Sony DRM system using rootkit technology

[Laddydaddy]

It looks like Sony is now going to issue a fix to remove the software.

http://news.yahoo.com/s/nf/20051103/tc_nf/39083

You can download the patch at;

http://cp.sonybmg.com/xcp/english/updates.html

[VegasBud]

F-Secure had this to say about the uninstallation offered by Sony:

However, they will install additional ActiveX components to your system while they are doing this so be adviced.

I guess you have to ask yourself if a company that has already installed a rootkit on your computer can be trusted enough to let them install "ActiveX components" on your system. Just because a rattlesnake has already bit you doesn't mean it won't bite you again.

[painkiller]

Here's also an opinion from E-Week.

This topic just gets worse for Sony BMG's sake.

http://www.eweek.com/article2/0,1895,1881592,00.asp?kc=ewnws110405dtx1k0000599

[BogieV]

Note it is patch for their "software" XPC - not a removal tool.
Patch?! that will let remove itself??? Like patch to uninstall MS Windows? What the...

[painkiller]

In the original install, the resulting files were - in effect - hidden from view.


The so-called "patch" doesn't remove anything.

Other than the fact you can now see the installed files.

How anyone calls this a "patch" - needs to have their heads examined - like they did to your hard drive(s).

[ROF]

It's called a patch because it's not the $sys$ files this installs but the $sys$ any hacker could install without your knowledge. These files and their installation will now be visible because of the removal of the rootkit style of installation.

Going the Sony route of removal requires you to fill out two pages worth of personal information. Way to go Sony. do you trust them when they say this personal information will not be shared? I don't think I would.

[gadgetguy]

www.sysinternals.com has a utility called RootkitRevealer to detect the presence of rootkit software on your system.

[VegasBud]

Unfortunately, even if you use RootkitRevealer, most people don't know how to interpret the results. On the Rootkit Revealer forum everyone just posts the results they get, and one poor overworked moderator tells them what their results mean.

Mark (of SysInternals) has a new entry today in his blog about the "uninstaller" Sony is distributing. Anyone considering running the uninstaller should probably read what he has to say before proceeding.

In the new entry, he also describes the program "phoning home" and how it is:

...not mentioned in the EULA, is refuted by Sony, and is not configurable in any way

[gadgetguy]

Unfortunately, even if you use RootkitRevealer, most people don't know how to interpret the results. On the Rootkit Revealer forum everyone just posts the results they get, and one poor overworked moderator tells them what their results mean.

True, but are you suggesting that it shouldn't be run? I would think anyone concerned about this would want to run it to see if it detects anything on their system. Another good source of information about rootkits and other security concerns can be found at Steve Gibson's site, www.grc.com.

[VegasBud]

...are you suggesting that it shouldn't be run?

No, but the results of a RKR scan aren't definitive. Some legitimate software could end up in the scan, too. The RKR forum makes it clear that it is beyond the average user's abilities to separate what's ok, and what isn't. If you're not crystal clear in what you're doing, you may just make matters worse. Even if you can correctly identify the right entries, there could be problems. In Mark Russinovich's original blog entry about this, he warns:

...most users that stumble across the cloaked files with a RKR scan will cripple their computer if they attempt the obvious step of deleting the cloaked files

For the less skilled user, it might be better to try another approach. F-Secure has a beta for a program called Blacklight that not only detects the rootkit, but attempts to remove it, and is "useful even for non-technical users". That may be a good solution, but it is a beta, so you use it at your own risk.

If you still had any trust at all in Sony, you could try the uninstaller they're distributing, but all it really does is decloak the rootkit, and Mark warns that even then, the "...uncloaking patch puts users systems at risk of a blue-screen crash and the associated chance of data loss". Add in that the current version of the "uninstaller" is 3.5 MB of drivers and executables from the same people who put the rootkit on your computer in the first place. That sure doesn't sound like a good idea to me.

[somebodeez]

Steve Gibson with Leo Laporte "Security Now".
You can listen to their discussion about this.
http://www.grc.com/securitynow.htm

[somebodeez]

Sony President of Global Digital Business says

"Most people don't even know what a rootkit is so why should they care about it?"

http://www.npr.org/templates/story/story.php?storyId=4989260

[painkiller]

That Sony president may be right on the money (about the "most" part). But that's it.

Unfortunately for him, he is still stirring up a real hornet's nest - by insulting the rest of us.

Maybe his tune will change when the company reports on their next quarter.

[Neroon]

Maybe his tune will change when the company reports on their next quarter.

Not bloody likeley. If their sales take a nosedive after this, they'll just blame it on internet pirates again.

[somebodeez]

I was gonna ask Santa for a new Sony DVD burner but now I'm off to go check the list to see how the other brands rate. :P

[junkmalle]

Maybe his tune will change when the company reports on their next quarter.

Not bloody likeley. If their sales take a nosedive after this, they'll just blame it on internet pirates again.

Don't buy ANY Sony products. It will hard to blame a drop in hardware sales on internet pirates.

[gadgetguy]

Not bloody likeley. If their sales take a nosedive after this, they'll just blame it on internet pirates again.

Let me get this straight. Sony pisses off the customer base by secretly installing software to prevent piracy and when sales fall, they will blame it on the piracy that they supposedly prevented? Yeah, that sounds right.

[BSR]

Sony President of Global Digital Business says

"Most people don't even know what a rootkit is so why should they care about it?"

http://www.npr.org/templates/story/story.php?storyId=4989260

That has to be one of the most ignorant comments ever.

At one time most people didn't know what phishing on the internet meant, so why do they care about it now??

Most people don't know much about computer security, but they are sure learning fast, why, because they should, and they want to be safe and protected.

[rkr1958]

Sony President of Global Digital Business says

"Most people don't even know what a rootkit is so why should they care about it?"

http://www.npr.org/templates/story/story.php?storyId=4989260

That has to be one of the most ignorant comments ever.

At one time most people didn't know what phishing on the internet meant, so why do they care about it now??

Most people don't know much about computer security, but they are sure learning fast, why, because they should, and they want to be safe and protected.

Thanks to Sony ... A lot more people know what a rootkit is now. And ... a lot more people will now protect themselves from this type of virus ... all thanks to Sony ...

[roma_turok]

Sony sued over rootkits

SONY IS FINALLY GOING to HAVE to answer the tough questions, it is being sued.

http://www.theinquirer.net/?article=27508

[somebodeez]

I was hoping someone would do this!
The very best of luck to ALCEI.

[BSR]

Interesting read, they are just loving their decision now, lol:

Sony DRM Decloaking Patch Might Crash Windows
Researcher says Sony's copy protection software also appears to communicate with Sony servers.
http://www.pcworld.com/news/article/0,aid,123438,tk,wb110705x,00.asp

A quote from the article about Sony:
"It's obvious that whoever's written this doesn't have all that much experience in writing drivers for Windows,"

[junkmalle]

More up to date news:

http://www.sysinternals.com/Blog/

"they are making clear to any potential customers that they are a not only technically incompetent, but also dishonest"

[Micker_C]

Actually it seems having AnyDVD on your system is Actually a protection from the Sony rootkit, I know something about these matters & although I don't have AnyDVD, it may be soon be my next software buy; to avoid these problems.

http://www.sysinternals.com/blog/

I'm supposing that Sony realizes the gloves are off, now. There will not be any legal protection for any arguement they have any longer, in fact I know of two Law Suits under way right now against Sony. I also imagine the Black Hat community can and will probably act against Sony with impunity.

The overall downside of the root kit is that it nules your windows system protective measures due to it causing a memory buffer overrun, that in fact is another issue for Sony, as it breeches current Cyber Laws. The API hook used is the work of pure, unadultered amatures.

A very heavy subject, but as of now anything with the name Sony will never, ever be purchased by anyone I know after this -Hardware or software. When a bought CD can't be played on a PC without causing a BSOD when trying to fix their deliberate attempt to "Call home" and disable the owners CD writer/reader. That's as hardcore as a company can get!

Sets a very unsettling presedence for future company actions, this must go to Court or all PC users can forget about any security of their PC. Follow the link offered at the beginning by the OP, half way down on the provided link above, will be a better method of understanding,you will see a black screen shot, that will show you how to see if you are "INFECTED".

Bad news, indeed. For casual PC users, who test positive the best result will be a format of the drive.

Until otherwise proven, it seems AnyDVD will be your best protection.

DON'T USE THE SONY FIX

Cheers

[painkiller]

I have also read through the SysInternals Blog.

Both Sony and the firm, First4Internet, that made their "DRM" software maker actually think they don't have to answer to anybody for what they have done.

Let's just hope they don't get away with this.

[Micker_C]

I have also read through the SysInternals Blog.

Both Sony and the firm, First4Internet, that made their "DRM" software maker actually think they don't have to answer to anybody for what they have done.

Let's just hope they don't get away with this.

I figure this will be "General News" right before Christmas, lets see how Sony holds up with stock holders Hit them where it hurts! I'll be watching that for entertainment and I don't have stock

One thing I don't have & would like to see is a list of all the titles they did this with, I said like to see as it won't matter much as Sony has a big 'Stop Sign' planted all over the place and nothing they turn out will enter many homes after this gets out to the general public. People have enough headaches, without actually buying into one

Cheers

[Noahtuck]

Maybe it's just me, but from the photo in that article, it ask's if you agree or not, so why not just choose "NO" and don't install their crap ?

And if they make it so you have to have their "software" to play their cd's on a pc, that makes it incompatibile ? i mean if it's to play on a standard cd player, then you have to be able to play it on your pc with anything you want ?
And just rip it with CDEX if ya want it

Maybe i missed something, i don't know, guess i'll have to go buy one and check it out 8)

I have just oh so hated sony for better than two decade's, can ya tell ?? over there to the left...

Sony President of Global Digital Business says

"Most people don't even know what a rootkit is so why should they care about it?"

http://www.npr.org/templates/story/story.php?storyId=4989260

Sony sued over rootkits

SONY IS FINALLY GOING to HAVE to answer the tough questions, it is being sued.

http://www.theinquirer.net/?article=27508

[thecoalman]

One thing I don't have & would like to see is a list of all the titles they did this with,

There's a link at the beggining of this thread to a page with a list, pretty small though so I figure it's not complete. They also have a link how to google for the titles with it from Amazon. I noticed one review of a title mentioning that it contained the rootkit.

[Headbanger's Ball]

From where I sit....Sony just lost out on the sale of a PS3 and a DVD burner.
Start screwing the comsumers; we'll screw you back.

[BSR]

Just another article, I also read that the new Windows antivirus that will be coming out will search for rootkits now.

http://www.pcworld.com/news/article/0,aid,123454,00.asp

Quotes from article:

security vendor Computer Associates International said today it is now classifying Sony's software as spyware and will begin searching for and removing XCP with its antispyware software, starting on November 12.

ALCEI-EFI (Association for Freedom in Electronic Interactive Communications - Electronic Frontiers Italy)
The complaint alleges that XCP violates a number of Italy's computer security laws by causing damage to users' systems and by acting in the same way as malicious software, according to Andrea Monti, chair of the ALCEI-EFI. "What Sony did qualifies as a criminal offense under Italian law," he said in an e-mail interview.

Computer Associates, said the company will direct its eTrust PestPatrol product to remove XCP from customers' PCs. "We have a scorecard, and there are 22 points that we go through examining how the software behaves," he said. "In this case, XCP is falling down."