Sony DRM system using rootkit technology

[Snakebyte1]

My very first Walkman was a Sony Walkman F1 I got in high school It's still going some 20+ years or so later. I got a Walkman F16 at some point and it was a POS. It was stylish but it chewed tapes left, right and center and I gave up on it after 3 months.

I have a Sony editing VCR (can't recall the model right now). Its been rock solid but its over 10 years now. I also have Sony TRV-110 Digital8 Camcorder and its great, but it too is over 5 years old now. Seems to me Sony decided to put more effort into styling the products than to making them durable over the last few years.

From all the posts it seems like there has been a great shift in quality. Has senior management changed in that time? The dumb a$$ comment by their president was ignorant and arrogant. If that is how their senior managemtn act, its no wonder their product quality has sufferred. I don't follow the stock market, but I'll guess Sony's stock has been declining over the last few years as well. Its amazing how fast bad leaders can drive a good company into the ground.

[VegasBud]

...I'll guess Sony's stock has been declining over the last few years...

Good guess. Sony stock peaked about five years ago at $160, and is currently trading about $34.

If you're interested, here's a chart of their stock:

[jg0001]

On two of my Windows XP Pro SP2 machines, I disabled autorun and then for months could not understand why my DVD drives would never detect the 2nd disc inserted -- they'd always see the directory of the first disc, even if it wasn't in there anymore! The solution as told to me in a different forum -- turn Autorun back on. Sure enough, that was the problem. Does anyone know why autorun is needed to ensure proper operation?

[Headbanger's Ball]

Your drive probably didnt realize there was a new disc inside. Hitting F5 would refresh the directory.

[Cornucopia]

Hitting F5 doesn't always do it. I've had the same experience.

Scott

[dcsos]

First 4 Internet
has made some buggy software tho'..It doesn't always work the way you describe:..
Over here I purchased the new SONY dual disc release of FIONA's EXTROADINARY
new album..
This after paying more than the general public for the release (over 19 dollars US)
because I was entrapped into a scheme on August 15th or so.

You see, FIONA announced a free concert at the VIRGIN MEGA STORE
After lineing up for this event (400 'freebies expected'), we were told the only way to get into this FREE EVENT was to PRE-ORDER the Disc (unfortunately, they couldn't give it to us yet, so we'd have to wait for the NOVEMBER Release)
So I saw the "free" concert by PAYING for the copy protected disc that I couldn't have till NOV 4 release..

Then, on the release date,after I was penalized 5 dollars for "PRE ORDERING"
I discovered that my new disc wouldn't even read in most of my COMPUTER CD/DVD drives. Unless I could RIP these songs to the harrddrive, I was faced with an overpriced disc that wouldn't even work in my equiptment!

And so, I curiously found that my 6X Sony DVD-ROM could actually RIP as usual on the THICK DUAL DISC audio side without installing the ROOTKIT PROGRAM.
Why the Sony drive acted like the Sony disc was anyold release??!..
what a hoot!....
.Meanwhile the NEC's that did read the disc mustve done that evil install..will check those machines for irregularities..
Who's on First over at First4internet?
It seems that this scheme wasn't fully baked.....

[dcsos]

Also could note my SONY 500A Dual Format DVD-R died after 350 burns.
My A03 by Pioneer (DVD-R) only is still going (1000+burns)
NUFF SAID!!!

[Headbanger's Ball]

Just found this link: http://www.smarthouse.com.au/Entertainment/Industry/?article=/Entertainment/Industry/News/Q7P7L4N2

Hitting F5 doesn't always do it. I've had the same experience.

Thanks.

[thecoalman]

Now it's getting interesting......

However, Computer Associates, which has a security division, said on Monday it had found further security risks in the Sony software and was releasing a tool to uninstall it directly.

According to Computer Associates, the Sony software makes itself a default media player on a computer after it is installed. The software then reports back the user's Internet address and identifies which CDs are played on that computer. Intentionally or not, the software also seems to damage a computer's ability to "rip" clean copies of MP3s from non-copy protected CDs, the security company said.

"It will effectively insert pseudo-random noise into a file so that it becomes less listenable," said Sam Curry, a Computer Associates vice president. "What's disturbing about this is the lack of notice, the lack of consent, and the lack of an easy removal tool."

http://www.zdnet.com.au/news/security/soa/Antivirus_firms_target_Sony_rootkit_/0,20000...9221702,00.htm

[painkiller]

Yup.

Uh-huh.

Bingo.

And we thought WE had problems.
Check here.
http://www.theregister.co.uk/2005/11/09/sony_drm_who_cares/

A portion of which says ...

A support manager at an IT department in a medium sized corporation told us that a CD-borne infection of Sony DRM is already causing his team headaches.

A major antivirus vendor diagnosed the problem as a nasty case of DRM, he told us, but the problem didn't end there. The Sony 'root kit' causes the antivirus software to go haywire, popping up alerts at the rate of one a second.

Three systems have so far been flattened, he said. The original culprit was a Van Zant CD - from Sony BMG.

And it gets worse.

[thecoalman]

The sharks smell blood, class action lawsuit filed in Calif (oddly it says on Nov. 1st )

http://today.reuters.com/news/newsarticle.aspx?type=technologyNews&storyid=2005-11-10T...IA-SONYBMG.xml

[MozartMan]

Another article:

Microsoft 'Concerned' by Sony DRM:

http://www.eweek.com/article2/0,1895,1884677,00.asp

[MozartMan]

New post on Mark's blog:

http://www.sysinternals.com/Blog/

Here is some text from that blog:

For those readers that are coming up to speed with the story, here’s a summary of important developments so far:

The DRM software Sony has been shipping on many CDs since April is cloaked with rootkit technology:

* Sony denies that the rootkit poses a security or reliability threat despite the obvious risks of both
* Sony claims that users don’t care about rootkits because they don’t know what a rootkit is
* The installation provides no way to safely uninstall the software
* Without obtaining consent from the user Sony’s player informs Sony every time it plays a “protected” CD

[junkmalle]

a Trojan which exploits Sony's DRM copy protection is in the wild

http://www.theinquirer.net/?article=27608

[GullyFoyle]

Two interesting links
http://www.eff.org/deeplinks/archives/004149.php

Sony-BMG Rootkit: EFF Collecting Stories, Considering Litigation
November 09, 2005

EFF is collecting stories from EFF members and supporters who have purchased Sony-BMG CDs that contained the "rootkit" copy protection software. We've previously posted at least a partial list of CDs infected here

We're considering whether the effect on the public, or on EFF members, is sufficiently serious to merit a lawsuit.

If you satisfy the following criteria, we would like to hear from you:

1. you have a Windows computer;
2. First 4 Internet's "xcp" copy protection has been installed on your computer from a Sony CD (for more details, see our blog post referenced above or SysInternals blog);
3. you reside in either California or New York;
4. you are willing to participate in litigation.

We have not made any final decisions about filing any legal action, but we would like to hear from music fans who have been harmed by the Sony-BMG "rootkit" copy protection technology. Please contact allison@eff.org.

http://www.eff.org/deeplinks/archives/004145.php

Now the Legalese Rootkit: Sony-BMG's EULA
November 09, 2005

If you thought XCP "rootkit" copy-protection on Sony-BMG CDs was bad, perhaps you'd better read the 3,000 word (!) end-user license agreement (aka "EULA") that comes with all these CDs.

First, a baseline. When you buy a regular CD, you own it. You do not "license" it. You own it outright. You're allowed to do anything with it you like, so long as you don't violate one of the exclusive rights reserved to the copyright owner. So you can play the CD at your next dinner party (copyright owners get no rights over private performances), you can loan it to a friend (thanks to the "first sale" doctrine), or make a copy for use on your iPod (thanks to "fair use"). Every use that falls outside the limited exclusive rights of the copyright owner belongs to you, the owner of the CD.

Now compare that baseline with the world according to the Sony-BMG EULA, which applies to any digital copies you make of the music on the CD:

1. If your house gets burgled, you have to delete all your music from your laptop when you get home. That's because the EULA says that your rights to any copies terminate as soon as you no longer possess the original CD.

2. You can't keep your music on any computers at work. The EULA only gives you the right to put copies on a "personal home computer system owned by you."

3. If you move out of the country, you have to delete all your music. The EULA specifically forbids "export" outside the country where you reside.

4. You must install any and all updates, or else lose the music on your computer. The EULA immediately terminates if you fail to install any update. No more holding out on those hobble-ware downgrades masquerading as updates.

5. Sony-BMG can install and use backdoors in the copy protection software or media player to "enforce their rights" against you, at any time, without notice. And Sony-BMG disclaims any liability if this "self help" crashes your computer, exposes you to security risks, or any other harm.

6. The EULA says Sony-BMG will never be liable to you for more than $5.00. That's right, no matter what happens, you can't even get back what you paid for the CD.

7. If you file for bankruptcy, you have to delete all the music on your computer. Seriously.

8. You have no right to transfer the music on your computer, even along with the original CD.

9. Forget about using the music as a soundtrack for your latest family photo slideshow, or mash-ups, or sampling. The EULA forbids changing, altering, or make derivative works from the music on your computer.


So this is what Sony-BMG thinks we should be allowed to do with the music on the CDs that we purchase from them? No word yet about whether Sony-BMG will be offering a "patch" for this legalese rootkit. I'm not holding my breath.

[Snakebyte1]

Here's my EULA to Sony:

1. Sony can have the right to kiss my a$$
2. Sony can have the right to watch me spend my money elsewhere


This whole thing is gonna get way worse before it gets better....

[MrMoody]

Moral of the story: Autorun should be disabled on all PCs. M$ should issue an operating system update that makes it ask before executing one byte of code from any removable media.

[thevoelk]

As Snakebyte said about it getting worse, an exploit is already out there:

http://www.cdfreaks.com/news/12666

F-Secure says it's not well written, but it was bound to happen.

[JSB1]

Moral of the story: Autorun should be disabled on all PCs.

Not exactly....

On two of my Windows XP Pro SP2 machines, I disabled autorun and then for months could not understand why my DVD drives would never detect the 2nd disc inserted -- they'd always see the directory of the first disc, even if it wasn't in there anymore! The solution as told to me in a different forum -- turn Autorun back on. Sure enough, that was the problem. Does anyone know why autorun is needed to ensure proper operation?

JSB

[MrMoody]

Using TweakUI for XP to turn it off instead of doing it in the hardware driver settings doesn't cause this problem.

[SCDVD]

And it gets worse........

http://www.msnbc.msn.com/id/9991596/

[MozartMan]

How To Spot Sony's Rootkit on CD:

partial list of the Cd's that contain the malware:

Trey Anastasio, Shine (Columbia)
Celine Dion, On ne Change Pas (Epic)
Neil Diamond, 12 Songs (Columbia)
Our Lady Peace, Healthy in Paranoid Times (Columbia)
Chris Botti, To Love Again (Columbia)
Van Zant, Get Right with the Man (Columbia)
Switchfoot, Nothing is Sound (Columbia)
The Coral, The Invisible Invasion (Columbia)
Acceptance, Phantoms (Columbia)
Susie Suh, Susie Suh (Epic)
Amerie, Touch (Columbia)
Life of Agony, Broken Valley (Epic)
Horace Silver Quintet, Silver's Blue (Epic Legacy)
Gerry Mulligan, Jeru (Columbia Legacy)
Dexter Gordon, Manhattan Symphonie (Columbia Legacy)
The Bad Plus, Suspicious Activity (Columbia)
The Dead 60s, The Dead 60s (Epic)
Dion, The Essential Dion (Columbia Legacy)
Natasha Bedingfield, Unwritten (Epic)
Ricky Martin, Life (Columbia) (labeled as XCP, but, oddly, our disc had no protection)

Several other Sony-BMG CDs are protected with a different opy-protection technology, sourced from SunnComm, including:

My Morning Jacket, Z
Santana, All That I Am
Sarah McLachlan, Bloom Remix Album

This is not a complete list. So how do you recognize other XCP-laden CDs in the wild?

Tip-off #1: on the front of the CD, at the left-most edge, in the transparent "spine", you'll see "CONTENT PROTECTED" along with the IFPI copy-protection logo. A few photos make this clearer.


http://www.eff.org/IP/DRM/Sony-BMG/

[SCDVD]

I hope this turns out to be a major miserable experience for Sony - And EXPENSIVE. It bit them in the ass and they deserve every bit of misery and expense that comes from it. This sort of thing can also be used as spyware so they can spy on you in any way they please. I wonder how much spy slime is being built or contemplated in hardware as well?

[Headbanger's Ball]

Wow, is First4 publically traded? Doubt they'll see many more contracts for their "service."

[SCDVD]

Sony has even made Microsoft mad. This crap is really invasive for Windows and it breaks the OS to remove it! It looks like Microsoft is looking at a Windows update to remove this slime without breaking the OS. As far as I am concerned Sony is guilty of a MAJOR crime which should cost them BIG TIME.

http://www.foxnews.com/story/0,2933,175192,00.html

[painkiller]

heh


(Did I say that out loud?)

[kirky99]

I believe this will remove it...

http://www.sophos.com/support/disinfection/rkprf.html

I didn't have the problem, sent it to a friend who did, now the same CD tells him he needs to install the player (again). So, I'm assuming it's a full uninstall. Thought I'd pass along the info.

Once gone, make sure you disable the autorun on your CD drives, and I'll also confirm that AnyDVD will block the DRM and allow normal use of your CD drive (and the offending CD).

[thecoalman]

Once gone, make sure you disable the autorun on your CD drives,

I'm not sure if I missed something here, perhaps I'm wrong but having autorun on your system just prevents you from listening to this CD unless you have already installed this POS. You have to click the OK button before anything is actually installed on your system.

On a side note I've had that disabled since day 1, for some discs it's just a pain in the ass.

[AlecWest]

The nightmare of Sony's rootkit software is over ... for now:

http://www.pcpro.co.uk/news/79775/sony-suspends-controversial-cd-production.html

[canadateck]

It hasnt begun. Another lawsuit out of NY.