Slashdot Mirror

not quite...

http://www.xcp-aurora.com/press_article.aspx?art=f eb_05_art3

NEW YORK (Billboard) - It looks like music retailers will soon be getting their wish: At least one major is getting aggressive with copy-protected CDs.

Sony BMG Music Entertainment is stepping up the rollout of what it calls content-enhanced and copy-protected CDs, according to company executives. It began with the Chieftains' "Live From Dublin" album, released Feb. 22. Upcoming albums that will receive the treatment are from Kasabian (March 8) and Susie Suh (March 29).

Sony BMG expects that by year's end a substantial number of its U.S. releases will employ either Sunncomm's newly enhanced MediaMax or First4Internet's XCP to address piracy concerns. No matter which technology a CD uses, it will include such extras as photo galleries, enhanced liner notes and links to other features.

First4Internet's XCP - the true meaning of audio security

XCP copy control technology is aimed at protecting the rights of Content Owners from the unauthorised and illegal copying of digital music and film on CD, DVD and on the Internet.

First4Internet is the one who apparently used GPL code without permission or attribution. Sony didn't build the rootkit on their own or directly steal GPL code (though they did distribute it, knowingly or otherwise).

not quite...

http://www.xcp-aurora.com/press_article.aspx?art=f eb_05_art3

NEW YORK (Billboard) - It looks like music retailers will soon be getting their wish: At least one major is getting aggressive with copy-protected CDs.

Sony BMG Music Entertainment is stepping up the rollout of what it calls content-enhanced and copy-protected CDs, according to company executives. It began with the Chieftains' "Live From Dublin" album, released Feb. 22. Upcoming albums that will receive the treatment are from Kasabian (March 8) and Susie Suh (March 29).

Sony BMG expects that by year's end a substantial number of its U.S. releases will employ either Sunncomm's newly enhanced MediaMax or First4Internet's XCP to address piracy concerns. No matter which technology a CD uses, it will include such extras as photo galleries, enhanced liner notes and links to other features.

First4Internet's XCP - the true meaning of audio security

XCP copy control technology is aimed at protecting the rights of Content Owners from the unauthorised and illegal copying of digital music and film on CD, DVD and on the Internet.

First4Internet is the one who apparently used GPL code without permission or attribution. Sony didn't build the rootkit on their own or directly steal GPL code (though they did distribute it, knowingly or otherwise).

Mathew Gilliat-Smith, F4i managing director, says [about his rootkit]:

"We have developed an effective solution that has earned us credibility with the major labels."

F4i also offers image composition analysis technology, which aims to filter illicit images such as pornography and offensive content on email, web sites, internet chat rooms and mobile phones

Here's some favorable press that First4Internet received a couple of years ago.

http://www.xcp-aurora.com/press_article.aspx?art=x cp_art8

Here's something funny... Sony's rootkit/DRM provider's, First4Internet, XCP's press release links on their website suddenly start to slow down in October 2005...

http://www.xcp-aurora.com/press.aspx

Do you think they're in a panic, too busy to toot their own horns?

Where is XCP being used?

XCP1 and XCP Red technology is being used by all four of the major Record Labels for the protection of pre release music on internal CDRs. Albums from some of the best known artists have been successfully copy protected in this way to reduce the occurrence of leaks prior to release.

Well, I think everyone has been missing a VERY important point. First4Internet is a company which sells products designed to PREVENT copyright violations. Read one of their press releases for example: http://www.xcp-aurora.com/press_article.aspx?art=a ug_05_art2

F4I knows EXACTLY what copyright infringment is. Now the question I will ask you is, do you guys know what happens to people who understand the law, claim to abide by the law, but are secretly violating the law?

Answer: very, very bad things. A court would slap this company so hard that they would cease to exist. And it needs to be done; it's simply no excuse for "big brother" to violate the copyright laws if we cannot.

Matt
(3yrd Year Law Student)

"Ultimately this kind of retro-fitted digital rights management (DRM) can only place speed bumps in the way of determined audio pirates ..."

So we're looking at hits to http://updates.xcp-aurora.com/ are we?

press releases here stating:
* First4internet loses Sony BGM as customer
* First4internet cancels XCP development
* Due to First4Internet's huge liability claims, First4Internet closes its doors
...
* First4Internet bought by Microsoft
...
* Profit ?

Bear in mind that Sony will never say that they're responsible for it. After all, they merely licensed the copy protection scheme from First 4 Internet. While we all should (rightfully) be pissed at Sony for including this on a bunch of their CDs, we should be equally as pissed (or moreso) at First 4 Internet for their (L)GPL violations and for making this product in the first place.

Sony BMG and EMI have begun shipping compact discs using technology that limits the number of copies you can make of any disc to three. And you can't port songs from affected CDs to Apple IPod players unless you request a workaround from Sony.

3. How can I get tracks I rip from my CD into iTunes and/or onto my iPod? Apple's proprietary technology doesn't support secure music formats other than their own and therefore the music on this disc can't be directly imported into iTunes or iPods. Sony BMG wants music to be easily transferable to any device that supports secure music. Currently, music from our protected CDs may be transferred to hundreds of such devices, as both Microsoft and Sony have assisted to make the user experience on our discs as seamless as possible with their secure formats. Unfortunately, in order to directly and smoothly rip content into iTunes it requires the assistance of Apple. To date, Apple has not been willing to cooperate with our protection vendors to make ripping to iTunes and to the iPod a simple experience. If you believe that you should be able to easily move tracks from your protected CD to your iPod then we encourage you to use the following link to contact Apple directly and tell them so. http://www.apple.com/feedback/ipod.html That said, while there is no direct support on the disc for iTunes or iPod, SONY BMG has worked out an indirect way for consumers to move content into these environments, despite the challenges noted above. If you'd like more information on how to move content to iTunes please [CLICK HERE].

The Sony/XCP uninstall process requires you to fill out a web form that uses an ActiveX control. That control has several serious security issues including the ability to run arbitrary code and even a handy built-in reboot function. The ActiveX control gropes around your system and encrypts some information that is submitted in a hidden form field. Their privacy policy does not mention this.

Feel free to go over there and try it yourself. If you install the ActiveX you can remove it in Tools, Internet Options, Settings, View Objects, "CodeSupport Control". Here's what they send you:

From: contentprotectionhelp
Sent: Monday, November 14, 2005 04:22 AM
To: sony-bmg-sucks@invalid.com
Subject: Re: ContentProtectionHelp Email Form

Thank you for contacting Sony BMG Online.

Sony BMG and First 4 Internet have released a Service Pack 2a update that addresses recent concerns surrounding the cloaking technology component on SONY BMG content protected CDs which use XCP technology. These components are not malicious nor spyware however to alleviate any concerns that users may have about the program posing potential security vulnerabilities the update removes the cloaking component from their computers. Please visit the link below to install the SP2a update.

      http://updates.xcp-aurora.com/

If you do not want to install the SP2a update and only wish to uninstall the DRM software, visit the form below using IE 5.0 (or higher) from the computer where the software is installed. After submission, you will be emailed a customized uninstall link within 1 business day (M-F).

      http://cp.sonybmg.com/xcp/english/form9.html
      Your "Case ID" is: 9999999.

TIP: The uninstall request form will require an ActiveX plug-in.
                Also you may need to temporarily turn off any pop-up blocker
                software on the PC.

Thank you for the opportunity to be of assistance.

The Sony BMG Online Support Team
FKSZ

This message and any attachments are solely for the use of intended recipients. They may contain privileged and/or confidential information. If you are not the intended recipient, you are hereby notified that you received this email in error, and that any review, dissemination, distribution or copying of this email and any attachment is strictly prohibited. If you receive this email in error please contact the sender and delete the message and any attachments associated therewith from your computer. Your cooperation in this matter is appreciated.

- - - - -

Disclaimer: I'm a Sony employee, and I strongly disapprove of the rootkit DRM stuff in a completely unofficial not-representative-of-the-company way ;)

But it's worth mentioning at this point that Sony didn't develop the software in question here - the XCP software was developed by First4Internet.

Not being a lawyer, or particularly knowledgable about (L)GPL terms, who could be held liable when a piece of software is developed by one party, but distributed by another? Is ignorance a defence, for instance if Sony said "We didn't know it had unlicensed code!", how would that affect things?

Sorry, typo in link :-(
http://www.xcp-aurora.com/press_related.aspx

In light of recent coverage, I think they need to update the press page on their website.
http://www.xcp-aurora.com/press_related.aspx/
Methinks they might need to dedicate a whole page just for Oct 2005 alone ;-)

Wonderful to watch this going south in a big way, dragging the whole concept of DRM with it. We all owe Sony a debt of thanks, really.

I particularly enjoyed this quote from First4Internet's website from their director of Sales & Marketing:
"We're not denying people access to the music," Macdonald said. "We're just trying to help them manage their access."

http://www.xcp-aurora.com/press_article.aspx?art=x cp_art10

Please! Please, Mr. MacDonald! Help me manage my access to my media by installing a rootkit!

I recently purchased Imogen Heap's new CD (Speak for Yourself), an RCA Victor release, but with distribution credited to Sony/BMG. Reading recent reports of a Sony rootkit, I decided to poke around. In addition to the standard volume for AIFF files, there's a smaller extra partition for "enhanced" content. I was surprised to find a "Start.app" Mac application in addition to the expected Windows-related files. Running this app brings up a long legal agreement, clicking Continue prompts you for your username/password (uh-oh!), and then promptly exits. Digging around a bit, I find that Start.app actually installs 2 files: PhoenixNub1.kext and PhoenixNub12.kext.

Personally, I'm not a big fan of anyone installing kernel extensions on my Mac. In Sony's defense, upon closer reading of the EULA, they essentially tell you that they will be installing software. Also, this is apparently not the same technology used in the recent Windows rootkits (made by XCP), but rather a DRM codebase developed by SunnComm, who promotes their Mac-aware DRM technology on their site.

'..but by using DRM which allows some limited copying, it is hoped that people won't feel the need to bypass the DRM entirely.'

http://www.xcp-aurora.com/press_article.aspx?art=j ul_05_art4

Darren Dittrich followed up on the discovery that Sony was playing a dirty trick on its customers, secretly installing a malware-style "root kit" on their computers via audio CDs:

I recently purchased Imogen Heap's new CD (Speak for Yourself), an RCA Victor release, but with distribution credited to Sony/BMG. Reading recent reports of a Sony rootkit, I decided to poke around. In addition to the standard volume for AIFF files, there's a smaller extra partition for "enhanced" content. I was surprised to find a "Start.app" Mac application in addition to the expected Windows-related files. Running this app brings up a long legal agreement, clicking Continue prompts you for your username/password (uh-oh!), and then promptly exits. Digging around a bit, I find that Start.app actually installs 2 files: PhoenixNub1.kext and PhoenixNub12.kext.

Personally, I'm not a big fan of anyone installing kernel extensions on my Mac. In Sony's defense, upon closer reading of the EULA, they essentially tell you that they will be installing software. Also, this is apparently not the same technology used in the recent Windows rootkits (made by XCP), but rather a DRM codebase developed by SunnComm, who promotes their Mac-aware DRM technology on their site.

Oh, wow, that sucked retry :)

This is the link you get from sony after jumping through a lot of hurdles:

http://www.xcp-aurora.com/support/sonybmg/process. aspx?opt=1&id=XYAUfasSFoSdasfDoFPPEWFFEoibnaZPQlSf FgKGSGGIA

See:

http://www.sysinternals.com/blog/2005/11/sony-you- dont-reeeeaaaally-want-to_09.html

Enjoy

This is the link you get from sony after jumping through a lot of hurdles:

http://www.xcp-aurora.com/support/sonybmg/process. aspx?opt=1&id=XYAUfasSFoSdasfDoFPPEWFFEoibnaZPQlSf FgKGSGGIA [xcp-aurora.com]

See:

http://www.sysinternals.com/blog/2005/11/sony-you- dont-reeeeaaaally-want-to_09.html [sysinternals.com]

Enjoy

From the article: "Sony's move is the latest effort by the entertainment companies to rely on controversial 'digital rights management' (DRM) technologies to reverse a steady drop in sales that the industry attributes in large part to piracy facilitated by online music and movie file-sharing networks like Kazaa and Limewire."

Yeah, because installing secretive, privacy-invading software on your computer is sure to stimulate CD sales.

And the uninstall process is a privacy invasion too... you gotta fill out an online form, check your email for a URL to ANOTHER online form, then get the uninstaller. And while the uninstaller gets rid of the XCP2 Aurora, it simultaneously installs another DRM (MediaJam). Nice. Sony, how I love thee. You're so sinister.

First4Internet, a company in Oxfordshire UK. supplied the Rootkit and DRM.

Don't sit there bottling it up! tell them what you think about their wonderful software. Hurry up though, there is a good chance that the order book isn't as full as it they would like :-)

but to you trust it?
http://updates.xcp-aurora.com/

Goes to show: the squeeky wheel gets the grease.

The people who make this odious software have contact details.

http://www.xcp-aurora.com/contact.aspx

Let them know how much you love them!

XCP2 may affect more than just CDs: The company is currently working on versions for DVDs and online music files, Gilliat-Smith says. Sony BMG will ship the DVD technology to U.S. movie studios for use in prerelease copies of movies by late 2005, he hopes, and will introduce a version for commercial DVDs later.

XCP2 may affect more than just CDs: The company is currently working on versions for DVDs and online music files, Gilliat-Smith says. Sony BMG will ship the DVD technology to U.S. movie studios for use in prerelease copies of movies by late 2005, he hopes, and will introduce a version for commercial DVDs later.

Malware Malware Malware
Virus Virus Virus
Rootkit Rootkit Rootkit
Spyware Spyware Spyware

Malware Malware Malware
Virus Virus Virus
Rootkit Rootkit Rootkit
Spyware Spyware Spyware

Malware Malware Malware
Virus Virus Virus
Rootkit Rootkit Rootkit
Spyware Spyware Spyware

Malware Malware Malware
Virus Virus Virus
Rootkit Rootkit Rootkit
Spyware Spyware Spyware

Actually they now link to the kind folks who made this software for 'em and will provide an uninstall feature... ...but the damned thing requires ActiveX.

http://updates.xcp-aurora.com/unsupported.aspx

Sigh.

In apparent response to all this fuss, Sony has released an update that "removes the cloaking technology component that has been recently discussed in a number of articles published regarding the XCP Technology used on SONY BMG content protected CDs." However, an attempt to access the link to this update using my preferred browser (Mozilla Suite) resulted in the message "Sorry, your Internet Browser does not support ActiveX Controls. Please use Microsoft Internet Explorer to continue."

http://cp.sonybmg.com/xcp/english/updates.html

SOFTWARE UPDATES/ PLUG-INS

November 2, 2005 - This Service Pack removes the cloaking technology component that has been recently discussed in a number of articles published regarding the XCP Technology used on SONY BMG content protected CDs. This component is not malicious and does not compromise security. However to alleviate any concerns that users may have about the program posing potential security vulnerabilities, this update has been released to enable users to remove this component from their computers.

http://updates.xcp-aurora.com/

search first4internet

how to get rid of it...

Except that he put a link to a form, and not to a way to get rid of it. Looking further into the sony website the code used seems to originate from http://www.xcp-aurora.com/ . Maybe that is the root of all problems.
Sue Sony -> Sony sue Aurora -> Lawyers will get rich and happy.

From xcp-aurora.com ("The Alleged creator of this ROCK-SOLID protection methodology")

http://www.xcp-aurora.com/xcp1.aspx

Quote:

"XCP1 - Burn Protect

XCP1 pre release technology is designed to provide copy protection onto compact disc recordable media (CDR). Its methodology is an encapsulation process that wraps around the audio content controlling device access. This technique enables the information contained on the disc to be protected without being altered or affecting sound quality. The control program provided as part of the disc management system does not install any programs that alter your access to the content. XCP is deployed through Aurora Software and provides two options for CDR protection."

End Of Quote.

I think it WRAPS around any prior functional protection method the vast majority HAD to protect their Windows Based computer ("Lets Not Forget NETWORK, if you happened to have installed this stuff on a system that's logged on with FULL Network Privileges")

True, the control program does not ALTER your access to the content, it just allows potential World-Wide access to any content on your Network it is installed on and makes WEP look like Quad-WPA encryption when compared to the holes this opens.

Quote From xcp-aurora.com

"XCP1

XCP1 is designed for CD Audio and PC & MAC playability. Levels of protection are very high and recipients of XCP1 copy protected CDs will find it difficult to digitally rip or burn the Red Book content of the CD."

End Of Quote.

Yes however it appears that it was just made much easier to FTP the entire contents of any and all system and possibly Network Media device(s) this stuff has been installed on.

All comments in this post made by ZOverLord are strictly the opinion of ZOverLord and do not reflect the opinions of any other person or entity including the site it was posted on.

The technology used in this rootkit appeared on Slashdot about six months ago.

At least now we know how it works.

"XCP aims to offer a reasonable level of protection against 'casual piracy' while working to provide the authorised customer with a quality digital music experience together with DRM features for controlled copying on their chosen platform. If data in any format is digitally written to a compact disc or DVD then it can be read from that disc in some way. XCP is designed to give a level of protection that will make it suitably difficult for the general consumer to copy and/or illegally distribute the content of the disc."

http://www.xcp-aurora.com/xcp2.aspx

Can someone explain how a thing like this is supposed to work? I don't mean whether or not it can be cracked, I'm sure it can. I mean, how does it ever work even on the non-technical user?

Just guessing :

As some protection scheme are relying on the autostart function of Windows :

The original is somewhat watermarked. Copying destroys the watermark. The autostart program installs "something" that forbids copying a non-watermarked CD.

Voilà, it's rather vague but hope it gives an idea. It might still be enough to apply for a patent those days :)

http://www.xcp-aurora.com/ are producing that protection, named xcp2.

"XCP aims to offer a reasonable level of protection against 'casual piracy' while working to provide the authorised customer with a quality digital music experience together with DRM features for controlled copying on their chosen platform. If data in any format is digitally written to a compact disc or DVD then it can be read from that disc in some way. XCP is designed to give a level of protection that will make it suitably difficult for the general consumer to copy and/or illegally distribute the content of the disc."

http://www.xcp-aurora.com/xcp2.aspx

Poking around the XCP Aurora website, there are buried references to "playing through the XCP player," or "using the provided player." Makes me think they require playback through custom software that they include on the disc. There are also references to RealPlayer, MS Media Player, Winamp, etc. It's possible that they're providing a plug-in to those programs that allows decoding of the audio portion while still appearing to be the playback tool of choice. If they're breaking the CD-ROM access by putting bogus CD structure info up front, someone will break out a Sharpie and "fix" it.

My guess is that some MBA looked at the market, and included OS's and playback programs until he got 98% market coverage, and said "that's good enough. The 3% [sic] represented by the remaining folks won't matter - we'll more than make up for that with the increased sales that result from the reduction in bootleg copies." The unfortunate truth is that it won't make a damned difference. They fail to realize that the Internet is what the military folks call a "force multiplier." You only need one determined individual to crack the coding, or to make a decent D-A-D copy (thus stripping off the DRM), and post it on the 'net. Once that happens, you've got a gazillion traders who are more than willing to propagate the copies.

Poking around the XCP Aurora website, there are buried references to "playing through the XCP player," or "using the provided player." Makes me think they require playback through custom software that they include on the disc. There are also references to RealPlayer, MS Media Player, Winamp, etc. It's possible that they're providing a plug-in to those programs that allows decoding of the audio portion while still appearing to be the playback tool of choice. If they're breaking the CD-ROM access by putting bogus CD structure info up front, someone will break out a Sharpie and "fix" it.

My guess is that some MBA looked at the market, and included OS's and playback programs until he got 98% market coverage, and said "that's good enough. The 3% [sic] represented by the remaining folks won't matter - we'll more than make up for that with the increased sales that result from the reduction in bootleg copies." The unfortunate truth is that it won't make a damned difference. They fail to realize that the Internet is what the military folks call a "force multiplier." You only need one determined individual to crack the coding, or to make a decent D-A-D copy (thus stripping off the DRM), and post it on the 'net. Once that happens, you've got a gazillion traders who are more than willing to propagate the copies.

Who cares? I've got an old 1989 Sony (!) CD player with an optical digital output, and a CMI8738 sound card with a digital input. I cannot imagine this copy protection scheme to violate existing SPDIF standards (mind you, "SPDIF" stands for "Sony/Philips Digital Interface", see also here). So - nobody able of getting an older CD player and a 50$ sound card will be too impressed by any backwards compatible CP scheme. This is ridiculous.

The CP vendor's web site says "It is a robust solution providing the highest levels of protection against casual piracy while ensuring full playability." which says all. This is not (and cannot be) targeted against the professional pirates in Asia who make and sell millions of copies, but against you and me and Joe User.