Samsung Printer Keylogger Rant

[Brutte]

I have bought a Samsung M2022 laser printer recently.

Adverts: easy installation, just connect power, plug USB, run driver, press “print”, end of story?
Naah of course not.

The driver itself (XP) installs seamlessly but at first print attempt it won't pass the data to the printer. Instead it displays the msgbox “proposing” an agreement on installing a Samsung keylogger software: Please trust us, closed source, we do our best, options available, of course not your personal data, kissmyass.

You have two choices then:

• Accept keylogger agreement and get what you paid for, or
• restart a computer (the “close” and “hide” window buttons are disabled) and reconsider the "proposition".

I hoped that this was just one of those bad days. The next day, after reinstalling, that came up with same msgbox. After contacting Samsung support where I asked for “keylogger-less driver” I got a prompt reply (rough meaning):

“No internet connection agreement - no printing”.

[SeanB]

Note to self, do not buy Someshit printers ever. Wonder how much of thier stuff does an ET and phones home, and what you will get if you disable it.

You think they have forgotten what happened to Sony with their software installs on CD's? That class action did hurt Sony both reputation wise and financially.

[free_electron]

what makes you think this has a key logger ?

[SeanB]

"Monitor user interaction" seems to mean looking at mouse activity, keyboard activity and active window at the time. Seems to fit the definition of a keylogger.

If it was only sending info on the job like toner used, image density,pages used and nothing else, and sending without any machine identifier other than the router or NAT external IP then that would be legitimate data. Anything more is going to be identifiable.

[Brutte]

what makes you think this has a key logger ?

From the preamble of the agreement? How do you call a "software that may log user interactions and use your IP address and internet connection to transmit data (..)"?

[mariush]

It means log user interaction with the printer ... how many pages you print, how many grayscale, how many color,  how many landscape or potrait. how much toner is used to print each job ...

The internet to transmit data part ... the control panel applet or whatever software is installed has a section where it suggests to buy toner ... maybe it reports the level of toner in the printer and i think when you press a button in that section it sends your IP to a server of theirs in order to do geolocation and suggest back stores from where to buy toner, drum, stuff like that.

Doesn't mean it logs what you type or what you do with the computer...

edit: i say this because i used to own a samsung ml-1700 printer, a similar text was with that driver as well and i remember the software had a section where you could click to buy toner or get a list of service locations.  Now it's at my sister's place so I can't double check, I own a Lexmark printer now.

[rdl]

Wow, that would be going right back to where ever I bought it if it was me. I would also let them know that I'd never buy another Samsung product again and would strongly suggest the same to everyone I meet for the rest of my life.

[German_EE]

Taking the printer back would be my preferred action as well, this is unacceptable.

[kolonelkadat]

crying 'keylogger' is quite the bold accusation. Especially considering they explicitly state that they collect "device information and information regarding the life cycle of the toner cartridge (Printer model name, serial number, installation date, toner usage level and supplier ID). This information will be used as data to help Samsung provide better user environment. Under no circumstances shall we collect any information other than the information listed above."

[true]

It means log user interaction with the printer ...

Have you not seen the shit companies want these days? Assume nothing.

Take the printer back and demand a refund.

crying 'keylogger' is quite the bold accusation. Especially considering they explicitly state that they collect "device information and information regarding the life cycle of the toner cartridge (Printer model name, serial number, installation date, toner usage level and supplier ID). This information will be used as data to help Samsung provide better user environment. Under no circumstances shall we collect any information other than the information listed above."

Perhaps it is a bold accusation, but regardless if there is a keylogger or not, this is a fucking printer, it puts toner to paper, there is no right reason to require an agreement like the one provided to use the printer. Brutte should be under no obligation to help Samsung's business to use a physical device. Yeah, you can argue software rights, etc but this is a fucking printer, Postscript or even PCL is pretty fucking standardized and printing has been basic standard computing technology for decades, it shouldn't require sending any data or information or ANYTHING to Samsung to be able to print.

[Bored@Work]

You have at least two alternatives you could try:

1. Don't install that shit coming on the Samsung driver CD. Instead, let Windows install the basic driver for that printer. This requires you have Windows configured to download recommended drivers.

2. Install that shit coming on the Samsung driver CD. Then proceed and block the connections in your firewall.

[miguelvp]

Regardless on how you agreed or not you can prevent the software to communicate to home base. Doesn't everyone have a firewall that can exclude specific programs to communicate?

Edit: bored beat me to the firewall.

[kolonelkadat]

this is a fucking printer

If that were the case, Id order a dozen and breed em for some serious profit.


If you dont want it phoning home, open up itdrvn.dll in a hex editor, go down to 1F300h and change that 56 8B 74  to something like C2 10 00. I havent checked all the dlls but that seems like its the one responsible for phoning home.

On the real though, with the amount of data that companies store and share about you, the amount of ink in your printer should be the least of your worries.

[Brutte]

If it was only sending (...) then that would be ldegitimate data. Anything more is going to be identifiable.

and

crying 'keylogger' is quite the bold accusation.

If you do not mind I do not want to discuss about which of keyloggers are legitimate and what the keylogger definition is etc, because that greatly depends on the individual preferences of the user.

The key point is that neither sellers nor Samsung provide this keylogger policy information to the customers before buying agreement takes place. Neither on website, nor on the box, nor in manuals, etc.
Their "gotcha policy" exploits the fact you buy the printer in belief the buying agreement contains all mutual obligations (that you give them money, they provide the software, hardware, warranty, support etc).

Unfortunately after unboxing you have to face that nasty feeling someone is approaching you from the back. I am not really interested in the details of how deep the intercourse is going to be or is it kissing only - I just do not want it. Full stop.
Do you believe I would ignore the "Warning: this printer comes with additional agreement (details on a CD) user has to accept, otherwise forget printing”?

[mrflibble]

You have at least two alternatives you could try:

3 - write script to poison statistics according to the fuck the fucking fuckers maxim.

And after you have made sure said script will provide quality data to the nice people at Samsung, then you return that printer to wherever you bought it as per "does not do what it says on the box".

Aren't there laws meant to protect consumers from precisely this sort of fun?

[mikeselectricstuff]

It's inexcusable for there not to be a "no thanks" option on something like this.

[wraper]

If it was only sending (...) then that would be ldegitimate data. Anything more is going to be identifiable.

and

crying 'keylogger' is quite the bold accusation.

If you do not mind I do not want to discuss about which of keyloggers are legitimate and what the keylogger definition is etc, because that greatly depends on the individual preferences of the user.

The key point is that neither sellers nor Samsung provide this keylogger policy information to the customers before buying agreement takes place. Neither on website, nor on the box, nor in manuals, etc.
Their "gotcha policy" exploits the fact you buy the printer in belief the buying agreement contains all mutual obligations (that you give them money, they provide the software, hardware, warranty, support etc).

Unfortunately after unboxing you have to face that nasty feeling someone is approaching you from the back. I am not really interested in the details of how deep the intercourse is going to be or is it kissing only - I just do not want it. Full stop.
Do you believe I would ignore the "Warning: this printer comes with additional agreement (details on a CD) user has to accept, otherwise forget printing”?

According to this, no smartphone or tablet shall you buy at all.

[Brutte]

It's inexcusable for there not to be a "no thanks" option on something like this.

There isn't. That is the part of their "gotcha policy".
If you would like to check that yourself - install the driver from the Samsung website I linked and make the first print attempt (you do not need a printer itself for that agreement to appear). AFAIK this applies to all new Samsung printers (not tested).

[mrflibble]

Re-reading that "agreement", I wonder if Samsung can get a class action lawsuit for willfully selling defective equipment. Because apparently there is no way to use that printer to actually print things within the perfectly reasonable confines of NOT agreeing to have a printer driver send undefined types and amounts of data.

What's next? Buy carton of milk, and then you only get to drink the milk after you agree to send your dna profile to whoever likes to collect data this time? Yes yes, they promise to not use your data in <fill-in-excuse-here>. Excellent. Lets just pre-empt that by not sending data at all. Problem solved. May whoever thought of this join all other KPI checkbox checking bleepers, and live in interesting times.

[kxenos]

It's not something samsung-specific. This "we've got you by your balls" corporate mentality is found everywhere.

[firewalker]

They should send back the files the user prints... 

Alexander.

[mrflibble]

It's not something samsung-specific. This "we've got you by your balls" corporate mentality is found everywhere.

As per corporate directive #3 they just try to find out what they can get away with. And with humans being such complacent monkeys that is quite a lot. Only way that works is feedback that hurts them financially. And public opinion, which again affects them financially.

[Brutte]

Re-reading that "agreement", I wonder if (..) apparently there is no way to use that printer to actually print things within the perfectly reasonable confines of NOT agreeing to have a printer driver send undefined types and amounts of data.

Being fair - I do not know all the details.
The short preamble to the agreement I attached in opening post is just an excerpt of a lengthy full agreement you can read when you click on one of the links available.

But as I mentioned earlier, no matter how interesting the agreement is, whether they offer me the only chance to win a Ferrari or not, if keylogger sends my IP, ID, toner level, DNA or only MAC number, if keylogger is customized or enabled once in a month, daily or permanently, that is not the point!
The only important thing for me is that I want to have the choice of rejecting that damned scam!

[German_EE]

If such a device was used in an office where medical records are printed would it be legal?

[nitro2k01]

If it was only sending (...) then that would be ldegitimate data. Anything more is going to be identifiable.

and

crying 'keylogger' is quite the bold accusation.

If you do not mind I do not want to discuss about which of keyloggers are legitimate and what the keylogger definition is etc, because that greatly depends on the individual preferences of the user.

Keylogger has a clear definition - something that logs keystrokes from the keyboard. What this program does is something different, as far as we know. Perhaps terms like data mining or spyware would be more appropriate.



This software looks dodgy, but I'd be interested in the three links on the bottom right. The first two will likely outline what data will be shared. The last link may offer a way to not install this feature.