Samsung has been hit by allegations that software it uses to update some of its machines has been found deliberately disabling Windows Update without users’ knowledge.
The Korean computing giant’s SW Update software – designed to update OEM bloatware, drivers and other features on Samsung PCs – was recently found to contain an executable labelled ‘Disable_Windowsupdate.exe’.
Blogging about the problem on Tuesday, Microsoft MVP Patrick Barker, found that the file, digitally signed by Samsung, had effectively been included in order to avoid installing potentially incompatible drivers.
A support representative he spoke to revealed the following:
“When you enable Windows updates, it will install the Default Drivers for all the hardware [on the] laptop which may or may not work. For example if there is USB 3.0 on laptop, the ports may not work with the installation of updates. So to prevent this, SW Update tool will prevent the Windows updates.”
However, preventing Windows Updates also effectively means stopping any security patches getting through to the affected machine – a move which, if true, has raised concerns in the security industry.
“The problem, of course, is that this is a heavy-handed approach that completely disables future security updates to Windows, a process that represents years of hard-won security maturity from Microsoft and computer vendors, which is something a major hardware vendor like Samsung should consider more seriously,” argued Rapid7 security engineering manager, Tod Beardsley.
“It’s unknown today how many Samsung customers have been accidentally skipping critical software updates, or for how long.”
Samsung has not responded to Infosecurity at the time of writing, but an official response sent to some news sources had the following:
“It is not true that we are blocking a Windows 8.1 operating system update on our computers. As part of our commitment to consumer satisfaction, we are providing our users with the option to choose if and when they want to update the Windows software on their products.
“We take product security very seriously and we encourage any Samsung customer with product questions or concerns to contact us directly at 1-800-SAMSUNG.”
Barker has responded to this statement, arguing that “I never implied it specifically blocked a ‘Windows 8.1 OS system update’, just that their SW Update software is preventing Windows Update from automatically installing updates, and forcing the user to have it set to ‘let me choose whether to download and install’.
“However you look at this, Samsung’s solution to what we can guess is a device driver workaround was not done in the best way, or a safe way,” he added. “I mean, come on, the exe is named Disable_Windowsupdate.exe.”