Slashdot Mirror

I had sent a friend information about this Sony thing last week and it got not a lot of attention. However same friend was trying to de-lous another persons PC yesterday and called me for support (Note: I'm not particularly qualified for Windows support at this point, but I can do Google searches and say things like "hang in there" from time to time). I think by that time I was called many of the virus and spyware elements had been cleaned by conventional means, but there seemed to be some persistent problems. Just in case, I asked whether they had played any of those Sony BMG music discs in the machine. Apparently I was on a speakerphone setup, and I heard several denials of the form "We never use our machine for such things" while my friend asked me what I was talking about.

After refreshing his memory, and in turn having the family involved talk among themselves for a while, it turned out that some Sony BMG discs HAD been played in that machine, and some of the remaining questionable files had Sony all over them even though the family didn't own a Sony camera, Sony music player or any other Sony device that they could think of. Finally someone remembered that the little girl in the family HAD played, or ripped, or SOMETHING some music CDs in the machine and off they rushed to find them. In the mean time I was looking for the list of Sony BMG discs affected, originally numbered 20 and widely circulated at that count, but subsequently updated to 50, and listed on a Sony website. I found the list of 50 at about the same time that they found their played/ripped/inserted/whatever CDs and sure enough, several of them had the Sony BMG label on them. Now the catch was that (a) none of the CDs they had found were on the list and (b) none of the CDs they had found had the warning that they contained copyright protection software, and my understanding was that the affected discs did contain such a warning.

Well, by getting rid of the Sony BMG stuff they seemed to be back to a clean machine, and they swore to never insert a music CD into their machine again or to buy a CD from Sony. So, congratulations should go out to Sony BMG and First4Internet for accomplishing their objectives. Now to round out the picture:

(1) I suspect that Sony BMG, Sony alone, and BMG alone have in the past used other protection schemes and while they haven't been vocal about it, other companies are doing the same experimentation. All of these programs have their own ways and means of hiding themselves and controlling what YOU do with YOUR PC. But NONE of them have exhaustively looked into the legal, much less technical ramifications of what they do. They think that by merely relying on third party companies like First4Internet they can claim ignorance of the consequences.

(2) Rumor has it that by the time you are asked for your permission to install software when you insert these disks SOME software has already been installed.

(3) Sony/BMG isn't the only company doing this, they are just the only company that has been caught.

(4) These discs have been out for a year, and some people say two years, or maybe more.

(5) There is no quick and easy way to uninstall these programs, either from Sony BMG or the s

Arista Records, BMG Classics, BMG Heritage, BMG International Companies, J Records, Jive Records, LaFace Records, Provident Music Group, RCA Records, RCA Victor Group, RLG - Nashville, Sony Urban Music, So So Def Records, and Verity Records (courtesy of http://sonybmg.com/).

I'm shocked that no one has mentioned SOCOM 3's credit card farming^Wverification system yet, which has gotten thousands of CC numbers from SOCrack addicts* who consider their clan/friends list system the only real way to play.

Sure, it's Zipper Interactive doing it, but (like the XCP discs) Sony publishes and "presents" the damn product. I think the fact Zipper enticed people to give them a CC and address made Sony's heads swell and set them towards the XCP route. They thought they could do anything, and they still hope to (see Top Questions, #10).

*me included

He's probably one of the unfortunate people who had bought one of these CDs. *shudders*

On the Sony site, they are talking about a secure updater which removes the rootkit:

If you obtain regular security updates from a major anti-virus service, you should receive an update through that process. You may also download the update yourself from http://cp.sonybmg.com/xcp/english/updates.html.

The update its talking about simply removes the rootkit, but does not remove the copy protection portion.

Therefore, I believe these disks will still be executable in format (besides, any with images/videos on will need the media player software as well...)

Just read the home page on the sony site, they still don't get it:

Going forward, we will continue to identify new ways to meet demands for flexibility in how you and other consumers listen to music.

We just want true cds without any bullshit, plain and simple.

If the XCP Update contains copyright infringement, then ISPs providing connections to the copyright material are obligated to honored any DMCA notice.

"but they haven't done any of the things a reputable company should be doing: Offering complete replacement discs (without foistware), coupons/credit for further Sony products ("Don't boycott our brand, please"), and promise not to abuse their actual customers again."

Actually, it appears that they *do* plan to offer replacement discs. I tried to post this to the main page (a fairly significant development, IMHO), but alas it was rejected. In other news, Mark Russinovich is declaring victory as a result.

I'm not saying that makes everything okay... I'm just saying that they're not being *total* jerks about this (just *partial* jerks). I expect we'll see more of a response out of Sony once that large bureaucratic ball eventually does get rolling. In an organization the size of Sony, I'd bet it has quite a lot of intertia.

And no, I won't be buying any more Sony CDs... or probably anything else - just on principle.

Yeah and I'm saying this won't work.

Who invests in Sony? Are they responsible?

Who else do they invest in? Are you going to stop using those companies products?

It's quite easy to pin this on the CEO of Sony Music right here. Blame him for the stupidity.

Why penalize the thousands of other employees of the different companies under the Sony banner who are in no way shape or form in charge or able to influence what a DIFFERENT COMPANY does.

You think that some middle-level manager at Sony Electronics or SCEA can tell Sony BMG "don't use f4i!!!" ??? Really you think that?

Tom

Tom

Sony issued an 'apology' yesterday: http://cp.sonybmg.com/xcp/

The rootkit doesn't phone home to there. From doxpara: Originally, it appeared that the rootkit itself issued queries against First4Internet. It does not.

So we're looking at hits to http://cp.sonybmg.com/xcp/english/updates.html, are we? Well, let's see what Google knows. That site is linked to by only one page: http://cp.sonybmg.com/xcp/english/updates.html - part of the Sony information site about this system, the site which has been referred to by every story, blog, and Slashdot post on this subject throughout the whole saga.

What we're seeing here isn't evidence of how widespread the rootkit is. It's how widespread the story is.

The rootkit doesn't phone home to there. From doxpara: Originally, it appeared that the rootkit itself issued queries against First4Internet. It does not.

So we're looking at hits to http://cp.sonybmg.com/xcp/english/updates.html, are we? Well, let's see what Google knows. That site is linked to by only one page: http://cp.sonybmg.com/xcp/english/updates.html - part of the Sony information site about this system, the site which has been referred to by every story, blog, and Slashdot post on this subject throughout the whole saga.

What we're seeing here isn't evidence of how widespread the rootkit is. It's how widespread the story is.

http://cp.sonybmg.com/xcp/english/form11.html

Sony's official list. 52 records.

Get it here.

They haven't even apologized yet.

Well, they sort of apologized. Rather half-assed, IMO.

Sony BMG and EMI have begun shipping compact discs using technology that limits the number of copies you can make of any disc to three. And you can't port songs from affected CDs to Apple IPod players unless you request a workaround from Sony.

3. How can I get tracks I rip from my CD into iTunes and/or onto my iPod? Apple's proprietary technology doesn't support secure music formats other than their own and therefore the music on this disc can't be directly imported into iTunes or iPods. Sony BMG wants music to be easily transferable to any device that supports secure music. Currently, music from our protected CDs may be transferred to hundreds of such devices, as both Microsoft and Sony have assisted to make the user experience on our discs as seamless as possible with their secure formats. Unfortunately, in order to directly and smoothly rip content into iTunes it requires the assistance of Apple. To date, Apple has not been willing to cooperate with our protection vendors to make ripping to iTunes and to the iPod a simple experience. If you believe that you should be able to easily move tracks from your protected CD to your iPod then we encourage you to use the following link to contact Apple directly and tell them so. http://www.apple.com/feedback/ipod.html That said, while there is no direct support on the disc for iTunes or iPod, SONY BMG has worked out an indirect way for consumers to move content into these environments, despite the challenges noted above. If you'd like more information on how to move content to iTunes please [CLICK HERE].

I called, it was just an answering service. they said to go to the web site: http://cp.sonybmg.com/xcp/ (don't bother, there isn't any information there). I asked if they would repair my computer. she said i could try sony repairs at 800 222 7669.

The Sony/XCP uninstall process requires you to fill out a web form that uses an ActiveX control. That control has several serious security issues including the ability to run arbitrary code and even a handy built-in reboot function. The ActiveX control gropes around your system and encrypts some information that is submitted in a hidden form field. Their privacy policy does not mention this.

Feel free to go over there and try it yourself. If you install the ActiveX you can remove it in Tools, Internet Options, Settings, View Objects, "CodeSupport Control". Here's what they send you:

From: contentprotectionhelp
Sent: Monday, November 14, 2005 04:22 AM
To: sony-bmg-sucks@invalid.com
Subject: Re: ContentProtectionHelp Email Form

Thank you for contacting Sony BMG Online.

Sony BMG and First 4 Internet have released a Service Pack 2a update that addresses recent concerns surrounding the cloaking technology component on SONY BMG content protected CDs which use XCP technology. These components are not malicious nor spyware however to alleviate any concerns that users may have about the program posing potential security vulnerabilities the update removes the cloaking component from their computers. Please visit the link below to install the SP2a update.

      http://updates.xcp-aurora.com/

If you do not want to install the SP2a update and only wish to uninstall the DRM software, visit the form below using IE 5.0 (or higher) from the computer where the software is installed. After submission, you will be emailed a customized uninstall link within 1 business day (M-F).

      http://cp.sonybmg.com/xcp/english/form9.html
      Your "Case ID" is: 9999999.

TIP: The uninstall request form will require an ActiveX plug-in.
                Also you may need to temporarily turn off any pop-up blocker
                software on the PC.

Thank you for the opportunity to be of assistance.

The Sony BMG Online Support Team
FKSZ

This message and any attachments are solely for the use of intended recipients. They may contain privileged and/or confidential information. If you are not the intended recipient, you are hereby notified that you received this email in error, and that any review, dissemination, distribution or copying of this email and any attachment is strictly prohibited. If you receive this email in error please contact the sender and delete the message and any attachments associated therewith from your computer. Your cooperation in this matter is appreciated.

- - - - -

Go to http://cp.sonybmg.com/xcp/ or http://cp.sonybmg.com/xcp/english/form14.html

Where it asks for the Artists name type in some diatribe

Where it asks for the Album Title, type in more diatribe

Where it asks for Store Name, type in yet even more diatribe

Where it asks for email address try something that will cause them trouble such as uce@ftc.gov or some chronic antispammer advocate.

This will hopefully force Sony to make the "patch directly downloadable." ...since Sony says over 2 million disks containing the rootkit have been sold, that puts them under the gun for roughly U.S. $150 billion in damages :)

Perhaps the copyright owners could offer to settle: have Sony repay all of the people who have been extorted for money because of filesharing (double for damages), and promise to stop all such activities in the future. That would only run them about $100 million, so it would be quite a deal.

Go to http://cp.sonybmg.com/xcp/ or http://cp.sonybmg.com/xcp/english/form14.html

Where it asks for the Artists name type in some diatribe

Where it asks for the Album Title, type in more diatribe

Where it asks for Store Name, type in yet even more diatribe

Where it asks for email address try something that will cause them trouble such as uce@ftc.gov or some chronic antispammer advocate.

This will hopefully force Sony to make the "patch directly downloadable." ...since Sony says over 2 million disks containing the rootkit have been sold, that puts them under the gun for roughly U.S. $150 billion in damages :)

Perhaps the copyright owners could offer to settle: have Sony repay all of the people who have been extorted for money because of filesharing (double for damages), and promise to stop all such activities in the future. That would only run them about $100 million, so it would be quite a deal.

Show Sony what it can do about forcing victims to give out their email addresses

Go to http://cp.sonybmg.com/xcp/ or http://cp.sonybmg.com/xcp/english/form14.html

Where it asks for the Artists name type in some diatribe

Where it asks for the Album Title, type in more diatribe

Where it asks for Store Name, type in yet even more diatribe

Where it asks for email address try something that will cause them trouble such as uce@ftc.gov or some chronic antispammer advocate.

This will hopefully force Sony to make the "patch directly downloadable."

Show Sony what it can do about forcing victims to give out their email addresses

Go to http://cp.sonybmg.com/xcp/ or http://cp.sonybmg.com/xcp/english/form14.html

Where it asks for the Artists name type in some diatribe

Where it asks for the Album Title, type in more diatribe

Where it asks for Store Name, type in yet even more diatribe

Where it asks for email address try something that will cause them trouble such as uce@ftc.gov or some chronic antispammer advocate.

This will hopefully force Sony to make the "patch directly downloadable."

http://cp.sonybmg.com/xcp/english/form14.html

• Arista Records
• BMG Classics
• BMG Heritage
• BMG International Companies
• Columbia Records
• Epic Records
• J Records
• Jive Records
• LaFace Records
• Legacy Recordings
• Provident Music Group
• RCA Records
• RCA Victor Group
• RLG - Nashville
• Sony Classical
• Sony Music International
• Sony Music Nashville
• Sony Wonder
• Sony Urban Music
• So So Def Records
• Verity Records

http://www.sonybmg.com/labels.html

"We also intend to re-examine all aspects of our content protection initiative to be sure that it continues to meet our goals of security and ease of consumer use," Sony BMG added.
I really can't believe this clown is saying that. Did they ever have a security goal in mind??? Does this statement mean that they continue to do business as usual???

I went back to their FAQs, and found a few interesting lines:

- You must log on to your computer with Administrator rights or Power User rights to fully use the disc.
So I must be an admin just to listen to Ricky Martin??? Gimme a break.

- To date, Apple has not been willing to cooperate with our protection vendors to make ripping to iTunes and to the iPod a simple experience.
And hopefully it'll stay that way for a long, long, long time...

- the protection components are never installed without the consumer first accepting the End User License Agreement.
But nowhere in the EULA it is mentioned what the user is in fact installing.

- If at some point you wish to remove the software from your machine simply contact customer service through this link. You will, though, be unable to use the disc on your computer once you uninstall the components.
Now this is another issue. Sony is marketing their discs as CDs, but their are not campatible with standard CD players??? They can't slap the CD logo anywhere they want and get away with it. They have to follow the standards, or call their DRM discs something else and anounce in big bold letters that such disc may not be playable in all devices.

Will sony give removal instructions? Their downloadable "patch" only updates their rootkit, but doesn't uninstall it.

yes, they will. but you have to ask and wait on customer service to get the uninstall program, and once you've run it your computer can no longer play the CD (without reinstalling the rootkit).

If you desire to grovel at the feet of Sony, and beg for permission to uninstall some software from your own PC, we new have a link:

http://cp.sonybmg.com/xcp/english/form14.html

Use this information in any mannor you see fit...

"Nonetheless, the spokesmen of Sony BMG Nederland says that Xcp will be introduced in Europe, and therefore also in the Netherlands, in 2006."

The article further contains no less then 17 dubious features of the Sony software, basically the same ones as circulated the news lately. However, number 15 is interesting. Blankesteijn claims he received spam after entering his e-mail adres in the request form for the Xcp removal software:

"15. Not only is this [filling in a form] in-necessary complicated and time consuming, Beet (the magazine) immediately received spam from Sony BMG containing an advertisement for their multimedia software. It turns out somewhere along the road you could have clicked on a link to Sony MBG's privacy policy. There it says your mail address can be added to marketing lists. But is very well possible that the user will not notice this link. In any way, nowhere is asked for permission to do this, which will make this way of handling illegal in many countries."

We are aware that a computer virus is circulating that may affect computers with XCP content protection software. The XCP software is included on a limited number of SONY BMG content protected titles. This potential problem has no effect on the use of these discs in conventional, non-computer-based, CD and DVD players.

In response to these events, SONY BMG has swiftly provided a patch to all major anti-virus companies and to the general public that guards against precisely the type of virus now said to exist. The patch fixes the possible software problem, and still allows CDs to be played on personal computers. It can be downloaded at http://cp.sonybmg.com/xcp/. Starting today, we will also be adding this link to the SONY BMG label and corporate sites. We deeply regret any possible inconvenience this may cause.

We stand by content protection technology as an important tool to protect our intellectual property rights and those of our artists. Nonetheless, as a precautionary measure, SONY BMG is temporarily suspending the manufacture of CDs containing XCP technology. We also intend to re-examine all aspects of our content protection initiative to be sure that it continues to meet our goals of security and ease of consumer use. More information about our content protection initiative can also be found at: http://cp.sonybmg.com/xcp.

We are aware that a computer virus is circulating that may affect computers with XCP content protection software. The XCP software is included on a limited number of SONY BMG content protected titles. This potential problem has no effect on the use of these discs in conventional, non-computer-based, CD and DVD players.

In response to these events, SONY BMG has swiftly provided a patch to all major anti-virus companies and to the general public that guards against precisely the type of virus now said to exist. The patch fixes the possible software problem, and still allows CDs to be played on personal computers. It can be downloaded at http://cp.sonybmg.com/xcp/. Starting today, we will also be adding this link to the SONY BMG label and corporate sites. We deeply regret any possible inconvenience this may cause.

We stand by content protection technology as an important tool to protect our intellectual property rights and those of our artists. Nonetheless, as a precautionary measure, SONY BMG is temporarily suspending the manufacture of CDs containing XCP technology. We also intend to re-examine all aspects of our content protection initiative to be sure that it continues to meet our goals of security and ease of consumer use. More information about our content protection initiative can also be found at: http://cp.sonybmg.com/xcp.

If you desire to grovel at the feet of Sony, and beg for permission to uninstall some software from your own PC, we new have a link:

http://cp.sonybmg.com/xcp/english/form14.html

Use this information in any mannor you see fit...

IANASE (I Am Not A Sony Employee), but I think Sony has many divisions, their videogames (PS2) division, their hardware (CD players, radio, etc - ever heard of Xplod?) division, and of course, their evil music division.

These have very different goals and their methods may vary. And this is interesting - Sony Xplod plays MP3 CD's, how can you explain that, if Sony is a member of the EVIL anti-mp3 anti-sharing RIAA?

Anyway if you want some heads to roll, blame these guys for the rootkit.

"Nonetheless, the spokesmen of Sony BMG Nederland says that Xcp will be introduced in Europe, and therefore also in the Netherlands, in 2006."

The article further contains no less then 17 dubious features of the Sony software, basically the same ones as circulated the news lately. However, number 15 is interesting. Blankesteijn claims he received spam after entering his e-mail adres in the request form for the Xcp removal software:

"15. Not only is this [filling in a form] in-necessary complicated and time consuming, Beet (the magazine) immediately received spam from Sony BMG containing an advertisement for their multimedia software. It turns out somewhere along the road you could have clicked on a link to Sony MBG's privacy policy. There it says your mail address can be added to marketing lists. But is very well possible that the user will not notice this link. In any way, nowhere is asked for permission to do this, which will make this way of handling illegal in many countries."

Another interesting Dutch headline involves the discovery that the rootkit contains parts of LAME, a LGPLed mp3 encoder. A translation can be found here.

"November 8, 2005 - This Service Pack removes the cloaking technology component that has been recently discussed in a number of articles published regarding the XCP Technology used on SONY BMG content protected CDs. This component is not malicious and does not compromise security. However to alleviate any concerns that users may have about the program posing potential security vulnerabilities, this update has been released to enable users to remove this component from their computers. Please note, Service Pack 2a is a maintenance release designed to reduce the file size of Service Pack 2. It includes all previous fixes found in Service Pack 1 and Service Pack 2."

Of course not. The protection software simply acts to prevent unlimited copying and ripping from discs featuring this protection solution. It is otherwise inactive. The software does not collect any personal information nor is it designed to be intrusive to your computer system. Also, the protection components are never installed without the consumer first accepting the End User License Agreement.

Surely we all understood what was going to happen when we loaded the rootkit...err, "software". I mean, who wouldn't expect a simple music CD to serve as a conduit for information being passed back to the mothership through a 3rd party Trojan?

(For you literalist, I'm being facetious.)

I've always been under the impression that Japanese companies (or those largly held by) were a bit more ethical than their American counterparts. Sony has proven to me that my impression was completely in error.


http://www.sonybmg.com/management.html

2 Americans, 1 Australian & 1 European.

from the sony "content protected discs" faq:

How do I uninstall the software?
If at some point you wish to remove the software from your machine simply contact customer service through this link. You will, though, be unable to use the disc on your computer once you uninstall the components.

Having to contact customer service just to *uninstall* a piece of software ? Seems to me like a an evil spyware-adware company trick...

Send Sony some feedback about their DRM software: http://cp.sonybmg.com/xcp/english/form11.html I sure did.

Malware Malware Malware
Virus Virus Virus
Rootkit Rootkit Rootkit
Spyware Spyware Spyware

Malware Malware Malware
Virus Virus Virus
Rootkit Rootkit Rootkit
Spyware Spyware Spyware

Malware Malware Malware
Virus Virus Virus
Rootkit Rootkit Rootkit
Spyware Spyware Spyware

Malware Malware Malware
Virus Virus Virus
Rootkit Rootkit Rootkit
Spyware Spyware Spyware

Interestingly enough, Sony seems to be responding to all the heat already. I found a readily available link to the ActiveX control-based uninstall mentioned above: http://cp.sonybmg.com/xcp/english/updates.html/. Note that I'm not endorsing the use of this tool as it requires allowing another Sony software tool to run on your system via IE and, as was noted above, puts more ActiveX crap on your system.

In apparent response to all this fuss, Sony has released an update that "removes the cloaking technology component that has been recently discussed in a number of articles published regarding the XCP Technology used on SONY BMG content protected CDs." However, an attempt to access the link to this update using my preferred browser (Mozilla Suite) resulted in the message "Sorry, your Internet Browser does not support ActiveX Controls. Please use Microsoft Internet Explorer to continue."

http://cp.sonybmg.com/xcp/english/updates.html

SOFTWARE UPDATES/ PLUG-INS

November 2, 2005 - This Service Pack removes the cloaking technology component that has been recently discussed in a number of articles published regarding the XCP Technology used on SONY BMG content protected CDs. This component is not malicious and does not compromise security. However to alleviate any concerns that users may have about the program posing potential security vulnerabilities, this update has been released to enable users to remove this component from their computers.

http://updates.xcp-aurora.com/

Sony's Form
A real live person will call you back Amazon titles with the protection
I'll refer you specifically to Velvet Revolver's new cd
Because the 1st user review goes on to explain that DRM sucks and gives directions for removing it.

Here's your chance to get a live Sony rep to call so that you can voice your displeasure, waste their time and generally jerk them around as long as they'll stay on the line. This is one of those moments where I wish TrollKore and The GNAA were still around. Those trolls would eat Sony alive. I don't know how, but I'm sure they'd manage to give Sony the verbal version of Goatse.

6. I have heard that the protection software is really malware/spyware. Could this be true?

Of course not. The protection software simply acts to prevent unlimited copying and ripping from discs featuring this protection solution. It is otherwise inactive. The software does not collect any personal information nor is it designed to be intrusive to your computer system.

Also, the protection components are never installed without the consumer first accepting the End User License Agreement.

If at some point you wish to remove the software from your machine simply contact customer service through this link. You will, though, be unable to use the disc on your computer once you uninstall the components.

I call shenanigans. They say it's not designed to be intrusive, yet it hides itself by creating a security hole and it messes with your drivers. They say it's not installed without the consent of the user to the EULA yet the EULA doesn't appear to give sufficient details to make an informed choice as to whether or not you want this on your system. They offer a removal tool; however, once applied, you will not be able to use the CD in your system at all. This last implies that the tool either does an incomplete removal or adds further software to your system (does the removal tool come with an EULA?)

should be filled out by all angry individuals... http://cp.sonybmg.com/xcp/english/form8.html

Get a Mac? According to the FAQ, the disc appears as a normal CD on a Mac. Anyone know if the content is the same, or are there extras that you get for enabling viruses on your PC?