Texas Sues Sony over rootkit

[lgh529]

Link is here.

Text follows:

AUSTIN, Texas - The state sued Sony BMG Music Entertainment on Monday under its new anti-spyware law, saying anti-piracy technology the company slipped into music CDs leaves huge security holes on consumers' computers.

The lawsuit is over the so-called XCP technology that Sony had added to more than 50 CDs to restrict to three the number of times a single disc could be copied.

After a storm of criticism, Sony recalled the discs last week.

To enforce the restrictions, the CD automatically installed the copy-protection program when discs were put into a PC — a necessary step for transferring music to iPods and other portable music players.

Attorney General Greg Abbott accused Sony BMG of surreptitiously installing "spyware" in the form of files that mask other files Sony installed as part of XCP.

This "cloaking" component can leave computers vulnerable to viruses and other security problems, said Abbot, echoing the findings of computer security researchers.

"Sony has engaged in a technological version of cloak-and-dagger deceit against consumers by hiding secret files on their computers," Abbott said in a statement.

The term "spyware" has been used broadly to cover programs that are installed without users' full knowledge and consent, whether or not they actually spy on a user's activities.

A Sony BMG spokesman didn't immediately return a call Monday morning.

Sony BMG initially rejected the uproar over XCP as technobabble.

But after security experts discovered that XCP opened gaping security holes in users' computers — as did the method Sony BMG offered for removing XCP — Sony BMG agreed last week to recall the discs.

Some 4.7 million had been made and 2.1 million sold. CDs that had XCP included releases by Van Zant, The Bad Plus, Neil Diamond and Celine Dion.

Abbott said some CDs remained in Texas stores as of Monday morning.

The Texas spyware law allows the state to recover damages of up to $100,000 in damages for each violation.

Abbott said there were thousands of violations, and that any money would go to the state.

[lenti_75]

good......fuckers

[SilverBlade]

Excellent. That would put Sony out of business for sure, top it off with some people boycotting Sony altogether (like me),

[TBoneit]

I myself would hate to see them go out of business. Sorry but I'm not a big Anti-Big Business type like some.

I have had good luck with Sony MIJ DVDs, two different Sony Changers a 5 Disc and a 400 Disc model. Had good luck with the DRU500a and 510A burners until I toasted one of them by putting TDK 8X only blank in one, I suspect it may have caused laser damage.

More Diversity /choice/competition in the market makes for better products.

If Sony hadn't come out with a -R & +R burner how much longer before others did?

BTW I can'tr recall when, if ever, I bought a Sony music Cd or movie on DVD. Most of the releases are crap these days.


Cheers

[ROF]

I'll bet this one gets settled for under a million dollars which will be used to upgrade the Texas governors office.

[Sabro]

Sony is by far, in my opinion, an excellent company with excellent products.

However, lately some of their decision makers have really goofed.. Investing tons in Arccos which failed after day 1, now the use of generic r00t kits to stealth their anti-piracy apps....

I fully understand them wanting to protect their investments, however, it seems to me this war is going alil overboard at times.

Revenue losses due to piracy have always made for great tax deductions, but I wonder with the release of these 'technologically advance' anti-copy routines if these companies will claim less losses at the end of their fiscal year...hmmmm

Sabro

[FulciLives]

I'd like to think this was done to "protect" consumers but ... what is the real truth?

Sounds like Texas wanted some money LOL

I guess the end result is what matters and that means SONY pulling the affected product(s).

- John "FulciLives" Coleman

[crazy14muzic]

Sony is by far, in my opinion, an excellent company with excellent products.

Just how many excellent products have they bought? aka SONIC FOUNDRY

I wasnt at all happy with that purchase but it seems that they have kept the products in tact for the most part

[MJPollard]

Sony is by far, in my opinion, an excellent company with excellent products.

Just how many excellent products have they bought? aka SONIC FOUNDRY

I wasnt at all happy with that purchase but it seems that they have kept the products in tact for the most part

It helps that it's the former Sonic Foundry programming team keeping up those apps, not Sony's. If it weren't, Vegas, Sound Forge, DVD Architect, ACID, and the rest of their products would've gone straight to shit, and I would've been looking elsewhere for my video editing and DVD authoring needs.

[whitejremiah]

I have had good luck with Sony MIJ DVDs, two different Sony Changers a 5 Disc and a 400 Disc model. Had good luck with the DRU500a and 510A burners until I toasted one of them by putting TDK 8X only blank in one, I suspect it may have caused laser damage.

How much is $ony paying you? nearly everything ive ever bought from sony breaks within a matter of a year, and no its not because im "abusing" the items....heck, did you read the statement that they put out about the earlier versions of the ps2 breaking on people? it was something to the effect of "dont play it that much" As far as the TDK blanks, ive used them in MANY differant burners and ran across exactly ZERO problems with them. EVER. I've wisened up and stopped buying sony afer a few car stereos (stopped reading discs within a year to a year and a half) a set of subwoofers (died within six months) a portable cd player (died within like eight months) I prey and hope that $ony gets hit hard for this one, because they definately deserve it........some of the stuff they have been doing lately is if nothing else, questionable...most likely illegal. I dunno if you heard about it too, but $ony outright and stole code from Lame and didn't credit it at all. As far as rootkits, honestly............this is just my opionion and take it for what its worth...if you got one, thats completely your fault...i turned autorun off on my drives just on the basis that on roughly 1/2 my dvd's that i tried to play in my pc as of a few years ago, they asked me if i wanted to install interactual dvd player...i got sick of it and turned the autorun off just to avoid that...and man am i ever glad i did now. Quite honestly if i owned one of those cd's and ran it in my computer, they would be SO sued.

[lordsmurf]

- Sony makes good DVD media. Decent VHS media. No way around that.
- Sony invented certain display technologies that many companies license and use to make tv sets and monitors. And it works well. No way around that.
- Sony has made a number of good video and audio products too. No way around that.
- Sony makes a piece of crap DVD burner. The DVD-ROM drives are okay. The DVD recorders are overpriced and the first model was a glorified paper weight. No way around those either.
- Sony has made a lot of stupid products because they did not want to license other people's tech: memory sticks, optical drives, minidisc, etc. No way around those duds.

The problem is Sony makes a LOT of stuff. They also buy and re-brand a LOT of stuff. And I"m sure a lot of it is indeed crap. But some of it works quite well. All this talk of "I hope they go out of business" is silly. But a good bitchslap for getting out of line in regards to the rootkit thing ... that is well deserved.

If a settlement happens, I'm sure it would be used to bail out (or try to bail out) the fund-lacking education system in the state, assuming anything is left from the legal team. I still remember the tobacco lawsuits. Sure, this is probably a money-grab, but so what? That's what legal action is for sometimes.

Keeping companies in line is one thing that should happen more often. Definitely in cases like this, where the acts are reckless and uncaring about the public well-being (their computer health, in this case).

[ofbarea]

Sony minidisc is an excellent portable recording solution. The midiscs magneto optical media it more durable than any CD, DVD or a tape drive. One drawbacks to MD is the fact that it is not possible to make a perfect digital copy of it, as there is generational lost due decompress/recompress process. Also it is true that the original version of the ATRAC compression was awful, but after ATRAC 1 rev. 4.5 and later the format is competitive with other options for recording. Even today minidisc is a solid option for such small recording device. I do not like too much the ATRAC 3 format. I have not used the ATRAC 3+ format yet.

On more recent NetMD and Hi-MD models the biggest drawback is its software. The Sonicstage application and its DMR way of handling music files is the worst part of the equation.

The hardware is fine and durable. With this format I’ve been able to record live performances (after getting the band approval) and the end result is fantastic. My girl friend is a journalist and she really likes the small size of the recording device and media and the resulting clarity of the recordings (provided that you have good microphone).

With the new Hi-MD units you could record in PCM format from analog sources and you can actually transfer the recording the a wav file in the PC using USB interface. Because of this restriction you cannot use external ADC converters to improve on the recording quality.

Minidisc would be a good format, even with the ATRAC compression schema, if it was not handicapped by the restrictive Sonicstage DMR process.

[davideck]

I have been partial to SONY products over the years and I have bought a lot of their stuff.
Most of it has failed over time, but I feel that I got my money's worth.

I find this whole DRM situation beyond belief.
How could SONY be so stupid!
Heads must really be rolling...

[hiptune]

[/quote]It helps that it's the former Sonic Foundry programming team keeping up those apps, not Sony's. If it weren't, Vegas, Sound Forge, DVD Architect, ACID, and the rest of their products would've gone straight to shit, and I would've been looking elsewhere for my video editing and DVD authoring needs.[/quote]

But they did right by Sonic Foundry, and the development of Vegas and DVD-A. Regardless of why, these products are good and priced resonable. I think it has nothing to do with a former team doing something fun to them, and helpful to others. It is Sony's new product that people like. I like Vegas and DVD-A, and my 3 Sony DVD players lived up to their life expectancy more or less.

[TBoneit]

whitejremiah, That is a terrible thing to ask/imply!

Sony doesn't pay me anything. I didn't even mention the Sony 17" monitor I'm usin g here at work it is frfom April 1998, still working, still sharp & bright despite being dropped by someone in the past hard enough to crack the base.

Did they do wrong. Yes but for some to be so virulent about their hatred makes me wonder why they are that way. Something bothers me, I make a mental note never to do business again and move on with my life.

While you are on bad companies why no mention Mitsubishi? They hid problems with their cars from the Feds to avoid recalls. Problems with their cars can kill, Sony products don't generally kill, Or Dell and several other brands where the power adaptors could shock or worse?

[ROF]

whitejremiah, That is a terrible thing to ask/imply!

Sony doesn't pay me anything. I didn't even mention the Sony 17" monitor I'm usin g here at work it is frfom April 1998, still working, still sharp & bright despite being dropped by someone in the past hard enough to crack the base.

Did they do wrong. Yes but for some to be so virulent about their hatred makes me wonder why they are that way. Something bothers me, I make a mental note never to do business again and move on with my life.

Don't take things personal. People have implied that I work for or I'm paid by the RIAA. Someone even went so far as to start an entire thread about such silliness. When someone has no defense or their defense is for illegal situations they themselves are involved in the usual result in forums is name calling or implying falsehoods to those who oppose them. Just take it at face value.

Sony made a mistake by trusting another companies word that the other companies software would not cause undue harm to the end user. Am I the only one who finds it odd that Sony is being sued by Texas while First 4 Internet who actually caused undue harm is not? That right there should tell you this lawsuit is only about lining the states pockets. It has nothing to do with defending the end consumer or punishment. If it were Texas would sue First 4 Internet to the point where bankruptcy would be the only kind word in their investors quarterly statements.

Something must be done and I'm glad Sony and a few others are at least trying to stem the flow of illegal activity. What they did in my opinion isn't illegal but instead was just a bad business decision made without thoroughly reviewing the consequences. Cars and toys are released every year and some of them have defects that kill. I'd say a rootkit pales in comparison, but Texas obviously feels life isn't something worth protecting since there's no money in it.

[mbellot]

Sony made a mistake by trusting another companies word that the other companies software would not cause undue harm to the end user. Am I the only one who finds it odd that Sony is being sued by Texas while First 4 Internet who actually caused undue harm is not?

But Sony is the one who distributed the virus (for profit no less) to the general public.

I'm also fairly certain that the reason F4I is not being sued is because Sony contractually accepted all liability for distributing the software on CDs they produce. Pretty standard practice, as a small engineering design firm we do it all the time. Our customers accept all liability for the product once we have satisfied their requirements and they start to produce it.

What they did in my opinion isn't illegal but instead was just a bad business decision made without thoroughly reviewing the consequences.

Ahh but your opinion doesn't matter, as you so often like to tell others when it comes to fair use.

In my opinoin I can do whatever I please with the music I purchase (nothing in the last decade or two) for my own personal gratification, as long as I don't give away or sell copies of it to others. I'm sure your opinion differs.

The simple fact is that if they broke the law in Texas (and in several other states and countries around the world) then they need to be held accountable for their actions.

[thecoalman]

You're off your rocker.....

Sony made a mistake by trusting another companies word that the other companies software would not cause undue harm to the end user. Am I the only one who finds it odd that Sony is being sued by Texas while First 4 Internet who actually caused undue harm is not?

Sony distributed it, Sony is responsible. Period. I'm sure they had a set of specs for this piece of crap that many consumers unwittingly installed. If the software first 4 internet provided didn't meet them that's irrelevant. It's still Sony's responsibility. If they were not aware of what it was then they are bigger bumbling idiots than this debacle has shown.

What they did in my opinion isn't illegal but instead was just a bad business decision made without thoroughly reviewing the consequences.

The last time I checked installing spyware or viruses on someones computer on purpose is illegal.

Cars and toys are released every year and some of them have defects that kill.

This wasn't a defect, it does what is was designed to do.

[ROF]

But Sony is the one who distributed the virus (for profit no less) to the general public.

What virus did they distribute? I thought they installed a root kit? Some root kits are installed by system administrators for network purposes. Your PC at work may have them installed. I doubt the company you work for labels them as a virus.

[ROF]

The last time I checked installing spyware or viruses on someones computer on purpose is illegal.

really? I guess most P2P networks which install spyware and adware are operating illegally and should be shut down today. Although I agree with that statement, to date this hasn't happened and I doubt very much that it ever will.

[thevoelk]

Also, even though First4Internet wrote the rootkit, they may not have a US presence, which may make it impossible, at least more difficult than Sony, for Texas to sue them, Adam would probably be able to clarify.

It probably falls along the same lines as gun manufacturers. Smith & Wesson makes a handgun to be used responsibly, it's not S&W's fault someone used it in an illegal manner. Or in the sense of a car, just because someone was killed by a drunk driver driving a Ford, that doesn't make Ford responsible.

Also, your argument about a Network Admin installing a rootkit is irrelevant. It's the company's computer that the network admin is installing it on, they have the permission, by the company, to maintain the network, usually by whatever means they need to.

[ROF]

First 4 Internet is a UK development house and as far as I know they do not maintain a presence in the US. All Sony rootkit CDs were labeled that they were using a new type of software to protect against theft. They did warn their users so I fail to see what the problem is in that respect. The rootkit as used by Sony does not cause any harm but it's potential to be abused by others is what has caused the uproar. So the arguement about guns not killing people and gun manufacturers not being held responsible for such deaths is just as valid as Sony not being held responsible for what others might do with the rootkit technology installed. Network administrators have a responsibility to maintain their network. Sony has a responsibility to their artists to protect against theft. This rootkit was improperly implemented in that it didn't take into account what unscrupulous individuals might do in contrast to the rootkit. I just hope Sony learns from this and next time provides an even stronger protection that doesn't open themselves up to all this undue flak.

[BobK]

When someone has no defense or their defense is for illegal situations they themselves are involved in the usual result in forums is name calling or implying falsehoods to those who oppose them.

Something well demonstrated by many of your posts trying to defend Sony's illegal actions. In that statement you imply that everyone who disagrees with you is involved in illegal activity themself. A very good example of implying falsehoods to those who oppose you.

Something must be done and I'm glad Sony and a few others are at least trying to stem the flow of illegal activity. What they did in my opinion isn't illegal

Your opinion is as meaningless as someone else having the opinion that copying CDs isn't illegal. Opinions don't make law unless you're a judge.

Cars and toys are released every year and some of them have defects that kill. I'd say a rootkit pales in comparison, but Texas obviously feels life isn't something worth protecting since there's no money in it.

Murders and rapes are committed every day and some of them are fatal. I'd say that parking violations, minor traffic infractions and jaywalking pale in comparison, but every police department in the world obviously feels that murder and rapes are not worth stopping.... see how stupid that attempted analogy and false assumption of yours really is? Probably not.

[thevoelk]

What Sony should have done is implement a RAM-based copy-protection. The player should have been installed to RAM, and removed when the workstation rebooted. That way, nothing is left behind, but it is preventing, to some extent at least, copying.

CSS was probably a perfect idea. It blocked the average, and for a while the above average, computer user from freely copying DVDs. It did not break my computer, or potentially remove access to the drive, when played and removed. It was a standard protection, ensuring interoperability between players. The RIAA/MPAA have admitted they're not as worried about the casual copier than they are about the dedicated groups that mass pirate. Yet they do next to nothing about these groups and go after the casual copier. Treating (or punishing) your entire income source as criminals is not a good way of running a business.

Here's the problem as I see it, and probably many others, in regards to CD and DVDs. When I buy a TV at BestBuy, I'm not "paying for a license to use (view in this case) it", it's mine. I can do with it as I want, nobody can sue me for improper use of it (except for some asinine move like throwing it from the top of a skyscraper). When I buy a car, it's mine. The manufacturer/dealership does not install anything that prevents me from using aftermarket parts or going somewhere else for service. Remington does not force me to use their shells for their model shotgun I own, nor does Marlin force me to use a certain brand bullet for their model rifles I own, or for the sidearms I own (save for the work issue I possess due to contracts), which are MINE.

I'm pretty sure it was in another post about this Sony mess someone mentioned that a CD-ROM drive doesn't count as an audio CD player in regards to applying as a appropriate listening device. I'm sure when you buy a copy of Windows, part of the cost goes to Philips in licensing for WMPs ability to play an audio CD. Which means it does count as an appropriate device (as a player only). I asked my MS rep at work why a DVD Decoder isn't included with Windows, his response was that the cost of licensing the decoder (I think it's something like $38 ) would be passed to the consumer, making Windows even more expensive than it already is, among other reasons.

I think most people, including myself, feel that when I buy a CD, it's mine. Which I think brings up an interesting question: I realize I don't own the music contained on a CD, but do I own the medium it's contained on? (I don't own any of the affected Sony CDs, although I was considering getting the Trey Anastasio CD until this fiasco). Sony owns the Van Zant copyright, but they in no way own my hard drive where the music may be ripped to. They have no right, and I'm pretty sure there's a law or two regarding this, to break my $1000+ computer to protect their $12 CD. I have no problem with trying to prevent people from sharing the content online, but they crossed the line this time. And I'm willing to bet a court will find they crossed well over the line.

Here's a funny side note. At work, standard policy is to format any unclassified workstation that gets a virus, and to replace the hard drive and incinerate the original for any classified workstation. This rootkit has been considered a virus by my employer. Since this came out, I've had over 100 hours of overtime rebuilding machines. I hope Sony gets the bill, both for the overtime and the hardware.

[sammie]

The funny part is look at the list, granted there are some current disks, Our Lady Peace, Switchfoot and Dead 60's but look at many of the others. The one that particularly caught my eye was:

Flatt & Scruggs
Foggy Mountain Jamboree
CK92801
827969280126

I mean YeeHaa! The Ballad of Jed Clampett. I'm not denegrating the music, but is theft of Lester Flatt and Earl Scrugs, Ray Charles, Frank Sinatra, George Jones, Burt Bacharach, Pete Seger, Louis Armstrong and Neil Diamond albums a real problem? I mean heck I'd be ecstatic to run out and buy a good Pete Seger re-master, the only issue is what store would carry it because I assume I'm one of the few here old enough to know who he is (or Lester Flatt and Earl Scrugs 8) ). These are all artists who could and should be available at a reasonable price through download sites, because retail outlets won't have the volume to ever stock them. They are the type artists that could develop a new generation of fans IF THEIR MUSIC was more available. I guess the point being they are likely to get their pee pees slapped over not much. (sorry for the pee pee bit, but I had to date myself one more time).

[Noahtuck]

The last time I checked installing spyware or viruses on someones computer on purpose is illegal.

really? I guess most P2P networks which install spyware and adware are operating illegally and should be shut down today. Although I agree with that statement, to date this hasn't happened and I doubt very much that it ever will.

Yeah, really!!

AUSTIN, Texas - Sony BMG Music Entertainment's troubles over anti-piracy technology on music CDs deepened Monday as Texas' attorney general and a California-based digital rights group said they were suing the music company under new state anti-spyware laws

And from that statement it seem's it is illegal in texas, and i know they have passed such laws in michigan also making it illegal to install spyware.
I don't remember the exact details but i was watching it on the local news quite some time back, and they were also going after some copmany or software company that had it in their products, although it was way before this "sony rootkit" problem.
And i think it has to do more with how intrusive the soft/spy ware is, or what kind of info it collects.

[Doramius]

THere are some guidelines for this Texas law. The main problem is that the Sony spyware opened up a persons computer so ANYONE could practically hack it. What's the use of having a firewall when you play a Sony CD that shuts it off or allows it to be bypassed. You basically spent $100+ on firewall, antivirus, & anti-popup/spyware software for nothing. Imagine you bring your Sony CD to work and listen to it on your PC. You just infected your entire company.

[mbellot]

The last time I checked installing spyware or viruses on someones computer on purpose is illegal.

really? I guess most P2P networks which install spyware and adware are operating illegally and should be shut down today.

I think the difference would be that the P2P clients inform you of the fact that they will be installing spyware type software in the EULA.

Sony did no such thing.

And as for your statement:

The rootkit as used by Sony does not cause any harm

Any software that can't be removed without causing serious system stability issues does indeed cause harm.

This rootkit was improperly implemented in that it didn't take into account what unscrupulous individuals might do in contrast to the rootkit. I just hope Sony learns from this and next time provides an even stronger protection that doesn't open themselves up to all this undue flak.

You mean the unscrupulous individuals besides Sony, right? I'm sure the unscrupulous b@st@rds at Sony knew exactly what they were trying to get away with, they just failed miserably because they went too far.

And as I've said before, there can be NO PROTECTION STRONG ENOUGH to prevent a PC from accessing the disk if it is to remain compatible with normal CD players.

As it is Sony took a big chance by adding a second session to the CD, many older CD players barf when they encounter a multi-session CD.

So take heart, fair use will continue unabated until CDs go the way of the 8-track.