did provided what is on the other links, I downloaded the software just to satisfy my curiosity, here are the links:Samsung Privacy Statement Online:http://www.samsung.com/us/common/privacy.htmlDetailed Information about Internet connection usage:http://www.samsungsetup.com/ts/agreements/en/Click here for setup options:You can turn all that stuff off, you still have to agree but that's just fine.People tend to make mountains out of anything.

author: TheBay
author_rank: Unknown
timestamp: November 14, 2014, 10:00:36 am
content: Quote from: miguelvp on November 13, 2014, 11:55:16 pmGlad you pointed that out.Samsung laser printers are awful anyway, they made a few MFP's that were HP clones using cheaper plastic parts and charge a fortune for consumables.Every sales rep that sold 4 got a free plasma TV LOL

author: Refrigerator
author_rank: Super Contributor
timestamp: November 15, 2014, 08:01:18 pm
content: I use an old Samsung printer, you can download "samsung universal printer driver" and you should be fine.

author: Brutte
author_rank: Frequent Contributor
timestamp: November 29, 2014, 01:38:15 pm
content: Quote from: miguelvp on November 13, 2014, 11:55:16 pmI have never planned to study their agreement, not mentioning accepting it. The software was removed, conditions "rejected", the "printer" was shipped back and only awful Samsung taste persisted.QuoteOnce again, I have no plans for any internet connection agreements with Samsung, irrespective of their conditions. Nor prior buying nor after that.I am glad their conditions and "gotcha policy" is fine for you.

author: nitro2k01
author_rank: Frequent Contributor
timestamp: November 29, 2014, 07:52:42 pm
content: Quote from: Brutte on November 29, 2014, 01:38:15 pmIf you don't trust the checkboxes that allow you to explicitly turn off that functionality, you should ask yourself if you can trust ANY software.

author: Zero999
author_rank: Super Contributor
timestamp: November 29, 2014, 09:08:31 pm
content: This is pretty common with any software.What's worse is, quite often suppliers don't accept returns on software and it's exempt from the distance selling regulations so if you can't read the EULA before buying it then returning it for a refund can be a problem. I don't know how this works legally but you should be able to read any contracts, before handing over any money.