Slashdot Mirror

: As opposed to authorized programs, like the Sony backdoor, which used Microsoft-supplied methods to create the program to hide from the users

it's a tad worse than that: microsoft appears to directly support malware by certifying them safe under it's designed for microsoft logo program.

for example: sunncomm's mediamax rookit software carries microsoft's designed for microsoft windows xp logo, which states:

    * the product will be stable when running windows xp.
    * the related software or driver components can be installed or removed easily.
    * the basic experience with the product and the operating system will be the same or better after upgrading to future versions of windows.

each claim is pointedly debunked by reading mark russinovich in sony, rootkits and digital rights management gone too far (october 31, 2005).

even if you do trust microsoft, i would suggest caution in trusting software carrying a microsoft certified logo.

- p

I recently purchased Imogen Heap's new CD (Speak for Yourself), an RCA Victor release, but with distribution credited to Sony/BMG. Reading recent reports of a Sony rootkit, I decided to poke around. In addition to the standard volume for AIFF files, there's a smaller extra partition for "enhanced" content. I was surprised to find a "Start.app" Mac application in addition to the expected Windows-related files. Running this app brings up a long legal agreement, clicking Continue prompts you for your username/password (uh-oh!), and then promptly exits. Digging around a bit, I find that Start.app actually installs 2 files: PhoenixNub1.kext and PhoenixNub12.kext.

Personally, I'm not a big fan of anyone installing kernel extensions on my Mac. In Sony's defense, upon closer reading of the EULA, they essentially tell you that they will be installing software. Also, this is apparently not the same technology used in the recent Windows rootkits (made by XCP), but rather a DRM codebase developed by SunnComm, who promotes their Mac-aware DRM technology on their site.

Darren Dittrich followed up on the discovery that Sony was playing a dirty trick on its customers, secretly installing a malware-style "root kit" on their computers via audio CDs:

I recently purchased Imogen Heap's new CD (Speak for Yourself), an RCA Victor release, but with distribution credited to Sony/BMG. Reading recent reports of a Sony rootkit, I decided to poke around. In addition to the standard volume for AIFF files, there's a smaller extra partition for "enhanced" content. I was surprised to find a "Start.app" Mac application in addition to the expected Windows-related files. Running this app brings up a long legal agreement, clicking Continue prompts you for your username/password (uh-oh!), and then promptly exits. Digging around a bit, I find that Start.app actually installs 2 files: PhoenixNub1.kext and PhoenixNub12.kext.

Personally, I'm not a big fan of anyone installing kernel extensions on my Mac. In Sony's defense, upon closer reading of the EULA, they essentially tell you that they will be installing software. Also, this is apparently not the same technology used in the recent Windows rootkits (made by XCP), but rather a DRM codebase developed by SunnComm, who promotes their Mac-aware DRM technology on their site.

A: Dear JC,

My decision to spend several hours on the phone with Mr. Vance fro The Register resulted in the story about SunnComm moving from "hatchet job" to "knife-wound."

While the author fact-checked all of the information I gave him, he didnt bother to fact-check his single main source and chose instead to mischaracterize the source/bashing organization as "investor-shareholders." I told the author that the person with whom he was corresponding was, in fact, not an "investor" as he characterized him and that SunnComm has never, NEVER been served with ANY complaint from ANY shareholder since I came to SunnComm in 2000.

The author did just what Dan Rather and CBS did when they took the bogus paperwork from Lt. Col. whathisname. They ignored the motives of the source. Worse, Mr. Vance proceeded to mischaracterize the source purposely in the article even after being told otherwise. In other words, Mr. Vance purposely made a decision to carry the water for OurStreet.Com even after knowing of the possibility that his source had lied to him about his standing.

The story is inaccurate on so many levels that I will go over it point by point and publish the results on our website as soon as its done.

Ill also send a copy to Mr. Vance and ask that he investigate and, where appropriate, retract his mis-statements.

Its funny. No one in the legitimate news community would touch the OurStreet dirt package with a 10-foot pole. Theyve been trying to find such a dupe for a year. Our Oregon friend from OurStreet must be jumping up and down with glee that finally he found his "patsy."

Thanks for writing. Theyll be more on this.

pj

Q: Peter,
Last weekend my wife was copying CDs from a friend. She was successful on all of her choices except for Afterglow by Sara M. She did not realize that we were invested in the company that prevented her from burning that CD. After I told her that we had a large position in Sunncomm, she was excited about the technology.
Peter, when will the shareholders be rewarded for their patients with Sunncomm? (9/7/2004 8:44:35 AM)

A: Hey, wait a minute. Thats a "when will the share price go up" question in disguise. I dont know for certain, but I believe that as the company continues to add new business and focuses on improving our technology, our value in the marketplace will continue to increase overall. We are working on making it a great year. Lets see how it goes.

Best regards,

Peter

And they are not happy.

I don't know what American libel laws are like, but here in Britain, what was said about the Register's journalistic practices would, if unprovable, cause SunnComm some trouble...

'Its funny. No one in the legitimate news community would touch the OurStreet dirt package with a 10-foot pole. Theyve been trying to find such a dupe for a year. Our Oregon friend from OurStreet must be jumping up and down with glee that finally he found his "patsy."'

' Mr. Vance proceeded to mischaracterize the source purposely in the article even after being told otherwise. In other words, Mr. Vance purposely made a decision to carry the water for OurStreet.Com even after knowing of the possibility that his source had lied to him about his standing.'

'he didnt bother to fact-check his single main source'

Needless to say, from a regular reader of the Register's perspective, these allegations seem extreme. However, I must say, the SunnComm director is very reassuring: "SunnComm is NOT a get rich quick scheme" - a Nigerian friend of mine told me the same thing the other week.

Cooler heads prevailed.

Because SunnComm is, itself, a company which relies on research and development for its survival, we feel that bringing legal action for damages against researchers in a higher learning environment may contribute to a chilling effect on the type of research that faculty, staff, and students elect to pursue. Therefore, weve decided to move along and not pursue legal remedies in deference to "the bigger picture."

[cough]bullshit[/cough] When was the last time any of these idiots gave a ripshit about "deference to the bigger picture"? When was the last time they gave a rat's ass about fair use and consumer rights? When was the last time they were loyal to anyone or anything other than their puppet masters at the *AA?

Jacobs concluded, "We realize now that Mr. Halderman had mistakenly expected to be researching an "extremely hack resistant" copy protection product when he evaluated MediaMax -Version1.

Lots of bullshit, but the truth finally comes out.

The PMTC [Professional Media Test Center] determined that none of the ripper programs used in the testing process was able to produce a usable unauthorized copy of the protected CD yielding a verifiable and commendable level of security for the SunnComm product. [Emphasis added.]

They billed this as the greatest thing since sliced bread, the answer to the problems of music piracy. Ahh . . . the success of security through obscurity demonstrated once again.

Later in the press release, the truth comes out. The truth is a beautiful thing, is it not?

In other words, "our technology sucks rocks and we know it. Everybody knows it except for the suckers at BMG who bought our marketing hype hook, line, and sinker. Our lawyers told us this barratry have been laughed out of the courtroom, probably with us having to pay his legal bills which would have bankrupted us."

The goal of MediaMax was not to invent the "holy grail" (since one does not exist).
...They seem to born out of some Messiah complex hell-bent on saving the world from any technological attempt to protect artists and their property.

No matter what their credentials or rationale, it is wrong to use one's knowledge and the cover of Corporate America to facilitate disinformation regarding the existence, or not, of such a Holy artifact. Also, to suggest that Jesus would be "saving the world from any technological attempt to protect artists" is a misrepresentation. When I asked, What Would Jesus Do , it was His position that He is not against any particular technology, however the application of technology such as DRM to prevent consumers from exercising their rights may be, in fact, an Evil that Jesus would be prepared to deal with during the coming Apocalypse.

The goal of MediaMax was not to invent the "holy grail" (since one does not exist).

...They seem to born out of some Messiah complex hell-bent on saving the world from any technological attempt to protect artists and their property.

No matter what their credentials or rationale, it is wrong to use one's knowledge and the cover of Corporate America to facilitate disinformation regarding the existence, or not, of such a Holy artifact. Also, to suggest that Jesus would be "saving the world from any technological attempt to protect artists" is a misrepresentation. When I asked, What Would Jesus Do , it was His position that He is not against any particular technology, however the application of technology such as DRM to prevent consumers from exercising their rights may be, in fact, an Evil that Jesus would be prepared to deal with during the coming Apocalypse.

It is the intention of management to remain a non-reporting company listed on the "The Pink Sheets" until such time as the company reports significant sales of its technology. It is within the corporation's legal rights to elect this option. However, this means that you, the investor or interest-holder, will not be afforded public access to regular company audits and therefore you must solely rely on the company's press releases, news stories, or other publicly available information.

Not having access to audit detail or other significant reporting dynamics can put SunnComm shareholders or interest-holders, at a significant disadvantage from a risk standpoint. Due to SunnComm's current, legal, non-disclosure status, your investment in SunnComm may carry with it an even higher degree of risk than that of other publicly traded companies which are currently fully reporting.

SO.. I can only believe what SunnComm tells me about SunnComm since SunnComm will try to sue and jail anyone that says anything bad about SunnComm or at least has them under a tight NDA. By the way:

If you have additional questions regarding this notice or anything you may read on SunnComm's website, we urge you to contact company directly.

So, go to Ask the Prez and watch the bullshit flow. Like this exchange on the "Prez" page:

Q: Ive heard your technology can be hacked. Does that mean it wont "work?" (10/6/2003 7:37:18 PM)

A: Not at all. People who perform tests on MediaMax and declare it to be "hackable" dont understand why its there in the first place. Let me tell you why:

1. All technology can be "hacked" by people wishing to make illegal and unauthorized use of the content owners property. Prior to MediaMax, there was no alternative to the illegal copying and re-copying of music by users. Now with MediaMax on the CD, honest people have a way of honoring the artists wishes regarding how and where the music property can be copied and shared.

2. MediaMax was designed to put a structure on the CD, itself, that empowers consumers to make licensed, legal and yes, limited copies of the music. The world has never seen anything like it before.

3. Thieves attempting to circumvent the technology for the purpose of re-distributing the music are breaking the law. Nothing will ever stop these thieves. Theyve rationalized the theft and they will always be looking for ways to cheat the system.

4. The goal of MediaMax was not to invent the "holy grail" (since one does not exist). The idea was to provide users with a way to legally use the CD, whether that be for copying or sharing the music. The difference between using our implanted technology or ripping the music for re-distribution is the difference between withdrawing money from your bank or robbing it.

5. If you owned technology that allowed you to transport the money from your local bank to your living room, doesnt give you the right to do it. Music is much the same. As a consumer, you purchase the "listening rights" to the music on the CD, not the duplication rights.

6. No matter how much stealing (called "sharing" to make thieves feel better about themselves)goes on, its still taking the copyrighted property of others and converting it to ones own use.

7. The current version of MediaMax is like any software technology in Version 1. The next version will make it tougher and tougher to circumvent. We have to start somewhere and progressive record companies like BMG and others understand this.

8. Meanwhile, honest people, may, for the first time, enjoy the pleasurable experience of legal and licensed copying and sharing of their music - thats about 95% of us.

Ask The President of Sunncomm what the hell he was thinking!

I've been reading the various press reports about SunnComm's threatened lawsuit against the Princeton student that revealed how to disable the software that SunnComm installs as part of it's copy protection.

I just wanted to say Thank You! This case, should it go to trial, will almost certainly point out the absurdity of the DMCA and, with any luck, completely invalidate that part of the DMCA, thereby saving us all from future frivolous lawsuits.

You are doing a great service to our country. Keep up the good work!

Quoth the poster:

...they will be driving the student into bankruptcy from legal fees due to nonsense claims such as this, thereby serving as a warning to anyone else who might consider pointing out that the Emporer does not have any clothes.

Well, not so fast. I am not making this up, it's on their site:

SunnComm Technologies, Inc. is a Phoenix, AZ company whose stock is publicly traded in the Over-the-Counter (OTC) market under symbol STEH. Our 3-year old company is currently in the development stage of its life cycle and, to date, has earned only insignificant revenue from sales of its products.

It is the intention of management to remain a non-reporting company listed on the "The Pink Sheets" until such time as the company reports significant sales of its technology . . . However, this means that you, the investor or interest-holder, will not be afforded public access to regular company audits and therefore you must solely rely on the company's press releases, news stories, or other publicly available information.

Besides making Enron look like a good investment, they may very well not have the cash to initiate a court battle. In which case, not for the first time would cooler heads prevail. These guys don't have the resources to mount a SCO-esque "we'll sue you until you buy us out" campaign.

As for suing the student, RTFA and you'll see that they mentioned the student AND Princeton. Here again, Princeton has the jack to mount a legal battle, SunComm doesn't. And Princetion might very well defend the student.

Any way you slice it, this does not bode well for the fledgling fair-use-rights infringers. I think they're more pissed at this guy putting the kibosh on their pump-and-dump scheme.

here (sunncomm.com)

It's worth checking out this page just for some of the comments, like "I have recently become a stockholder in your company and am proud to have done so..."

One born every minute...

I did a search on google and found this page which has instructions on what to do if the DRM software didn't load.

At the bottom of this page they have this:

What should I do if the program does not automatically start when I place the CD in my computer?:
Try removing the CD from the CD-Rom drive, and replacing it again to allow the application to start automatically. If the application still does not start by itself, PC users can double-click their "My Computer" icon on the desktop and then double-click on the drive letter containing the CD. If the application still does not launch, try double-clicking on the LaunchCD.exe file in the CD directory. The application should start.

So what Halderman did wasn't even close to a breach (duh +5). If he had attempted to circumvent the digital keys now THAT would have been something. I suppose this lawsuit is a way of preventing anyone from going further with "research". Halderman has my respect for what he's done, and what he's about to go through, but this wasn't exactly ground breaking.
Technically I can put out another paper now saying I installed VMWare (which suggests turning off autorun) and this bypassed their DRM.

Really the DRM never even has a chance to come under scrutiny since it didn't get installed. Look back at that page and you'll see that the technology is around the Digital Keys and part of MS's new DRM.

Here is the form.

Be polite.

I've got some questions.

Do you really think that your *not* ripping people off by selling them technology that doesn't do it's job??

Do you really think that a software only DRM solution for music can ever do it's job?

Do you really think that just because some kid wrote an article about how your software doesn't work the way it's supposed to, the he's doing something wrong?

Well, we'll check back in about a month or two to see if you've still got BMG as a client :)

Posted to this link. Wonder what the chances of a reply are!

In your first answer you note that "Now with MediaMax on the CD, honest people have a way of honoring the artists wishes regarding how and where the music property can be copied and shared." Wouldn't you agree that it's not the honest people you are worried about? Honest people didn't copy CDs and distribute them, only the dishonest ones, so basically your software is only re-enforcing to the honest users that they are all potential theives, and are not trusted?

In your third point: "Thieves attempting to circumvent the technology for the purpose of re-distributing the music are breaking the law. Nothing will ever stop these thieves." What about people who have autorun disabled on their CDs due to security concerns? When they rip and burn or copy the music from a mediamax protected CD they'll be able to do it (as I understand it) without the knowledge they are doing something wrong, because your software appears to rely on autorun being enabled... are they still considered to be circumventing your copy protection?

When you say "The difference between using our implanted technology or ripping the music for re-distribution is the difference between withdrawing money from your bank or robbing it." you are again implying that the users are theives, regardless of their reasons for ripping a CD. When I rip my CDs so I can stream them to my computer at work, or have backups in case a CD is lost or damaged, or have them available in a large playlist format that I can use to play a mix of music as I want it at home through my computer am I a thief?

"If you owned technology that allowed you to transport the money from your local bank to your living room, doesnt give you the right to do it." Why not? It is my money. If I want to use it to light my cigars or roll around naked in or simply tear MY money into little pieces why am I not allowed to?

"No matter how much stealing (called "sharing" to make thieves feel better about themselves)goes on, its still taking the copyrighted property of others and converting it to ones own use." As I understand the music industry it's infringing on the rights of the record companies to make money and rip off the artists, who (some of them anyway) actually make music that they want to be heard by others. I think your opinions of people who "share" files is a bit uneducated and lopsided.

When you boast that: "The current version of MediaMax is like any software technology in Version 1. The next version will make it tougher and tougher to circumvent." you are indicating that you will make it harder to prevent software from sneakily installing on a computer. In fact, unless your software makes its presence known (and approved) it rates as a virus.

"So-called "experts" who grandstand by publishing MediaMax hacks dont "get it." They seem to born out of some Messiah complex hell-bent on saving the world from any technological attempt to protect artists and their property." Surely you are joking when you say this Mr. Jacobs. These "hacks" are the act of holding down the shift key or having autorun disabled, hardly the work of a master hacker. I believe most of the mention was along the lines of "wow, lame copy protection, it uses autorun". Hardly a "messia complex" as you describe it.

"With MediaMax, we have a technology that plays on virtually every device" As a law abiding person who has resisted the urge to "share" or "borrow" music online, I must ask if this technology will work on my linux system, or the mac laptop which I will be getting through work soon. Working in CD players is fine, but the other side of the technology, the side where it works in computers, is important as well, and the entire world doesn't run windows... or are those who don't thieves because they aren't (can't) use your software?

"Stealing is serious. People are getting hurt...real people, and SunnComm intends to pl

At http://www.sunncomm.com/video/video.asp?VideoID=01 30 Peter Jacob says at a congressional hearing in response to "what happens when the market presents a cdrom that mimics the function of a cd player? Would you consider that to be a circumvention device?"

"That protection won't do any good any more for that particular CD"

He also says later:
"Everyone knows that the customer will dictate what fair use is at the end of the day. I think our company will pioneer that."

Don't worry, they couldn't sue themselves (they'd have to borrow even more money). This is a completely pointless threat! Their web site pulls up a disclaimer upon loading that informs you that the company hasn't made any money (probably up to their eyebrows in debt) and they're under their rights not to report to any stock purchasers just how much they've lost until they break even (if ever). The CEO of the company acknowledges that buying their stock is a risk of losing your entire investment in it.

How are they so concerned about their 20% loss in stock value when they warn their own shareholders that they're buying a volatile stock in a company that hasn't made any money and they don't want to tell you how much they've lost and/or owe? What damage exactly has this kid done to their reputation?!? They don't have one!

Not to mention, someone should sue them for false advertising. Their web site claims that their technology is "Lightyears Beyond ENCRYPTION". If I was BMG or the RIAA, I'd sue them to recover every penny I paid them to include security technology on their CD's that can be circumvented by simply holding down the Shift key!

Their website has it's own equally effective security feature.... Much like the Shift key with their Audio CD security, if you disable flash (ActiveX in IE, plug-ins elsewhere) it simply disappears (no alternate content if you block flash)! Perhaps if someone disables the DMCA these absurd lawsuits will also disappear (one can dream, right?).

For example, visiting http://www.sunncomm.com/video/video.asp using i686+Linux+Mozilla gives the error message "Sorry, this feature is not available to Macintosh users at this time"

If they can't do something as mediocre as a browser check with javascript (can't even COPY-PASTE it from any of the free resources online), is it really a surprise that their DRM software can be bypassed by hitting shift ?

If this bullshit lawsuit doesn't get thrown out of court in five minutes or less, I am moving to Canada.

Mail these fucktards and let them know what you think of them and their ridiculous suit.

~Philly

http://www.sunncomm.com/index2.html

http://www.zombo.com/

Because of our non-reporting status, SunnComm's management feels you need to understand these very important facts prior to making a decision to invest in the company's shares, and you should also be totally aware that you run the risk of losing your entire investment should you make the decision to purchase shares in SunnComm.

Run the risk of losing your entire investment? More like a dead cert now, methinks!

(BTW, this text plus other stuff shows up in a window when you first visit their website; to see it on a later visit, you'll have to delete their cookie)

...lurks the corporate logo "Lightyears beyond encryption"

Bwahahahaha! You just can't make this shit up...

Also, in the original article, it says that you'll be able to download all or some of the music from the CD to your computer, but they won't play on other people's computer, so you won't be able to share the files with other computers. You'd have to give the physical disk to the user you want to share the music with and that user would have to download the music from the CD.

I'm not too familiar with the actual technical specs on the CD format, but a quick read-through of the Sunncomm stuff doesn't make much sense to me in that it would seem easy to get around.

I'm sure that one of my CD players (at least 12 years old, and yes it still works) won't be able to "decrypt" anything.

It appears that they also have some kind of downloadable music format; the player for it apparently checks to see if the CD is present. Their website is maddeningly vague (understandably) and, to add insult to injury, it requires Flash. But there's a mention of using "Microsoft's DRM technology for music downloads".