Sony DRM Installs a Rootkit?

An anonymous read writes "SysInternals.com guru Mark Russinovich has a detailed investigation of a rootkit from Sony Music. It's installed with a DRM-encumbered music CD, Van Zant's "Get Right with the Man". (Mmmm, delicious irony!) The rootkit introduces several security holes into the system that could be exploited by others, such as hiding any executable file that starts with '$sys$'. Russinovich also identifies several programming bugs in the method it uses to hook system calls, and chronicles the painful steps he had to take to 'exorcise the daemon' from his system." This house is clear.

Comments

My question:

[conJunk]

Now is that *sony's* rootkit, or a soon-to-be-former-sony-employer's rootkit?

Re:My question:

[ryanr]

If you read the article, there's a strong implication that this is a purchased commercial rootkit. Presumably, Sony very deliberately licensed and distributed it.

Mark didn't get into a lot of detail about all of the functions, but he didn't mention any backdoors or phone home functionality.

Re:My question:

[networkBoy]

Honestly, I see this as a real exposure to a lawsuit. If I accidently install this rootkit on my system, then try to remove it (seeing as it looks like a genuine security breach) and then disable my computer, thus having to bring it in for service what then?. If a malware company uses the rootkits ability to hide $sys$ prefixed files and uses that to steal my identity, costing me thousands of dollars and hundreds of hours of time to get my identity back, can I sue?

-nB

Re:My question:

[interiot]

The rootkit is by First 4 Internet. It's possible that Sony simply purchased this DRM from this outside company, not realizing that the DRM contained a rootkit.

Still, one would hope that Sony would only choose reputable suppliers, ones who wouldn't allow a virus/trojan to be distributed intentially or even through neglect.

Re:My question:

[interiot]

No, the rootkit wasn't necessarily intentionally purchased by Sony. Re-read the article. Google for first 4 internet. Find this site. Notice they sell DRM. Thanks for playing.

Re:My question:

[networkBoy]

I don't understand what you mean. Do you mean that Sony did not understand that this DRM was a rootkit? or that the DRM is not a rootkit?
AFAIK this is a rootkit in more ways than one.
-nB

Re:My question:

[ryanr]

Uh... the point of the original article is that Sony is shipping DRM in the form of a rootkit on their CDs. The rootkit appears to have been licensed from the company you link to. I'm not sure what point you were trying to make. You appear to be agreeing with me that they are the likely sellers of said rootkit.

Re:My question:

[interiot]

there's a strong implication that this is a purchased commercial rootkit. Sony very deliberately licensed and distributed it.

It's obvious that a rootkit exists on the CD. It's quite likely that Sony purchased the DRM from First4Internet. It's not obvious that Sony asked First4Internet to include a rootkit in the product that was delivered to Sony.

Re:My question:

[eln]

And nobody at Sony bothered to vet a piece of software that was destined to be shipped with millions of CDs? It's beyond absurd that a company of Sony's size would allow a piece of software to appear on any of its products without Sony having tested the hell out of it first.

I think it's far more likely that Sony knew what this software did, and chose to distribute it anyway. This could have been a result of incompetent testers, poor communication between QA and management, overbearing management anxious to get a product out on a strict deadline, or any number of other things.

Re:My question:

[utlemming]

However, it might not protect them from a product liability suit. Simply put, if that had happened to me, I would have bought a new hard drive, reinstalled everything and then copied the data that I needed over, and then filed a product liability suit. I would claimed everything from illegal computer trespass, product liability, vandalism, and anything else that might have sounded half-way reasonable. The fact that a root-kit was installed on the computer to protect music shows that privacy now takes a second place seat to some one-else's property rights, when that person isn't even present. In this case one the music industry, if allowed to get away with it is violating privacy and property rights of another person in order to protect their property rights.

Re:My question:

[_pi-away]

It's obvious that a rootkit exists on the CD. It's quite likely that Sony purchased the DRM from First4Internet. It's not obvious that Sony asked First4Internet to include a rootkit in the product that was delivered to Sony.

This is not a rootkit hidden in a DRM product, the rootkit *IS* the DRM product. There is no way sony did not know about this.

Re:My question:

[MiKM]

Even so, isn't Sony ethically (if not legally) obligated to ensure that the DRM protection doesn't violate a user's privacy? Surely Sony and every other company that uses DRM tests the DRM to ensure it doesn't either interfere with a computer's normal operations or create a major vulnerability. While it isn't a perfect example, it would be as if Ford bought car security systems from ACME corp that had a major vulnerability. While it is ACME corp's fault that the vulnerability exists, it is Ford's responsibility to make sure that the security system WORKS and has no backdoor or unreasonable vulnerability.

Re:My question:

[slavemowgli]

You can always sue. The real question is: will you win? And even though IANAL, I'd say you have a pretty good case here; if the EULA does not even *mention* any of this, then it probably constitutes an illegal act.

Re:My question:

[macstrat]

now i may be wring in how DRM works but wouldnt making a dupe of the disk in toast/converting to mp3 then burning to a new disk or something along those lines completly override any sort protection at all? especially when some of the ppl that actually buy the cd have macs, in which stuff like that for windows wont work?

Re:My question:

[Jackie_Chan_Fan]

abso-fucking-loot-ly

Re:My question:

[interiot]

Yeah, certainly "waa, he made me do it" isn't a reasonable legal defense. But it takes a somewhat large grain of salt to think that Sony intentionally included a rootkit on one of their CD's. Other posters are right though, any of the other scenarios are somewhat implausible as well.

Re:My question:

[John Hasler]

Besides, if Sony didn't know they were grossly negligent.

Re:My question:

[Anonymous Coward]

> It's beyond absurd that a company of Sony's size would allow a piece of software to appear on any of its products without Sony having tested the hell out of it first.

You never played Star Wars Galaxies, did you?

Re:My question:

[Anonymous Coward]

From the Cnet article about First4Internet, http://news.cnet.co.uk/digitalmusic/0,39029666,391 89658,00.htm>

First4Internet's XCP has been used previously on prerelease CDs only. Sony BMG is the first to commercially deploy XCP. First4Internet's other clients -- who include Universal Music Group, Warner Music Group and EMI -- are using XCP for prerelease material. Sony BMG expects that by the end of the year a substantial number of its US releases will employ either MediaMax or XCP.

The particular steps taken to conceal this and make it impossible for a non-professional to remove qualify clearly as a rootkit, although not perhaps as malware. The exposure of Sony customers' computers is also a concern - here's a ready-made shield for malware from whatever antivirus they might be running.

Re:My question:

[Anonymous Coward]

No, you can't sue. In fact, technically, you have to defend Sony. From the EULA for that particular CD:

You shall defend and hold the SONY BMG PARTIES harmless from and against any and all liabilities, damages, costs, expenses or losses arising out of your use of the LICENSED MATERIALS, your negligent or wrongful acts, your violation of any applicable laws or regulations, and/or your breach of any provision of this EULA.

A competent lawyer would be able to argue that your actions were negligent (you didn't know what you were doing when you deleted the hidden files; Mark Russinovich however did, if you read his article) and you attempted to violate laws and/or the EULA.

So let me rephrase my answer. You can sue them. You can sue them for whatever you want. You can sue Sony because your neighbor's kid is ugly if you want to go through the motions. But are you going to win a suit because you deleted files that Sony had installed on your machine without your knowledge, thus rendering your machine useless? Sadly, no, you're not.

So what can you do? You can refuse to buy Sony's music, and let them know why, and you can contribute to this type of behavior getting as much press as possible. Post links to this story on other people's blogs, some news organizations are monitoring various blogs.

Re:My question:

[EddWo]

It only works on Windows machines, but it appears to be designed to hook into all CDROM drives and monitor any CD Burning commands sent to them to prevent more than a fixed limited number of copies of itself being burnt from that machine, or ensuring that every burnt copy automatically includes the same DRM mechanism.

Re:My question:

[VGPowerlord]

Mod parent up. :D

Re:My question:

[FFFish]

If you truly are that gung-ho, then I shall send you twenty buck with which to purchase the CD. You can then do exactly as you describe.

Mind, that you aren't purchasing the CD yourself for the express purpose of following-through on what you've written, kinda indicates to me that I'll just be wasting my money. You won't start any lawsuits at all.

Re:My question:

[shibashaba]

It wouldn't protect Sony. It's up to Sony to later get damages from whomever sold the software to them if Sony does indeed have a case. Which I doubt, if I were a Judge/Jury I would expect Sony to pay attention to what the hell they're doing.

Re:My question:

[shaka999]

Yeah...sure ya would.

Re:My question:

[DoraLives]

Actually this is a major limited access high speed expressway to seriously fuck with Sony.

It'll go like this: Somebody out there with an axe to grind against Sony is going to lift this code intact, with no modifications, and marry it with a worm that goes around and infects peoples machines with some nasty or other that executes with a file that has a name beginning with $sys$ and cause some real trouble with it.

Net result, the infected folks are going to have a SERIOUS beef with Sony over the fact that the "invisible" file was able to install itself and run its merry course completely under the radar. All because of a piece of shit attempt by a fucked up Giant Corporation that was attempting to further line its pockets by installing some ... shall we say, hmm, unsavory code?

Ok script kiddies, you have your assignment. Now get to work!

Re:My question:

[Anonymous Coward]

Honestly, a lawsuit doesn't begin to go far enough. I want Sony company officers to get a$$-raped in prison.

Re:My question:

[Tet]

And nobody at Sony bothered to vet a piece of software that was destined to be shipped with millions of CDs?

How? If you've ever worked in a software engineering team, you'd know that the chances of a software tester even knowing what to look for are slim at best. They'd test that it performed as it was supposed to do ("Does it let me copy the CD? No. Looks good to me"). They won't have checked for unexpected side effects, and even had they done so, they almost certainly wouldn't have know the inner workings of Windows well enough to detect software like this. There's an argument for Sony's purchasing guys not doing sufficient due diligence before buying the product, but blaming the testers? That's just not really reasonable.

Re:My question:

[VENONA]

Sony is having financial troubles. "Sony is set to cut product lines as well as ditch non profitable categories in a move aimed at injecting profitability back into the ailing company. They are also investing in direct to consumer operations with new direct sell stores and online operations set to be launched." http://www.smarthousenews.com.au/ and cruise around, or Google 'sony restructure'. You can send mail to the band, or the corporation. I chose to mail The Register, as they have guys qualified to evaluate Win issues, and I'm a Unix guy. Maybe it would be best to keep an eye on major media. If and when confirmation comes in (which shouldn't be long at all), contact local media. What we don't need is for this to turn out to be less than 100% factual. No reflection on the author, but independent confirmation would seem to be indicated. We can't risk crying wolf about this. If it's confirmed, it will be all over the traditional wire services--Reuter's, API, UPI, etc. Nobody will touch it unless it *is* confirmed. I expect it will be. Once confirmed, *then make sure it's locally distributed*. It's not something we'd want missed by even small town media.

Re:My question:

[Thing 1]

I hereby offer $200 toward this goal.

Re:My question:

[Anonymous Coward]

The fact that a root-kit was installed on the computer to protect music shows that privacy now takes a second place seat to some one-else's property rights

Sony have no property rights here. "Intellectual property" is nothing more than a buzzword. Copyrights aren't property. Patents aren't property. Trademarks aren't property. They are all limited privileges granted by the government to further particular social goals.

Once you fall into the trap of thinking "intellectual property" is property, the ideas that it's Sony's choice how to manage "their property" spring naturally from it. Why do you think you hear the phrase being pushed so much? Don't help them in their goal by referring to copyright as "property rights". It's not true, it's never been true, and (hopefully) never will be true.

Re:My question:

[Shanep]

Besides, if Sony didn't know they were grossly negligent.

Yes, it is Sony's responsibility to know what they are shipping.

Re:My question:

[Anonymous Coward]

I wonder who is responsible when a virus named $sys$something.dll installs invisible to you and feeds off SONY's rootkit?

Re:My question:

[Shanep]

now i may be wring in how DRM works but wouldnt making a dupe of the disk in toast/converting to mp3 then burning to a new disk or something along those lines completly override any sort protection at all? especially when some of the ppl that actually buy the cd have macs, in which stuff like that for windows wont work?

Yep. I have never come across a DRM "protected" audio CD which was not very simple to get around. Copying or ripping it on anything that was not Windows was all that was needed. It only takes ONE person to do this and then put the mp3's up for download and ALL of that DRM effort and pissing off real customers was for NOTHING.

Even if they could make a CD DRM mechanism which worked, at the end of the day the CD must produce music at an analog output and it could be copied there as an absolute worst case.

The Copy Protection solution is really simple. Make the works affordable and very easy to obtain for the majority of people and they will buy them. There will always be at least a minority who will illegally copy them anywhere from single copies to bulk copies to be sold. Investigate and prosecute the bulk copiers. As long as the big corporations are hated, many people will continue to feel like it is ok to copy the works they sell. Putting rootkits on audio CD's, which are installed automatically without prompting, is a great way to keep people hating you and making MORE people hate you. Considering that many of the people who will be "infected" with these rootkits, will actually be genuine paying Sony customers.

Re:My question:

[philipgar]

IANAL, but I will say this, if it can be shown that Sony bought this software and knowingly used it despite the implications of what the software does, they should be forced to pay. I'm not talking about some petty fines, or suing, I'm talking far more. While multi-millions of dollars of fines for trespassing and intentional invasion of privacy without the consumers consent etc are just the starts. I could imagine if it's proven that some of the business managers or CEOs knew what the software does, and can be shown that they willingly invaded their customers privacy, and violated their computers, I think jailtime might be in order. It is illegal to enable a company to commit a crime with gross violations like this.

I'm sure this could drag on for years, but lets hope someone attacks them for this and hits them where it hurts. No media company has the rights to do this. Even if there was mention of it in the EULA, it's legality would be questionable, but without even that, this is a dangerous place for them to go.

If they want to use mafia tactics to stop them, lets use ant-mafia tactics to catch them. That involves not just stopping their intimidation of people, and stopping their illegal activities, but hitting their leaders, and stopping them.

Phil

Re:My question:

[deimtee]

It's too late for him to do it now. If he knows in advance what the CD will do to his system that would seriously weaken his case.
What this needs is some raging libertarian litigant to have run it and THEN find out about it.

Re:My question:

[earthforce_1]

Unless they have a CYA in the EULA, (and they probably do) like that used in spyware, adware and other "phone home" software. Which is why I would not let the kids install that ATRAK crap on the PC.

Ironically, I would actually feel safer downloading my music from Kazaa.

Re:My question:

[Anonymous Coward]

Yeah...sure ya would.

Why wouldn't he? Just because you're too much of a pussy to stand up for yourself doesn't mean that he is.

I'll be there are lawyers galore that'd jump on the chance to hit a nice liquidy (as in cash) company with a class action lawsuit, even if it only had a one in ten chance of winning.

Re:My question:

[trime]

Is that you Jack?

Re:My question:

[Thing 1]

Nope, and I was actually thinking an AC would respond with "say hi to Bubba for me" but this is not a contract, there's no way anyone can collect on this offer, and it's really similar to the blue ball on the first season of Drawn Together which talked about shooting the president.

Not from memory, because I'm somewhat anal about carrying my Palm and watching TV through a pausable medium:

Spanky Ham (Adam Carolla, he's got an amazing voice), to Princess: "Yeah but honey where you're from, inanimate objects spring to life and spew silly catch phrases."
Blue ball growns eyes and mouth: "What you talkin' about, Pig?"
Princess: "No, he's right blue ball, maybe I should just apologize."
Blue ball alone, caption "Fairytale Advisor": "Usually, Clara looks to us for advice. But this time it came from Spanky. It's a good thing, too, because I was going to tell her to shoot the president."
Ball and background turn red, camera turns and ominous music plays.

I rest on freedom of speech, and if that's not enough I've traced my IP address and you can find me at 127.0.0.1.

Re:My question:

[Superfarstucker]

Read the comments on mark's article, there is a post to a google cache link of some guy with an @first4internet address asking how to write a cd driver filter. http://66.249.93.104/search?q=cache:hDmbqX5yahgJ:w ww.osronline.com/showThread.cfm over 2 years old.

Re:My question:

[Grym]

The fact that a root-kit was installed on the computer to protect music shows that privacy now takes a second place seat to some one-else's property rights

Sony have no property rights here. "Intellectual property" is nothing more than a buzzword. Copyrights aren't property. Patents aren't property. Trademarks aren't property. They are all limited privileges granted by the government to further particular social goals.

And what's even MORE interesting (or confusing, take your pick) than that is that this program actually tresspasses and destroys consumers' very real physical property. The OP's statement could also be put as: Consumer property rights have taken back seat to corporate profits.

In which case, none of us should be surprised. Look how the supreme court ruled recently! You don't even have a right to your house if a company can make a profit by taking it away.

One of these days Americans are going to wake up and realize that their representatives are a pack of greedy whores. I wonder if it will be too late by then.

-Grym

Re:My question:

[mysidia]

Testing the hell out of a product doesn't automatically reveal every conceivable issue. Ever use a Windows/DOS-based operating system?

Remember the CIH virus, and how some PCs from a major manufacturer came pre-installed with it, and another major company accidentally included it in a firmware upgrade?

It may be deplorable for a manufacturer to not test the hell out of products and catch everything, but it's not absurd to suggest something slipped by -- because that sort of thing has happened many times before, and it will happen again --- unfortunately, sometimes very unlikely things get by through chance.

Re:My question:

[Anonymous Coward]

Has an EULA ever held up in court when it directly violates laws in some states?

Re:My question:

[magnanimous cowherd]

It is probably some hacker trying to get his root kit beta tested.

1. Create rootkit beta .0000001
2. Intercept prominent security researcher's Amazon shipment and instert rootkit
3. Your rootkit is tested and results are posted on the net
4. Sony gets the blame...um...er I mean PROFIT!


cowherd

Re:My question:

[proudhawk]

/Quote Honestly, I see this as a real exposure to a lawsuit. If I accidently install this rootkit on my system, then try to remove it (seeing as it looks like a genuine security breach) and then disable my computer, thus having to bring it in for service what then?. If a malware company uses the rootkits ability to hide $sys$ prefixed files and uses that to steal my identity, costing me thousands of dollars and hundreds of hours of time to get my identity back, can I sue? /quote Short answer: yes you can sue. A more involved answer: you can, but how much money have you got to spend on it? Remeber, sony is a very big monster. its going to take a few hits before it gets knocked down (took the state of New York 5 years to bring the suit into Federal court and get a judgement in the sony/disc jockey payola case).

Re:My question:

[Technician]

Simply put, if that had happened to me, I would have bought a new hard drive, reinstalled everything and then copied the data that I needed over, and then filed a product liability suit. I would claimed everything from illegal computer trespass, product liability, vandalism, and anything else that might have sounded half-way reasonable.

To prevent a loophole they may be able to wiggle through, I still stick to my simple principle. Look for the Compact Disk logo. No logo, no sale. Philips standard Compact Disks tm. do not have executible code.

The downside is unless you shop used music shops, there isn't much in the way of Compact Disks tm for sale anymore.

Re:My question:

[petermgreen]

drm for CDs relies on hiding itslef from the legitimate user of the PC so in a very real sense it relies on being a rootkit to function at all.

Re:My question:

[idlake]

And nobody at Sony bothered to vet a piece of software that was destined to be shipped with millions of CDs?

They did--by putting it on one of their releases. Releasing a single CD just isn't a big deal to these people. And it's done by the music division, which probably has even less experience with software than the rest of the company.

It's beyond absurd that a company of Sony's size would allow a piece of software to appear on any of its products without Sony having tested the hell out of it first.

From your remark, we must conclude that you have never owned a Sony camera, laptop, or PDA.

Re:My question:

[Anonymous Coward]

According to a comment from the bottom of TFA, First4Internet:

...were incorporated 24/11/1999. In 2004 they had a turnover of £709,941 and operating expenses of £1,301,546 -- meaning an operating loss of £591,605. In the last five years they have, on average, lost £541,067 a year. For 2004, their credit rating is "HIGH RISK" (complete with capitalisation). Meanwhile, the four directors share annual renumeration of £224,413 between them (average £56,103 each).

One of the directors, Nicholas Bingham, (appointed in 2002) was director of "Sony pictures home entertainment Ltd." from 1989 to 1997, and director of "Sony pictures television production UK Ltd." from 1996 to 2000, and director of "Sony digital radio europe Ltd." from 1994 to 2000.

A cynic might say Sony selected this inept copy protection technology because it was supplied by one of thier cronies. The reason this is a bad business practice can be seen by the software's many failings.

Re:My question:

[Krimszon]

As stated in the comments on the original article, first4internet is run by former Sony executives. Smells fishy...

Re:My question:

[Anonymous Coward]

I'm assuming this is a joke and that you understand the hideous ethical implications of what you are proposing.

Re:My question:

[nasta]

You can find more info about the root kit from F-Secures page: http://www.europe.f-secure.com/v-descs/xcp_drm.sht ml and a link to Sony to ask for tools to remove their DRM: http://cp.sonybmg.com/xcp/english/form8.html

--
Remove one sig.

Re:My question:

[Decker-Mage]

Which is one argument for having outside testers. I don't know about other testers but my testing platforms here are wired up like pinball machines complete down to system file and registry monitoring so installation of this software would be triggering alarms (and getting bounced when I reject the changes) all over the place and that's assuming that I'm running as the Administrator which is also another of my tests here. So, not only didn't they practice due diligence in the purchasing department, I'd argue that they didn't practice due diligence in their software engineering section either.

I don't call it them my torture chambers for nothing ;-).

Re:My question:

[logpoacher]

667 - Neighbour of the Beast? :-)

Re:My question:

[Decker-Mage]

The Copy Protection solution is really simple. Make the works affordable and very easy to obtain for the majority of people and they will buy them. And that's precisely what it comes down to, the consumer has to perceive value received at the particular price point. As it stands right now, consumers perceive that they are not receiving value for the particular price and turn to alternative methods to circumvent the price system. Here the price is paid in terms of possible financial and legal consequences as a result of their actions. If you lower the price, the consumer will stick with the legal methods. Unfortunately it seems too simple for the business types and apparently they were asleep during their classes in economics. I know that they don't teach this stuff over in business school as I had some serious knockdown dragout fights with their professors over their whenever they wandered over into the economics terrain.

Apple apparently gets it right now as they are doing very nicely indeed although that won't last if they music industry gets their way. They want to squeeze the consumer back out of that market and back into illegal downloads in order to extract as much profit as they can despite the fact that increasing the price-point will decrease overall profits. Their loss as they will find out. Why does this stuff have to be so hard for these id10ts to get? It's real simple.

Re:My question:

[Thalagyrt]

665.99: Retail price of the Beast. :-)

Re:My question:

[dswan69]

You only have yourself to blame if you buy products from the music mafia. They're no different to a corner drug dealer.

Re:My question:

[xouumalperxe]

had you RTFA, you'd have known that it is (sony's DRM)'s rootkit. (wow, pointer algebra in ENGLISH!)

Re:My question:

[jafuser]

And then Microsoft and others will jump in and trumpet the "benefits" of Trusted Computing as a way to "protect" people from things like this. And people will flock to it like a gas station in Florida.

Re:My question:

[Ibn al Arabi]

Sony started it, perhaps you should ask them about the hideous ethical implications of what they are doing?

Re:My question:

[froschmann]

I'll put up 100. That gives us 300... Any others?

In democratic america...

[Anonymous Coward]

corporations exploit YOU!

hrm, so much for humor. I don't find it funny at all :/

Re:In democratic america...

[conJunk]

damn... you know it's getting scary when the soviet russia joke is not only unfunny, but frightening....

i don my tinfoil hat and robe...

Re:In democratic america...

[Anonymous Coward]

i don my tinfoil hat and robe...

HARRRRRRRRRRR!!!

Re:In democratic america...

[nmb3000]

i don my tinfoil hat and robe...

Wow, a tinfoil hat and robe! When do the pants and underwear come in? :)

However when you said "hat and robe", my first thought was of Bloodninja's cyber adventures.

Re:In democratic america...

[caluml]

Or as Osama says: "I'm free - what about you?"

Re:In democratic america...

[IorDMUX]

damn... you know it's getting scary when the soviet russia joke is not only unfunny, but frightening....

... and "Insightful".

Re:In democratic america...

[Anonymous Coward]

and "Insightful"

amen to that

Re:In democratic america...

[Barterer]

This is where some idiot says "Yay Capitalism!" Yes, future idiot, rootkits are caused by capitalism.

Re:In democratic america...

[nmb3000]

corporations exploit YOU!

Insightful indeed.

The thing is that there is more than a corporation here. The artist that chose to sign with Sony is now going to feel the repercussions of this dirty little trick Sony tried to play. Do you think that Sony really cares if they loose a few sales of this one CD because they got caught red-handed? Of course not.

These record labels are not only exploiting the consumer, but they are screwing over the artists that depend on them for advertising and distribution. Here is contact information for Van Zant. Let them know that you're pissed. Let them know you won't be buying their CD. Let them know that they were screwed by Sony. While you're at it, why not let First4Internet know that you hate them and hope they burn in Hell for writing malware like this. A few thousand emails will do wonders for these jerks.

If enough artists move away from these corporate labels it can only mean good things for the consumers. It's not impossible for this to happen, just extremely difficult.

Re:In democratic america...

[Anonymous Coward]

man, remind me to *never* try to read the bloodninja shit at work, *ever* again

Re:In democratic america...

[Anonymous Coward]

When was it funny?

Re:In democratic america...

[netcrusher88]

...a few thousand emails will do wonders for these jerks.

Indeed. Do you think we could manage to slashdot Sony's mailserver?

Re:In democratic america...

[evil agent]

Yeah, screw this. I'm never buying another cd again! I hear there's this concept on the internet called "file-sharing." With this technology around, why would people risk buying these dangerous cds? That'll teach Sony.

Re:In democratic america...

[Anonymous Coward]

Excellent idea. I already submitted my email stating that I won't support the band (what's their name again?) anymore.

Re:In democratic america...

[Mister Transistor]

Wow, a tinfoil hat and robe! When do the pants and underwear come in?

They're not necessary! All I need is my trusty Ajax model Mountibank Lead Codpiece!

Re:In democratic america...

[Anonymous Coward]

congrats for catching the joke, you genius you!

Re:In democratic america...

[chrysrobyn]

In democratic America... corporations exploit YOU!

I've read two relevant quotes.

"Democracy is the theory that the people know what they want and deserve to get it good and hard."

"In communism, man exploits man. In capitalism, it's the other way around."

Re:In democratic america...

[Zobeid]

Wouldn't it be more productive to write to the US Dept. of Justice and urge them to open an investigation? They bust hackers who turn loose worms, they should be able to bust Sony for distributing trojan malware on their audio CDs. Putting a few Sony execs in a federal pen ought to *really* get the message across.

Re:In democratic america...

[Anonymous Coward]

Or you could just use Linux.

Re:In democratic america...

[Doppler00]

Naw, congress is too busy demonizing the oil industry because average joe can't afford gasoline for his 8 MPG SUV.

Seriously, does congress even understand the technology and the dirty tricks the media companies are doing? I mean, installing malware and destroying someone's operating system is NOT a good idea.

Re:In democratic america...

[ShieldW0lf]

Both systems give freedom with the one hand and take it away with the other. The difference is only which hand is doing which.

In soviet-style communism, the means of wealth production are commonly held and commonly shared. This is freedom, it protects the individual from being compelled to act against their will via threats of deprivation. However, that freedom is taken away by their totalitarian, non-representative political system where the laws, and thus control over common resources, are subject to the whim of the leader.

In american-style democracy, the political system is (somewhat) representative and transparent, and the population (via process) gets to be involved in the lawmaking and have certain freedoms. However, that freedom is then taken away by their capitalistic economy, which is structured to consolidate control over the means of production and communication into the hands of the few, keep it there, and place the rest of society in a position where they must obey or die of starvation and exposure. Contemplate the term "artifical scarcity" for a moment.

They both suck. They're both political-economic structures based around the few maintaining control over the masses without accountability. It was inevitable that they would have to be enemies and that they would have to heavily propagandise their population towards a blind negative reaction. If people ever actually stopped to think about it, they might realize that by pairing a communal economic structure with a democratic political structure they could finally stop being slaves living in fear. Dangerous stuff if you're the Master.

Re:In democratic america...

[Shanep]

While you're at it, why not let First4Internet know that you hate them and hope they burn in Hell for writing malware like this. A few thousand emails will do wonders for these jerks.

And while everyone is at that, why not consider moving the hell away from Microsoft? The software company which is "Insecure by default! Two weeks without a remote hole in the default install!". The company whose ridiculous defaults allow such security problems in the name of ease of use.

Re:In democratic america...

[Anonymous Coward]

idiotic:

yes he is really free...spending every second of every day worrying about being killed (and he is worried, no one actively hides)

just remember, osama is brainwashed by someone who really has a quest for power. so no, he isnt even free inside his own mine

Re:In democratic america...

[Srass]

Douglas Adams put it most succinctly: "People are a problem."

Re:In democratic america...

[DeadlyDonkey]

Congratulations Internet Detective! Through your supreme deductive skills and cunning intellect you have traced the source of this joke!

Re:In democratic america...

[Anonymous Coward]

"In communism, man exploits man. In capitalism, it's the other way around."
How about this one: "In communism, you are a slave of your goverment. In capitalism, you are a slave of your money" ?

Re:In democratic america...

[Anonymous Coward]

"In communism, man exploits man. In capitalism, it's the other way around."

Amazingly, you managed to write that backward. ;-)

Re:In democratic america...

[Anonymous Coward]

Or as Osama says: "I'm free - what about you?"

Yes, but is that free as in beer or as in speech?

Re:In democratic america...

[Anonymous Coward]

'lose' is spelled with only one O you polack asshole

Re:In democratic america...

[Alsee]

But that's the great thing about robes! You don't need to wear pants, much less underwear!

-

Re:In democratic america...

[windborne]

Aahh, I wish I had mod points so i could mod you up.

We in the scandinavian countries tried this. Unfortunately it's going the other way at the moment, less tranparency/democracy and less communal control of resources. It was good while it lasted...

Re:In democratic america...

[bobbuck]

"They both suck. They're both political-economic structures based around the few maintaining control over the masses without accountability."

Capitalism is about the the individuals. Even the biggest companies bend to the will of consumers. Look at rebates offered by Ford and GM. Do you think they want to discount their vehicles?

Democracy is just a means to an end. It's the only way to protect individual liberty. Pairing a 'communal structure' with a democratic political structure is a certain path to tyranny. The majority will democratically steer more resources to itself. The minority will be demonized to justify its deprivation.

It's pretty callous to say that Soviet style Communism is a type of freedom because individuals are not compelled to act against thier will by threats of deprivation! Starving to death is not a threat of deprivation???? Did you just forget that five million people were starved to death for political reasons? Get a history book!

Re:In democratic america...

[zooblethorpe]

damn... you know it's getting scary when the soviet russia joke is not only unfunny, but frightening....

Even worse is when the soviet russia joke is *accurate*. (8-(

Re:In democratic america...

[ShieldW0lf]

It's pretty callous to say that Soviet style Communism is a type of freedom because individuals are not compelled to act against thier will by threats of deprivation! Starving to death is not a threat of deprivation???? Did you just forget that five million people were starved to death for political reasons? Get a history book!

Yes. Exactly. A communist economy, which by its fundamental nature is structured to, if not share equally, at least ensure that the factories, farms etc, the means of production, are used to meet the basic needs of all its citizens. However, it was subverted by the totalitarian political structure and millions starved.

Now they're a capitalist democracy. Except that during this wonderful changeover, the "directors" of the various industries didn't step down, nor did they get replaced, they just became the wealthy directors of the now privately held corporations. No less power than before, and no less secure in their power than before, except now they don't even need to maintain a facade that they are interested in administering these resources in a socially responsible fashion. And the people continued to starve. They went to the streets with their life savings unable to afford bread. In one case, it was political power that was used to crush them, in the other, it was economic power. In both cases the people were crushed, and in both cases it was the same group at the top doing the crushing.

Oh, and democracy is about ensuring that the people at the top are leaders and not rulers. It's about trust. It's imperfect, highly flawed, just the best we've managed to put together so far. Despite the democracy, we still have rulers that we do not trust, and a structure that does not allow for their timely removal if they demonstrate themselves to be untrustworthy. It could be a whole lot more fluid, a whole lot more transparent, a whole lot easier to participate in, a whole lot better.

Re:In democratic america...

[Anonymous Coward]

"just remember, osama is brainwashed by someone who really has a quest for power. so no, he isnt even free inside his own mine"

Ahh, sounds like an average American voter, then!

Re:In democratic america...

[Anonymous Coward]

From what I heard on another forum (Mark's forum, I believe), the Van Zants are furious about this and want the DRM off their CDs. Official spokespeople for them say they will "meet with Sony to get this issue resolved", which I believe is professional-speak for "we're pissed at them" *heh*

--EmiOfBrie

as if

[scenestar]

DRM wasn't intrusive in the first place.

Unsafe software

[Anonymous Coward]

Crap, and now we can get viruses from our CD's, too.

and now with no liability

[jeremy111]

And let me guess, it offers you an EULA and exempts Sony from any liability for damages caused by this thing?

Re:and now with no liability

[redshadow01]

RTFA, the EULA does not mention this at all...the writer of the article made a specific point with respect to this.

Re:and now with no liability

[einhverfr]

IANAL....

Does this mean that we can sue Sony for computer tresspass?

What is the difference between this and any other back door used for unauthorized access?

Re:and now with no liability

[Anonymous Coward]

Article 7. DAMAGES ARISING OUT OF YOUR ACTIONS

You shall defend and hold the SONY BMG PARTIES harmless from and against any and all liabilities, damages, costs, expenses or losses arising out of your use of the LICENSED MATERIALS, your negligent or wrongful acts, your violation of any applicable laws or regulations, and/or your breach of any provision of this EULA.

Re:and now with no liability

[bleckywelcky]

1) Go out and buy crappy Sony music CD.
2) Play crappy Sony music CD on computer.
3) Crappy Sony music CD installs rootkit malware.
4) Sue Sony under computer laws?
5) Profit?

Re:and now with no liability

[FidelCatsro]

Even if the EULA were to be a valid contract (which it isn't in many places , and probably isn't in many others)
A contract can not exempt any party from an act which contravenes any current laws.
  To quote the UK Sale of goods act 2002

48A Introductory
 
    (1) This section applies if -
 
(a) the buyer deals as consumer or, in Scotland, there is a consumer contract in which the buyer is a consumer, and
 
(b) the goods do not conform to the contract of sale at the time of delivery.
 
    (2) If this section applies, the buyer has the right -
 
(a) under and in accordance with section 48B below, to require the seller to repair or replace the goods, or
 
(b) under and in accordance with section 48C below -
 
(i) to require the seller to reduce the purchase price of the goods to the buyer by an appropriate amount, or
 
(ii) to rescind the contract with regard to the goods in question.
 
    (3) For the purposes of subsection (1)(b) above goods which do not conform to the contract of sale at any time within the period of six months starting with the date on which the goods were delivered to the buyer must be taken not to have so conformed at that date.
 
    (4) Subsection (3) above does not apply if -
 
(a) it is established that the goods did so conform at that date;
 
(b) its application is incompatible with the nature of the goods or the nature of the lack of conformity.
 
    48B Repair or replacement of the goods
 
    (1) If section 48A above applies, the buyer may require the seller -
 
(a) to repair the goods, or
 
(b) to replace the goods.
 
    (2) If the buyer requires the seller to repair or replace the goods, the seller must -
 
(a) repair or, as the case may be, replace the goods within a reasonable time but without causing significant inconvenience to the buyer;
 
(b) bear any necessary costs incurred in doing so (including in particular the cost of any labour, materials or postage).
 
    (3) The buyer must not require the seller to repair or, as the case may be, replace the goods if that remedy is -
 
(a) impossible, or
 
(b) disproportionate in comparison to the other of those remedies, or
 
(c) disproportionate in comparison to an appropriate reduction in the purchase price under paragraph (a), or rescission under paragraph (b), of section 48C(1) below.
 
    (4) One remedy is disproportionate in comparison to the other if the one imposes costs on the seller which, in comparison to those imposed on him by the other, are unreasonable, taking into account -
 
(a) the value which the goods would have if they conformed to the contract of sale,
 
(b) the significance of the lack of conformity, and
 
(c) whether the other remedy could be effected without significant inconvenience to the buyer.
 
    (5) Any question as to what is a reasonable time or significant inconvenience is to be determined by reference to -
 
(a) the nature of the goods, and
 
(b) the purpose for which the goods were acquired.

Sony did not mention this at the point of sale and therefor would be liable for repair of the problem .. IANAL but this is my interpretation of this part of the act

Re:and now with no liability

[FidelCatsro]

I should have cross referenced that with other parts of the act

Other Amendments to 1982 Act
    12. - (1) In section 18(1) after the definition of "hire purchase agreement" there is inserted -
 
" "producer" means the manufacturer of goods, the importer of goods into the European Economic Area or any person purporting to be a producer by placing his name, trade mark or other distinctive sign on the goods;".
 
    (2) In section 18(1) after the definition of "redemption" there is inserted -
 
" "repair" means, in cases where there is a lack of conformity in goods for the purposes of this Act, to bring the goods into conformity with the contract.".
 
AMENDMENTS TO THE SUPPLY OF GOODS (IMPLIED TERMS)ACT 1973

And to invalidate the EULA

Additional implied terms in consumer cases
    3. - (1) Section 14 of the Sale of Goods Act 1979 is amended as follows.
 
    (2) After subsection (2C) insert -
 
    " (2D) If the buyer deals as consumer or, in Scotland, if a contract of sale is a consumer contract, the relevant circumstances mentioned in subsection (2A) above include any public statements on the specific characteristics of the goods made about them by the seller, the producer or his representative, particularly in advertising or on labelling.
 
    (2E) A public statement is not by virtue of subsection (2D) above a relevant circumstance for the purposes of subsection (2A) above in the case of a contract of sale, if the seller shows that -
 
(a) at the time the contract was made, he was not, and could not reasonably have been, aware of the statement,
 
(b) before the contract was made, the statement had been withdrawn in public or, to the extent that it contained anything which was incorrect or misleading, it had been corrected in public, or
 
(c) the decision to buy the goods could not have been influenced by the statement.
 
    (2F) Subsections (2D) and (2E) above do not prevent any public statement from being a relevant circumstance for the purposes of subsection (2A) above (whether or not the buyer deals as consumer or, in Scotland, whether or not the contract of sale is a consumer contract) if the statement would have been such a circumstance apart from those subsections.".

Statement 2d

Re:and now with no liability

[IdleTime]

Ahhh... But we are talking about good ol'e US of A here and they don't have any laws to protect people, only corporations. And in case you never have seen commercials on US TV, I can inform you that there are many many commercials for pure scams, commercials that are pure lies etc. 90% of all commercials here in USA would never have been allowed on TV in Europe.

Re:and now with no liability

[FidelCatsro]

I am not familiar with the US consumer rights act but to quote an amendment to the federal trade commission act

`(b) PROHIBITED ACTS-
`(1) The introduction into commerce, sale, offering for sale, or advertising for sale of a prerecorded digital music disc product which is mislabeled or falsely or deceptively advertised or invoiced, within the meaning of this section or any rules or regulations prescribed by the Commission pursuant to subsection (d), is unlawful and shall be deemed an unfair method of competition and an unfair and deceptive act or practice in commerce under section 5(a)(1).
 
`(2) Prior to the time a prerecorded digital music disc product is sold and delivered to the ultimate consumer, it shall be unlawful to remove or mutilate, or cause or participate in the removal or mutilation of, any label required by this section or any rules or regulations prescribed by the Commission pursuant to subsection (d) to be affixed to such prerecorded digital music disc product. Any person violating this subsection shall be deemed to have engaged in an unfair method of competition and an unfair and deceptive act or practice in commerce under this Act

and

(b) FAIR USE RESTORATION- Section 1201(c) of title 17, United States Code, is amended--
(1) in paragraph (1), by inserting before the period at the end the following: `and it is not a violation of this section to circumvent a technological measure in connection with access to, or the use of, a work if such circumvention does not result in an infringement of the copyright in the work'; and
(2) by adding at the end the following new paragraph:
`(5) It shall not be a violation of this title to manufacture, distribute, or make noninfringing use of a hardware or software product capable of enabling significant noninfringing use of a copyrighted work.'.

So perhaps it is illegal , You would need to prove that it is mislabelled .. of course IANAL and from a brief reading of the act this is the best I could find .It does not tell you about this software so it is perhaps mislabelled unless the notice of the copy protection counts .It would need to be tried in court

Re:and now with no liability

[CommiePuddin]

Congratulations, you just quoted the most useless part of every EULA ever.

You can't sign away your right to sue. Ever.

At least not in my state.

Re:and now with no liability

[ObsessiveMathsFreak]

You shall defend and hold the SONY BMG PARTIES harmless from and against any and all liabilities, damages, costs, expenses or losses arising out of your use of the LICENSED MATERIALS

Ahhh! But is the rootkit one of those licensed materials?

Re:and now with no liability

[Decker-Mage]

At least on Amazon.com (I have no idea about the CD case itself) it is advertised as a copy-protected CD and the copy-protection in this case is the DRM Rootkit so that protection is out methinks.

Re:and now with no liability

[FidelCatsro]

I wonder if there is any precedent about the description . To me just saying copy-protecttion is woefully inadequate and misrepresentative of its function beyond the pure face value .

Anti-spyware Bill

[AKAImBatman]

We *really* need to get a anti-spyware bill on the books. Something along the lines of, "It shall be a criminal offsense to install non-application software on any computer when the user has not been reasonably notified in advance and/or agreed to have the modifications made. This bill will be reevaluated for its effect in three years."

Anything running in the background, rootkits, and other forms of spyware (which generally rely on the user not knowing they're there) would immediately become illegal.

Re:Anti-spyware Bill

[conJunk]

It shall be a criminal offsense to install non-application software on any computer when the user has not been reasonably notified in advance and/or agreed to have the modifications made

i'm 100% with you, but what happens when the lawyers get their teeth into it? shall we define "non-application software"? what constituteds "agreed to"?

you and i can act like we know what that means, but we aren't lawyers... somehow (unless its brilliantly done) i can imagine certain big scary companies using charges under this hypothetical spyware act to intimidate competition

Re:Anti-spyware Bill

[Anonymous Coward]

yeah but in what nation?
how would the government of england enforce a law like this against a korean software firm rooting a guy's computer in the united states?

-GenTimJS

Re:Anti-spyware Bill

[emarkp]

We do. Or at least Washington state does.

Quick! If you live in WA:

1. Buy spyware CD
2. Sue Sony Corp. for $100,000
3. Profit!

Re:Anti-spyware Bill

[AKAImBatman]

shall we define "non-application software"?

The bill would actually need a definition of "application software" so that anything that doesn't meet that definition would be automatically covered. e.g. "Application Software refers to a self-contained program that is installed on the consumer's computer. To be considered self-contained, it must not modify the operating system to execute any software at any time other than when the user runs the software in question."

what constituteds "agreed to"?

The courts do. Considering the difficulties they've been giving to the click-through licensers, I'm perfectly okay with that.

Re:Anti-spyware Bill

[Anonymous Coward]

What about printer drivers, scanner control panels, sound panel replacements, stuff that makes the media keys work? The list could go on and on.

What is really needed is something that makes intent part of the law. I'm sure someone here who IAL can provide more details about this concept.

Re:Anti-spyware Bill

[Mephiska]

You know they'd just hide the consent for that in the EULA, which hardly anyone reads anyway.

Re:Anti-spyware Bill

[AKAImBatman]

That's where the "reasonably notified" comes in. The courts haven't been too happy about EULAs as they are. If you try to slide things past the consumer, the courts will find that the contract was misrepresented and hold the company accountable.

Re:Anti-spyware Bill

[Anonymous Coward]

We already HAVE laws on the books that make this illegal.
Stop creating new laws for actions that are already covered! Seriously you idiots, cut it out.
If I stuck a phaser in your face and demanded your wallet would that not be covered by exisitng armed assault and robbery laws? Of course it would be covered.
Amazon is nothing more than a MAIL ORDER CATALOG, it doesn't matter that it has a web interface.
Spyware is malfeasant intrusion, it doesn't matter that it's a video game and not a home security system.
Spam is trespass and harassment, it doesn't matter that it is delivered using SMTP.

I understand that computer professionals are some of the most silly, blinkered fools on the planet, but even they should be able to understand these ridiculously simple principles. Please stop this idiotic insanity.

Re:Anti-spyware Bill

[jrockway]

> anything running in the background

Like Apache or cron?

Re:Anti-spyware Bill

[maxwell demon]

updatedb (started by cron) feels very much like a local DoS attack ...

Re:Anti-spyware Bill

[AKAImBatman]

Normally I'd agree with you. Unfortunately, Spyware does not necessarily meet the definition of "malfeasant intrusion." (Whatever that means. I've never heard of such a law, nor do I see any public officials involved.) Every law I've seen only covers physical intrusions. Now there are laws against causing damage to your machine (which this rootkit obviously does), but those won't apply in all situations and can be hard to prove.

The point of an anti-spyware law is to extend the laws of intrusion to cover virtual presence as well as physical presence.

Re:Anti-spyware Bill

[Cromac]

It would be interesting to see if the CDs sold in Washington are different than those sold in other states. If they are and don't contain the rootkit in Wa that would seem to show a deliberate intent to distribute it to states that don't have such laws.

Re:Anti-spyware Bill

[AKAImBatman]

"It shall be a criminal offsense to install non-application software on any computer when the user has not been reasonably notified in advance and/or agreed to have the modifications made."

No, not like Apache or cron. (Especially since cron is part of the OS.)

Re:Anti-spyware Bill

[queenb**ch]

Problem #1 - Mr. Spyware Programmer in Nigeria where such things aren't illegal.

Problem #2 - Mr. Identity Theif in wierd 3rd world country where such things are illegal but are tactitly condoned by local authority as long as its not someone from their country

Problem #3 - Mr Corporate Lobbyist - RIAA & MPAA ring any bells????

Problem #4 - Your privacy has been dead for decades. The sad part is that people are just now starting to smell the rotting corpse.

Passing a bill here in the USA will only do what CAN-SPAM did - drive them off shore to less regulated places. What's really needed is the ability to establish peering points that co-incide with national borders. Then we can pass a law that says that if we don't like your data integrity laws, we don't pass traffic to/from you.

See if that doesn't actually accomplish what you're looking for.

2 cents,

Queen B

Re:Anti-spyware Bill

[Jackie_Chan_Fan]

You cant really say "non application" because in a court, lawyers would just argue that it is an application or part of the application.

how about "no company shall install any program that breaches the security of a computer in any manner the user is not made fully aware of"

hahah yeah right ;)

Its a tough one. Certainly it should be illegal to install backdoors in software. (if it isnt already)

Re:Anti-spyware Bill

[theguyfromsaturn]

Sony is one of the scariest companies of all. They are worse, much worse than even MS. Since I have seen some of their buisness practices I make a point of not buying any Sony product. You know from the start that they weill hyperDRM anything you buy from them, and I always make the assumption that I very lilkely will lose ownership or access (or both ) of anything I could produce using their products, or any copyrighted material that I may legally obtain. It 's the safest approach, although I'm sure they are not alone. Only the very worst offenders.

Re:Anti-spyware Bill

[whoever57]

Corrected version:
1. Buy spyware CD
2. Join class action lawsuit
3. Get $5 off next CD voucher
4 (valid only for lawyers): collect $$$M

Re:Anti-spyware Bill

[ArbitraryConstant]

Large companies like Sony don't have the freedom to opperate completely outside a country like that. They'll have a large portion of their assets in a country like the US.

Re:Anti-spyware Bill

[Anonymous Coward]

Sure such a law won't cure everything, but I'd love to see the *AA driven out of our country.

Re:Anti-spyware Bill

[MightyMartian]

Alternate route:
1. Buy spyware CD
2. Join class action lawsuit
3. Congress makes installing root kits on computers by Sony legal as part of omnibus NASA Barn Building and Stamp Price Commuter Shipping and Lawn Bowling Act.
4. (valid for crooked politicians only): Profit!

Re:Anti-spyware Bill

[d34thm0nk3y]

4 (valid only for lawyers): collect $$$M

as long as those $$$Ms come out of Sony's pocket maybe it will make them think twice next time...

Re:Anti-spyware Bill

[Anonymous Coward]

In my country (Italy) there's a bill which, since its initial writing, estabilishes a very foundamental notion.
For your reference, it's bill 547-93 (n 547 dated 23 december 1993).
With its articles n 615ter/quater/quinquies, it estabilishes the concept that your computer is your "informatic domicile", in toto equal to the civic domicile (your home).
In that way, you can easily understand that a domicile violation is just a crime.

Summarizing, it also defines the violations to "a system protected with adeguate security measures", and their prosecution.

Under many other aspects, this bill is still old and modifiable, but clearly it has some very good points (like the above).

I also think it would be silly to emanate bills which say "do not install this if user doesn't want" and such.
Always remembers there's lots of lusers around here who just doesn't have any tech knowledge of what runs in their own computer.
Just define which is property and what can be done with it, and you're done.

Re:Anti-spyware Bill

[pluggo]

I couldn't agree more. However, this is one of the rare cases where I would actually encourage *more* vague wording in this legislation.

I'd like to see a bill that requires software vendors to provide on demand a human-readable description of the actions that software is taking. This wouldn't be much of a problem for the open-source community, but it would stick in the craw of every company that releases black-box binaries that are opaque to anyone but those few who have the skill/patience/time to use a debugger/disassembler. It doesn't need to be source code, but the actions the software takes should be documented in enough detail to reveal security flaws and hidden functionality. This would be extremely helpful as our society as a whole is becoming more and more dependent upon not only the software we run ourselves, but that run by others.

Also, on a slightly-off-topic note, I like the part about re-evaluation after an introductory period. I think a lot of ridiculous laws would come off the books if there was a mandatory periodic review.

Re:Anti-spyware Bill

[iMaple]

To be considered self-contained, it must not modify the operating system to execute any software at any time other than when the user runs the software in question.

Which would require you to define OS. For example, since MS has claimed that IE is (an indeipensible ?) part of the OS a skin (theme) changer could be considered malware . My point is , the bill is necessary but it cant be just one small paragraph .. expect something like lots of pages of jargon, which noone who votes on it will grasp.

Re:Anti-spyware Bill

[Anonymous Coward]

What about drivers? They're loaded a bootup by the operating system and are executeable code. What about other services that need to start automatically? Your definition of "Application Software" needs to be thought through a little more.

You could define spyware/rootkits as "additional executeable programs that do not contribute to the advertised function of the main application". i.e., something that's sneaky. Of course, it needs to be legalesed up a bit.

Re:Anti-spyware Bill

[cyberformer]

Problem #5: Program forces users t0 click through a 100,000-word EULA that its authors claim constitutes "reasonable notification". I imagine this would be Sony's defence.

Re:Anti-spyware Bill

[Anonymous Coward]

Exactly! Plenty of perfectly legimate software uses the exact same techniques as this rootkit does including the tools the author of TFA used to track it down. No prohibition based on soley programming techniques or a technical definition is going to work.

(somebody mod the parent up)

Re:Anti-spyware Bill

[jcuervo]

No, not like Apache or cron. (Especially since cron is part of the OS.)

Eh? Cron runs in user space. If it was in kernel space, like khttpd, it'd be part of the OS.

Or did you mean "standard utilities that usually come with the OS"?

Re:Anti-spyware Bill

[Anonymous Coward]

Maybe if the two of you had applied better reading comprehension when you read the original post, you might realize why neither of you got mod points for your reactionist nonsense.

Re:Anti-spyware Bill

[AKAImBatman]

Or did you mean "standard utilities that usually come with the OS"?

Precisely. The user agreed to install the complete OS, knowing the details of what was getting installed on his system. Thus cron and anything else that comes with the OS is not bound by such a law. Nor is anything you explicitly install. (e.g. Apache) Now if I sent you a cool recompile of Doom, but also included a secret installer for "cron", THEN I would get in huge trouble for installing cron on your computer.

Re:Anti-spyware Bill

[DieByWire]

Cringely had a suggestion a year or two ago that all software have a label that describes the software's behavior - a 'Truth in Labeling' for software.

He pointed out that before standard nutrition labels were required on food, no one had a clue about what they were getting. (Now they do, they just don't care.)

His suggestion was to have a similar scheme that had several basic catagories along with a simple warning icon for each behavior. The idea was to make it simple enough so that a consumer who cared could look at the label and see 'Oh, it checks for updates' versus 'Oh, it phones home with my serial number' versus 'It tells people where I've been surfing.'

It seemed pretty well thought out to me, but alas, I can't find it on google right now. I leave it as an exercise for another reader....

Re:Anti-spyware Bill

[Anonymous Coward]

Maybe you could be a little more explicit about what point you think was missed?

I don't see how an anti-spyware bill as described above would help in this case.

I think it was this wording that prompted the "reactionist nonsense":

"It shall be a criminal offsense to install non-application software on any computer when the user has not been reasonably notified in advance and/or agreed to have the modifications made. This bill will be reevaluated for its effect in three years."

How do you define non-application software? How you you define reasonable notification? Now I'd agree that it's probably possible in principle to define these things in a way that makes sense. But I think maybe there's a point here that you're missing here, which is that a lot of software does these kinds of things (plenty of examples are mentioned in other replies) so all a law like this would do is add several paragraphs to EULAs that nobody reads or understands anyway. This language would exist in both spyware and in legimate software.

The real problem here is that the software is doing things that the user doesn't expect, and for reasons that don't have anything to do with the software's normal functioning.

So i still think that any laws that simply say "you can't do this without permission" aren't going to work. What is necessary is to put some kind of intent into the law so that bad software like this can't just get around it by burying technical jargon in a EULA.

The question is, what really distinguishes spyware that uses these techniques from perfectly legimate software that uses these techniques? The answer isn't just that one tells you what it's doing and the other doesn't. Some spyware tells you exactly what it's doing in the EULA, but it gets installed anyway.

The difference is why they use these techniques. "Good" software use the techniques because they are requred for their normal functioning. "Bad" software uses them in order to make it difficult to remove, to hide it's activities, etc. The difference comes down to intent.

Re:Anti-spyware Bill

[Anonymous Coward]

How do you define non-application software? How you you define reasonable notification?

Non-application software is always an important definition (which he did define a few posts up), but the reasonable notification? I'm sorry, if you explicity install print drivers, knowing that they are print drivers, then what court is going to hold the manufacturer of the print drivers responsible for the fact that you installed print drivers? The key is that user _agreed_ to install print drivers, so this law wouldn't apply.

What is necessary is to put some kind of intent into the law so that bad software like this can't just get around it by burying technical jargon in a EULA.

Several other posters have mentioned that EULAs aren't being found to be enforcable by the courts. Even if the EULA is enforcable, then this law becomes impotent. None of this "Oh, noes! No one can install any print drivers!"

As I said, if the geniuses had paid better attention, they would have caught this.

Re:Anti-spyware Bill

[jrockway]

Actually, cron is part of the OS. The OS is UNIX. The kernel is BSD/Linux/Hurd/etc. If you don't have cron, it's not UNIX.

Re:Anti-spyware Bill

[Shanep]

hall we define "non-application software"?

The bill would actually need a definition of "application software" so that anything that doesn't meet that definition would be automatically covered.

And we might have to watch out for the difference between:

"non-application software"

and

"non application-software"

My mothers hair-curling iron might be considered non application-software.

; )

Re:Anti-spyware Bill

[Anonymous Coward]

Problem #5: Program forces users t0 click through a 100,000-word EULA that its authors claim constitutes "reasonable notification". I imagine this would be Sony's defence.

I was once a Citibank customer. EVERY SINGLE TIME I logged into their online banking, I would have to wade through tons of pages of agreement. I'd press and hold PGDN and then wait for SECONDS! Which I consider a very long time when you consider that the pages are flashing past at incredible speed.

How can they expect anyone to read that? Do they expect everyone to read it each time they log in, in case something changes? My session will TIME OUT! If I read it this session, it times out so I log back in, will I be covered by the fact that I don't read it the next time, for fear of it timing out again?

Are there any lawyers out there who write shit like that and recommend such ridiculous use, see how ridiculous it is?

Re:Anti-spyware Bill

[enjahova]

What's really needed is the ability to establish peering points that co-incide with national borders. Then we can pass a law that says that if we don't like your data integrity laws, we don't pass traffic to/from you.

I dont know if I am reading this right, but doesn't this make stuffing the DMCA and other crap down the rest of the worlds throats even easier? Who knows, maybe this is the way we are heading, but for the good of the internet I am not sure what is best.

I think national borders on the internet are a trend that governments seem to want (look at China). I havn't put much thought into it but taken to an extreme where you can just cut off countries does not sound like a good idea.

Re:Anti-spyware Bill

[Grym]

Makes me miss the good old days when ??? was one of the steps.

Re:Anti-spyware Bill

[senatorpjt]

What part of getting $5 off a $16 CD did you miss?

These class-action lawsuits usually end up with "penalties" that just end up giving them more money.

Re:Anti-spyware Bill

[BACbKA]

"no company shall install any program that breaches the security of a computer in any manner the user is not made fully aware of"

First, does SONY install the program? Or does it cause it to be installed by you? or by your OS? Second, what do you think about programs with unintentional security bugs? If your company distributed a software which later is found to contain a security bug and a worm is released to exploit it, are you liable under your proposed anti-spyware bill? Doesn't this ring familiar of the security liability proposed legislation discussions? and while we're remembering those, the free software should not be forgotten in your proposal as well.

Re:Anti-spyware Bill

[Jackie_Chan_Fan]

No i agree, it was far too much of an open ended statement. Thats why i said "Yeah right" :)

The point being its quite hard to word it in any really effective way.

Re:Anti-spyware Bill

[CaptainFork]

"It shall be a criminal offsense to install non-application software on any computer when the user has not been reasonably notified in advance and/or agreed to have the modifications made. This bill will be reevaluated for its effect in three years."

It should apply to any software, not just "non-application software", since applications could have built-in malware functionality.

The correct model is the "ingredients" box on food (in the UK at least): if food contains cyanide, it must say so in the ingredients box where even a person of moderately below average intelligence can find and understand it. So we're looking at a "what this software will do" box. It should appear on the machine in a GUI-based message box (because that's what most people understand). It should be seperate and distinct from the EULA (which no-one reads). It should indicate the following items and include "confirm"/"cancel" buttons.

- Network connections: one of "Does not communicate with other computers", "Communicates with other computers when requested by the user", "Communicates with other computers automatically"

- Uninstallation: "May be un-installed" or "May not be un-installed"

- Execution: "Runs when requested by the user", "Runs automatically"

These are inspired by the current story; there are probably others. The point is that this makes it easy for even inexperienced users to make the informed choice. Any comany or individual who installs software on someone's machine without this message box, or puts incorrect details in it can easily be made liable in various ways.

Re:Anti-spyware Bill

[ObsessiveMathsFreak]

Unless the company has buckets of cash and red hot rabid technobabbling lawyers. Then, you know, the judge will agree to just about anything. Doubly so if they're in the Supreme Court.

Re:Anti-spyware Bill

[xouumalperxe]

the rootkit in question (possibly all rootkits? nit my area of expertise) is installed at the driver layer. LOTS of software installs parts of itself at the driver layer, including some parts of some raytracing/computer generated imagery programs, and do so legitimately. Neither counts as self contained. As always, the question is: do you want to catch all villains and some innocents in between, or do you want to make sure no innocents are caught, and let some villains slip?

Re:Anti-spyware Bill

[AKAImBatman]

I don't understand why it's so difficult for people to grasp the wording.

Does your raytracing program explain in detail that it will install drivers? Do you explicitly agree to having those drivers installed? Yes? Then there's no problem.

The only problem is if your raytracing program wants to install drivers but doesn't tell you that it's going to do so. Then it would fall afoul of the proposed law. Personally, I think that's a good thing. There's way too much crap out there that I simply wouldn't install if I knew it was going to mess with my computer. RealPlayer is a great example. Another example is the Battle for Moscow game I installed. (There was no warning whatsoever that it would install a crapload of spyware. Took me a good half-hour to eradicate all of it.) iTunes would have to be properly labeled. Etc, etc, etc.

If we're lucky, such a law might even convince providers to stop adding their "oh so useful" (but not in actuality) icon to the system tray.

Re:Anti-spyware Bill

[ilyanep]

oooh I like that idea.

I wonder how long (and I'm dead serious here, not sarcastic) it'll take the other countries to capitulate.

Re:Anti-spyware Bill

[Pakaran2]

SUre. But they can contract with someone there, and claim to have no idea about this "extra rootkit code" the contractor added.

What is it exactly?

[realbadjuju]

I RTFA (submitted it too, not fast enough) and honestly it goes way over my head. Is it actually a root kit, ie can Sony or Sony's adgents (in a legal sense, not a black helicopters sense) push arbitrary code onto the machine and have it executed?

Re:What is it exactly?

[networkBoy]

If it walks like a duck, talks like a duck, and looks like a duck, then it is a duck.

How's that for an answer? Any security pro I know would call this a rootkit.
-nB

Re:What is it exactly?

[RingDev]

Being a root kit just means that the program works at the OS level, USUALLY in such a way that the end user will not notice it, nor will virus detectors flag it. It changes something about "Windows" as opposed to adding something to it. (over simplified)

The arbitrary code in this case is installed when you hit 'OK'.

-Rick

Re:What is it exactly?

[abscondment]

You're confusing the terms "rootkit" and "trojan"/"backdoor".

A trojan in its strictest sense tricks a user into executing one set of code when they think they're executing another. A backdoor simply allows remote execution of arbitrary code.

A rootkit is usually the set of tools that an attacker deploys on a compromised system. "rootkits" in the terms of this article are programs that trick your kernel into doing things it shouldn't do. This could include a trojan or a backdoor, but not necessarily.

Sony's program is a rootkit because it runs without authorization from the CD and alters the Windows API in order to disguise itself. As far as the article indicates, it doesn't include the ability for Sony to execute code on your machine. It's still dirty and sinister, if you ask me. It also allows any other malicious attackers to conceal anything they plant on your machine - simply by prefixing any file name with $sys$ - that's not cool!

Re:What is it exactly?

[realbadjuju]

Thanks for clreaing that up.

Re:What is it exactly?

[sakusha]

You obviously didn't read the article very closely. Sony patched the CD/DVD drivers, Sony's code runs every time you access the drive. He didn't disassemble the entire driver so there is no clear indication that it doesn't contain security problems (whether by incompetence like a buffer overflow, or a deliberate backdoor) that would allow arbitrary code to run. There is no way to audit the code for security, it is probably illegal under the DMCA to disassemble and fully analyze DRM code in sufficient detail for a full code audit
THAT is the biggest problem with these windoze DRM hacks. You can secure your system with all the technology at your disposal, but it means nothing when you are tricked into running a rootkit disguised as DRM. Then you have to trust the DRM vendor did not make any mistakes that expose you to further security risks.

People like to gripe about Apple's DRM, but at least they know better than to pull crap like this.

Re:What is it exactly?

[abscondment]

I guess may language was a little unclear. What I meant to say was that that article gave no indication that a backdoor had been found, not that it implied no backdoor existed. Of course, that's what happens when you submit without proofreading.

Hopefully some legislation will send DRM methods like this into illegal-ville. We'll see... until then, I'm certainly not putting new CDs anywhere near a windows installation.

Re:What is it exactly?

[John Hasler]

There is no way to audit the code for security, it is probably illegal under the DMCA to disassemble and fully analyze DRM code in sufficient detail for a full code audit

You really ought to actually read the DMCA some time. There is a specific exemption for this sort of thing.

Re:What is it exactly?

[sakusha]

Yes, I've read the DMCA. The specific clause about security testing is rather vague. It allows security testing, but only up to a point of "infringement" (whatever that means). This hasn't been tested in court AFAIK but even prominent security researchers are afraid of it. The way I read it (IANAL) is that you can security test it up to the point where you disassemble it enough to discover how to break the DRM, and ANY code audit that could find security holes would cross that line.

Re:What is it exactly?

[carlmenezes]

So they patched the drivers. Strong case for Linux if you ask me. The thing is, in Windows world, people tend to just make themselves administrators of their own systems and they end up using the computer on an admin account - heck, Windows Xp Home does that by defult.

Contrast this with the Linux way of doing things - nobody in their right mind uses a root account as their usual login. Forget about the fact that Linux still has such a small user base compared to Windows that developing a patch for drivers itself might not seem feasible to a company like Sony.

Move to Linux. Use only GPL stuff. Then see how difficult that makes it for a company like Sony to harm your system.

Re:What is it exactly?

[Overzeetop]

I was under the impression that the code was installed when you forgot to hold down the shift key. "tacit approval via convenience"

Re:What is it exactly?

[klui]

In this case, anti-virus software found it. This was posted on August, a bit before Mark posted his article. http://castlecops.com/postp611852.html

Re:What is it exactly?

[klui]

Oops, not anti-virus software, but Zone Alarm Pro...

Re:What is it exactly?

[RingDev]

Yeah, as root kits are becoming more popular, you'll see more antivirus companies looking into detecting and repairing the damage. Hopfully the writer of that article is employed by such a company, a lot of the steps he took manually could be automated, but if those processes were combined with the symantic/mcafee data stores it could drasticly improve our ability to detect and remove root kits quickly.

-Rick

Re:What is it exactly?

[Anonymous Coward]

Enhanced Audio CD Installer v1.1.434
Thank you installing The Enhanced Audio CD player allowing you to get the full benefit of the audio on this cd.

Please enter your root password to continue:

Re:What is it exactly?

[John Hasler]

> Yes, I've read the DMCA. The specific clause about security testing
> is rather vague. It allows security testing, but only up to a point
> of "infringement" (whatever that means).

It's perfectly clear what it means. It means infringement of the copyright on the protected material. There's no way studying this "rootkit" stuff would do so. In fact, I doubt that the rootkit stuff qualifies as DRM at all.

RootKits coming out in bundles?

[cwtrex]

I'm downloading RootkitRevealer now. I wonder how long it is going to take for Norton and McAfee to upgrade their Rootkit detection abilities? Next years anti-virus release? The last rootkit that Norton found on a computer at work was well spread and had been out for 6 months. It still was unable to remove/fix the infection. :(

Re:RootKits coming out in bundles?

[Flower]

This was semmingly bought by Sony from a 3rd party to protect their DRM scheme. My bet is no AV company is going to try and detect it or remove it as it is a "legitimate program." What's funny (well sick funny but still funny) is I could see First4Internet trying to sue anyone for labeling their software as malware and then trying to remove it. Not like that isn't the first time that's happened.

Re:RootKits coming out in bundles?

[Anonymous Coward]

That's what you get for using closed source software.
I KISS YOU

Re:RootKits coming out in bundles?

[Al Dimond]

I know you're more a troll than anything, but as a GNU/Linux user that cares very much about Free Software, I've gotta respond to that. If everyone ran open source Unices and ran as non-priviledged users and used that "I don't automount my /boot partition but keep a dummy /boot when it's not mounted" trick (to prevent kernel image from being overwritten), there still would be scads of users that would have autorun enabled and give their root passwords out like candy on Halloween. As a fairly technologically informed type, I try to never say OK to an install I don't understand. But even sometimes I have to just trust Portage, and for someone that doesn't know much about computers such a policy would mean they'd be using a typewriter.

Re:RootKits coming out in bundles?

[jrockway]

If a user has the ability to overwrite /boot, then he probably has the ability to "mount /boot" and defeat your little scheme there. A better solution is to keep your kernel image (and modules!) on a CD-ROM (read-only being the operative words) and boot from that. But then again, there's nothing stopping an attacker from getting root and loading a rootkit module, or installing grub on your hard drive and bypassing your CD-ROM without you even knowing.

Once someone has root on your system, your computer is compromised. Completely.

Re:RootKits coming out in bundles?

[Al Dimond]

Yeah, that was pretty much my point too. A trick like that (which I believe is default in Gentoo, at least) may sound clever but it's no help in general against malware running as root. That said, if the malware isn't expecting it, it might cause it to fail; similarly, a rootkit can hide something from detection software it knows about. If you have unique or uncommon detection software you could still see it.

Another potential approach: root is a user, and only has as many priviledges as the kernel gives it. A kernel could be written that simply denies overwrites of certain protected files and memory regions without specific, specialized hardware confirmation (think a red button on your case). This, of course, requires specialized hardware. Or maybe the power button can be used (I think the power button is typically handled by ACPI stuff), unless that can be faked somehow. Of course, all is powerless against a local malicious user with a screwdriver/blowtorch.

OS's fault

[aachrisg]

Microsfot needs to make it completely impossible for any software to do something like this unless the user runs in some special maintenance mode or logs in as some special account. They can make an exception for windows updates which are signed by them.

Re:OS's fault

[redshadow01]

Yeah, that's called "Trusted Computing"...where Microsloth decides what you can and can't run...

Re:OS's fault

[LLuthor]

These kind of changes can only be made with changes to the driver model.

They can't make it impossible to do this kind of thing on 32-bit versions of Windows (without breaking A LOT of drivers and programs), but on all 64-bit Windows versions this is already impossible.

Re:OS's fault

[Trillan]

It could be done without breaking many programs by having certain APIs invoke a privlege escalation warning; a lot like XP's firewall.

Re:OS's fault

[EmperorKagato]

Which could also mean that Sony could go to Microsoft and ask this feature to be installed with a Windows Update.

Re:OS's fault

[speeDDemon (nw)]

Trusted Computing...

I think this lil video on Trusted Computing is perfect at explaining trusted computing.

I leave it running on the computers on display in my store. Hopeing that I can educate enough people in my small section of the world about the follies they are about to embark on.

Re:OS's fault

[dtfinch]

They at least ought to turn off the seriously insecure by design autorun feature by default.

Re:OS's fault

[Anonymous Coward]

Yes, and I'm sure Microsoft won't sign Sony's code, right?. Microsoft is totally against predatory practices like this, right?

Have you any idea about the hidden data Microsoft keeps on your windows machine right now?

Heh, don't worry, on Windows Vista you'll never see this thing happening. DRM will make it impossible for you to discover corporate rootkits. Enjoy your privacy.

Re:OS's fault

[hal9000(jr)]

Easy, Don't run as ADMINISTRATOR. Run as a regular user!!!!!!!

Come on, man. It's 2006 already

Re:OS's fault

[aachrisg]

doing this causes problems for normal users. Microsoft needs to make a mode which is more secure than administrator (no allowing modifying the function dispatch tables for OS calls for instance), but still allows installing and running software which falls short of this.

Re:OS's fault

[werelord]

Yes, it can be the OS's fault, but don't solely blame Microsoft.. Rootkits have been around for a long while; Unix and Linux are far from exempt from this..

Re:OS's fault

[judas6000]

Doing this can cause major problems for a lot of software. For whatever reaon, be it Microsoft's or 3rd party software developers many applications seem to require admin access rights to run or install. Some of EA's games spring immediately to mind.

Re:OS's fault

[sulli]

Exactly. Also, never autorun CDs.

Re:OS's fault

[PsychicX]

I will direct you to this article:
Kernel-mode drivers that extend or replace kernel services through undocumented means (such as hooking the system service tables) can interfere with other software and affect the stability of the operating system. For x86-based systems, Microsoft discourages such practices but does not prevent them programmatically, because doing so would break compatibility for a significant amount of released software. A similar base of released software does not exist for x64-based systems, so it is possible to add this level of protection to the kernel without breaking compatibility.

As usual, it's the bane of all software corporations today -- legacy crap that some programmer shat out in his sleep.

Re:OS's fault

[Anonymous Coward]

And then rootkits would be 'signed' by MS as well, the people who write these rootkits would have little trouble doing that (technically and morally).
  The problem on windows is that every user is a superuser. Have you ever tried using a regular user account? Unless you greatly restrict what kind of software you use, it's not an option. I tried setting up user accounts for my family, they couldn't play games and a lot of other 'simple' things (the game in particular was one of The Sims variants). There are *huge* design issues in windows, like changing the desktop image requires access to the same controls that control all the screen (changing resolution, etc).
  I hope Vista sandboxes old software, so that finally user accounts are feasible in windows. It'd probably break things a bit, like games needing to be installed in every user account possibly, but with some automagic handling that would be somewhat avoidable. Still, it's MS, why would they do the right thing?

Re:OS's fault

[Anonymous Coward]

I've heard of people who put clocks ahead 10 minutes or so, but 2 months? Yikes...

Re:OS's fault

[PintoPiman]

Easy, Don't run as ADMINISTRATOR. Run as a regular user!!!!!!! Come on, man. It's 2006 already

1. It's not 2006. =)
2. *nix types have had admin and least-rights users for decades.
3. MS could make this easier by allowing "sudo" style escalation like OS X and Ubuntu do. As it stands now, commercial software frequently creates problems for users who are doing the right thing and running as least-rights users.

~p

Re:OS's fault

[Anonymous Coward]

Easy, Don't run as ADMINISTRATOR. Run as a regular user!!!!!!!

Don't talk to me, talk to the programmers at major software companies.

Come on, man. It's 2006 already

2006? Boy, am I behind the times.

Re:OS's fault

[dcam]

Or flash drives. To disable:
http://www.mcse.ms/message1698818.html

Re:OS's fault

[Intrinsic]

I agree, accept the only problem is some programs require administrator rights to run, like Half-life 2. Its complete bs..

Re:OS's fault

[Anonymous Coward]

3. MS could make this easier by allowing "sudo" style escalation like OS X and Ubuntu do.

They do. It's called the runas command (CLI) or its equivalent "Run As..." command (GUI) in an executable's context menu.

Login as limited access, then use that for any programs that give you trouble, such as games, proxies, and some CD burners or antivirus apps. You can also create a shortcut that automatically prompts you to login to run. And MS Office even automatically prompts you to login when you insert the CD to install.

MS has gotten much better about this, it's the other application developers that are holding them up.

Re:OS's fault

[cheekyboy]

No, talk to their managers, as they decide which 'features' or 'bugs' get priority and attention.

Re:OS's fault

[value_added]

Easy, Don't run as ADMINISTRATOR. Run as a regular user!!!!!!!

And how in this case is running as a regular user with administrative privileges (a member of the "Administrators Group") different than running under the "Administrator" account? I doubt many Windows have ever logged onto the Administrator account or know what it is; IIRC a standard click-and-point install creates a user account that is a member of the Administrator Group. Seems to me that kind of account is as regular as any other account.

Perhaps you meant run under an account that is a member of the Users Group? That kind of account is also regular, but does have limited privileges. Regular use of a such an account would be advisable, if it weren't for the discussed-to-death problems of installing and running Windows programs that require administrative privileges. Among other things.

Come on, man. It's 2006 already

I'll say. This same vaguely inaccurate information keeps appearing on /. with little notice.

Re:OS's fault

[Antique Geekmeister]

No, "Trusted Computing" is not designed to prevent this. It is designed to *enforce* it. By having an appropriately signed application, required to access appropriately signed and controlled hardware such as your CD or DVD drive or appropriately encrypted files found on your CD, DVD, or downloaded files, it's designed to prevent you from accessing content in your files or on your systems without the signed license keys from the vendor.

Re:OS's fault

[slashknott]

Run as a regular user. Users group.

Then, if (when) you need to install something, or run a program that needs administrative privileges, right click it and "Run as" Administrator (or user with administrative privileges).

This is the same kind of thing as 'sudo' in linux.

You'll get a lot less shit on your system this way, still not perfect but better.

Re:OS's fault

[Rorschach1]

"Come on, man. It's 2006 already"

Goddamned daylight savings time changes...

Re:OS's fault

[Malc]

Right-click->Run as.

Or create/modify the shortcut to it so that it prompts for admin password

Or look at Aaron Margosis' blog about other tricks for individual apps with elevated privs.

Re:OS's fault

[IdolizingStewie]

The Explain tab for Turn Off Autoplay in the Group Policy Editor says at the bottom it does not disable autoplay for music CDs. I don't know for sure, since I rarely boot into Windows anymore, but wouldn't that mean the setting is useless in this particular case?

Re:OS's fault

[dillee1]

Why parent is modded funny? Should be insightful.

I really wonder why windows expert like Mark will actually leave his cd autorun and get infected without notice. Even a moderately knowledgeable windows user knows it is dangerous.

Re:OS's fault

[Anonymous Coward]

but still allows installing and running software which falls short of this.

That's called a "normal user" account on *nix systems.

Re:OS's fault

[Anonymous Coward]

Dunno, can it be in media player or you need to simply press shift key?

Re:OS's fault

[Eunuchswear]

Huh? Half Life 2? Nonsense.

The only one I've ever come across was early versions of the Sims 2. And that's been fixed.

Re:OS's fault

[Anonymous Coward]

Only CDs ? What about DVDs ? Pendrives ? etc. etc.

Personally I never autorun anything, not on my Windows box, not on my Linux box. If the day ever comes where I can't turn it off then that's the day I stop using a computer.

Anyone who uses Autorun is an idiot.

Re:OS's fault

[wheany]

Yeah, but still, Blue screen of death, LOL. Am I right or what, guys?

Re:OS's fault

[wheany]

Half-Life 2 doesn't require Administrator rights. Punkbuster does.

Re:OS's fault

[scaryjohn]

It's a very neat video that explains what trusted computing is supposed to be and what it's not. But it doesn't actually say much about why T.C. is dangerous for the end user. I'd have liked to see more of that.

One more minute, of that, and it'd really be perfect. :-)

Re:OS's fault

[dcam]

That is correct. You use a to block disable all CD autoplay.

The point I was making was that autoplay on USB drives is another potential vector. I personally don't disable it for that reason. I disable it more because I consider it a dead light bulb feature.

Re:OS's fault

[scaryjohn]

Trusted computing is soon to be found in:

Desktop computers, Notebooks, Servers, PDA's, Cellphones, Game units, DVD-players, Set-top boxes, Watches, Mixers, Steam Irons, Fridges, Fire Extinguishers, Grandfathers' Earplugs, Toilets, Dogs, LAFKON, Boxes...

Didn't Notice?

[KidHash]

Not that this makes it better in any way, but I liked how he said

I hadn't noticed when I purchased the CD from Amazon.com that it's protected with DRM software, but if I had looked more closely at the text on the Amazon.com web page I would have known

followed by a picture of the amazon web page in question with [CONTENT/COPY-PROTECTED CD] clearly visible in massive letters.

Re:Didn't Notice?

[Captain Chaos]

Does anyone know how reliable Amazon's notice is? I bought my first CD in years (The Legend of Johnny Cash) and it is still sealed because I want to make sure there is no protection. Even if I would only listen to the actual CD and never make a backup I don't plan on supporting that type of behaviour. The RIAA members have really hurt themselves with this type of behaviour. Years ago I averaged at least one CD purchase a week, now they are lucky if I buy one a year and that has been to give as gifts only. The lack of good new music doesn't help, but there are old releases I wouldn't mind buying if they'd stop treating customers like criminals.

Re:Didn't Notice?

[vettemph]

>followed by a picture of the amazon web page in question with [CONTENT/COPY-PROTECTED CD] clearly visible in massive letters.

You can still blame Amazon. There is a huge difference between CONTENT/COPY-PROTECTED CD and CRIPPLES YOUR PC WITHOUT CLEAR PERMISSION. Of course you would buy niether given the "choice".

Re:Didn't Notice?

[Anonymous Coward]

bought my first CD in years (The Legend of Johnny Cash) and it is still sealed because I want to make sure there is no protection.

hold down the fucking shift key, Einstein. Getting around DRM is mindnumbingly easy.

Re:Didn't Notice?

[Flower]

While this isn't exactly foolproof, IIRC just look for the Audio CD trademark on the disc. There are no DRM specs for the actual format and the company that owns it made a stink awhile ago about copy protected discs using the mark (search /. there was an article about it sometime ago.)

Any recent release should be marked as copy protected in some way, shape or form.

Re:Didn't Notice?

[maxwell demon]

hold down the fucking shift key, Einstein. Getting around DRM is mindnumbingly easy.

In other news, the RIAA demands that computers don't come with shift keys, because they are a circumvention device and therefore forbidden under the DMCA.

Re:Didn't Notice?

[HTH NE1]

Amazon has been known to alter the titles of products in their catalog. However, in my experience the copy of the title in one's order history does not get revised (I make many preorders).

Mark Russinovich should check his order history for the presence of that text there to determine if it was present at the time he ordered.

Re:Didn't Notice?

[Anonymous Coward]

The RIAA members have really hurt themselves with this type of behaviour. Years ago I averaged at least one CD purchase a week, now they are lucky if I buy one a year and that has been to give as gifts only.

I think they hurt themselves worse by publishing shit music. I haven't purchased a CD in over five years, and it didn't take DRM or lawsuits to make that decision for me, just a minute or two of the radio every now and again.

So what did the recording industry do in response? Accused everyone of stealing their shit music, spent millions of dollars trying to stop the alleged theft, and made certain that I'll never give them another penny, even if they do get around to making better music. Great job, RIAA.

Re:Didn't Notice?

[mibus]

what's a shift key/

i'd love to be able to get past the drm on my cds1

Re:Didn't Notice?

[corblix]

followed by a picture of the amazon web page in question with [CONTENT/COPY-PROTECTED CD] clearly visible in massive letters.

Well ... there is "clear", and then there is "clear". The page shown is extraordinarily "busy". At the top it has four tabs with nine subtabs, five account management maybe-tabs, a drop-down menu, two separate search boxes, two "Go" buttons and an "Advanced Search" button ... and that's just the top of the page.

Meanwhile, over at the right is a big yellow button in a big blue box, and in the middle of the page is the cover image.

Do you read all the text on every web page you visit? (Hint: you don't.) I certainly don't. When I buy a product, I consider: Is this the product I want, how much will I have to pay, and how long will it take to arrive.

The real lesson we learn here is not that the author of the article was unobservant. On the contrary, he was just as observant as anyone could be expected to be. No, the real lesson is that we all need to make a mental note: When paying for music, check its DRM status. I appreciate Amazon making such info available in nice big letters in an easy to see location. However, that alone does not mean I will read it.

Re:Didn't Notice?

[lysander]

This whole thing just reads wrong. How much are you willing to bet he bought the cd just so that he could deconstruct the DRM? This seems much more likely than a windows-internals hacker just happening to notice an anomaly, dig around for it for a while, and then realize, "Oh, damn, maybe it was that cd I bought that had DRM notices all over it?"

Re:Didn't Notice?

[ConceptJunkie]

There's plenty of good new music out there... more than I can afford to buy, and I buy _a lot_. And guess what, almost all of it is not sold by RIAA members. Nor does it have copy protection. Don't let the mass-market suits force tasteless gruel down your gullet. Explore. Expand. Experience.

Re:Didn't Notice?

[DocSavage64109]

Even if you are right, I can't say that I mind. His article may be a catalyst for some sort of anti-DRM backlash. Most likely though, this issue will be forgotten just like every other major issue that has been happening in the U.S. over the last few months.

Re:Didn't Notice?

[Anonymous Coward]

So?

Re:Didn't Notice?

[HardCase]

That company would be Philips. They own the patents along with another company...Sony.

Re:Didn't Notice?

[Captain Chaos]

I shouldn't even respond to a post with that kind of attitude, but maybe I didn't word it clearly enough for you to understand. I know there are ways around the protections, but I stated I don't want to support that kind of behaviour if there is protection on it. Have you seen all the news reports about how well protected audio CDs sell that the RIAA members like to spread around? My copy goes back if it has protection no matter how easy it might be to bypass. A lost sale is more effective in fighting back than bypassing the protection or they'll just think we are happily accepting their crap. It's just a shame that they think they can just buy politicians to protect their outdated business model instead of adapting to the changing times.

Re:Didn't Notice?

[Captain Chaos]

I had to leave soon when I wrote that post or I would have made it clearer that the comment about the new music was referring to RIAA member companies specifically. I do have CDs from independents and local bands, though I haven't bought any of those lately either. I'm not boycotting them, but I haven't been looking very hard and most of my friends and family don't listen to much that the RIAA doesn't fill their heads with. I should look around for more though as there are a lot more independents out there now and I'm probably missing out on a lot of music I'd like.

Re:Didn't Notice?

[Anonymous Coward]

Quite a bit. His story about not knowing it was protected is probably just to provide plausible deniability if they come after him with a lawsuit. Someone like that who knows more about Windows internals that most of the programmers at Microsoft who wrote it in the first place would know that copy restricted discs existed and would know how to check in advance using google, online forums like Afterdawn, and even Usenet.

Re:Didn't Notice?

[jsebrech]

I agree that it's easy enough to find out whether a CD is copy-protected or not most of the time. By paying attention to it I've already been able to avoid buying several copy-protected CD's.

In my experience most artists don't even know their CD is copy-protected. Like Charlotte Martin's CD On Your Shore. BMG put copy-protection on there without informing her. When she found out, she made them remove it from the second print. Had she known beforehand, it would have never gotten on there. She was pissed about it. Just informing the artist of your displeasure about the DRM can go a long way.

Sony means to degrade society

[Anonymous Coward]

This is why I hate Hip Hop and Rap. Sony and Hiphop and Rap are rootkits on the good parts of humanity.

Re:Sony means to degrade society

[Heem]

the album in question is a country album. almost the exact opposite of rap.

Re:Sony means to degrade society

[pinkfalcon]

I suppose I could look this up if I wasn't so lazy, but isn't Van Zant from Lynard Skynard? Not exactly country and definately not Rap or Hip Hop.

Re:Sony means to degrade society

[maxarturo]

Van Zant the group is comprised of the two Van Zant brothers Johnny and Donnie. You're correct that they both have "country-styled" rock roots, but this album is basically known as their first full-blown country album. So I see where you're coming from, but this is a country album.

Re:Sony means to degrade society

[thc69]

Ronnie Van Zant is from Lynyrd Skynyrd. He's dead now.

The band Van Zant is his brothers doing a southern rock sort of sound that gets played on country radio. The title track from the album is a good song IMO, but I guess I won't be hearing much of the rest of the album.

Re:Sony means to degrade society

[pinkfalcon]

Yes I was aware that Ronnie Van Zant was killed in a plane crash, but Johnny Van Zant was also in Lynard Skynard and is still the lead singer in the current tours.

I didnt know about Donnie.

Is the EULA valid?

[nweaver]

Since spyware WITH a proper EULA has been held to be in violation by the FTC, and since this EULA doesn't really mention the rootkit's difficulty of removal, this might be litigatable.

Of course, Mark Russinovich did (inadvertantly) dissasemble content protected by the EULA.

Re:Is the EULA valid?

[Billly Gates]

Worse it should not be legal in the first place for such an extreme eula. Many spyware programs from 180networks already do not have an euala and just come bundled.

If we had an eula where the user agreed to be held as a slave would that be legal too? I think not.

Re:Is the EULA valid?

[Phat_Tony]

Even if you can't win a case directly regarding the rootkit, I would sure hope [IANAL] you'd have a good case if exploits come out and damage occurs. If you try to play an ordinary disc in your computer and end up with a sneaky backdoor for hackers that was covertly and intentionally installed by Sony, then, say, lose thousands of dollars worth of software and information, I'd sure hope Sony would be found at least partially liable for that. If it's a widespread exploit, then perhaps a class-action lawsuit?

Re:Is the EULA valid?

[bogado]

If we had an eula where the user agreed to be held as a slave would that be legal too? I think not.

Damn, there goes my business plan....

Re:Is the EULA valid?

[MultisSanguinisFluit]

Of course, Mark Russinovich did (inadvertantly) dissasemble content protected by the EULA.

Yeah, but it's not like there was a file listing that clearly identified which files were covered under the EULA. One can argue that licensors have a duty to identify their intellectual property.

Re:Is the EULA valid?

[ObsessiveMathsFreak]

Of course, Mark Russinovich did (inadvertantly) dissasemble content protected by the EULA.

And that is why he shall burn in seven fiery litigious suffering hells along with all the other reverse engineering, anti-DRM, I-want-to-own-what-I-buy, hippy COMMUNISTS! So preacheth the church of the new global economy!

Glory To capitaliZm!!! HAIL SATAN!!!!

Re:Is the EULA valid?

[Ilgaz]

I saw words "Sony" "DRM" on Slashdot and thought "Oh, DRM, geeks." and moved to another page.

When I read the name "Mark Russinovich" on Yahoo news, I stopped to ignore and find out, damn thing is actual, elite rootkit which needs Russinovich and F-Prot boss himself to figure whats going on?

For non windows people. Russinovich is like "low level God" on windows platform and various others. What if he didn't spot it?

E.g. Frisk looks like they were completely confused about the reports they get about a "virus" installed by AudioCD. I bet they thought its just a false alert coming from newbie computer users.

I had no option to buy my music online here in Istanbul. Time to STOP buying CDs for me really. (speaking to myself!)

I hope some company takes sony to court

[Anonymous Coward]

NT

Sony has gone too far...

[chrispyman]

It's one thing to copy protect your CDs to make it difficult to rip but it's another thing to install a rootkit that is by definition difficult to remove. Who'se going to clean up this mess when a Microsoft patch or SP comes around and breaks any computer with this installed?

Re:Sony has gone too far...

[jnelson4765]

I think this is an excellent point. I work with a radio station doing their computer stuff, and the people who listen to any new CD's that come in do it from their computer.

If I have one of the machines I'm responsible for get hosed by Sony's dumbfuck copy protections, I am going to get pissed.

OTOH, this is standard Sony bullshit - as anyone who has ever ued the steaming pile of dog shit, Sonic Stage, can attest. When the software crashes randomly on 5 different computers in a row, with 3 different MD recoders, there is a problem.

Fuck Sony's consumer electronics and music divisions. They really do define corporate evil in the 21st century.

Thanks

[BCW2]

I am very glad to hear about this. That CD WAS on my birthday list for next week.

Sony just lost a sale, end of story.

Re:Thanks

[Flower]

Don't tell Sony. Tell the Brothers that they lost a sale. Let them know that the product they worked so hard on now has poorly written software on it that could damage your computer. And through you want their music you can't buy it and you're going to tell your friends not to risk buying this CD.

Re:Thanks

[BCW2]

Don't worry, I already did.

Re:Thanks

[Relic of the Future]

How? I was just poking around their site and can't find anyway to contact the artists directly; all there is is a .cgi form that reports back to Sony corporate.

Also, someone should join their bboard and let the fans there know, too. (I just can't bring myself to join a country music board though ::shudder:: ;)

Re:Thanks

[BCW2]

That's what I did. Joined the BB and got the word out that way. Someone on that BB has to be in contact with them. Quite a few artists scan their BB's themselves to see what the fans think.

They are not just country, Lynyrd Skynyrd and 38 Special are rockin groups. They just did something country with this one.

Re:Thanks

[DaveV1.0]

If you posted to the BB on CMT.com, they appear to have removed it because I can't find it.

Re:Thanks

[DreamerFi]

Just a sale? No more? I've been refusing to buy anything that has been near a Sony label for years now because of the shit they're trying to pull. If you're just going to buy the next piece of crap that comes along, they'll never change.

Re:Thanks

[xtracto]

If you know about other CD's, feel free to help.

The list of CD's so far are:

Note: I would had preffered to make a nice looking list, but Slashdot was spitting me " Your comment has too few characters per line (currently 36.7)." so I had to remove all the CRLF from my post. Sorry

Nothing Is Sound. Switchfoot Unwritten [ENHANCED] Natasha Bedingfield Ride Shelly Fairchild 12 Songs Neil Diamond Touch Amerie Bloom Remix Album [ENHANCED] Sarah McLachlan Kasabian Kasabian The Essential Pete Seeger [ORIGINAL RECORDING REMASTERED] Pete Seeger Jeru [ENHANCED] [ORIGINAL RECORDING REMASTERED] Gerry Mulligan imes Like These Buddy Jewell, Bob Brookmeyer & Friends [ORIGINAL RECORDING REMASTERED] Bob Brookmeyer Healthy In Paranoid Times [ENHANCED] Our Lady Peace Cautivo [DUALDISC] Chayanne The Invisible Invasion Coral, The Coral Defined Amici Forever Suspicious Activity [ENHANCED] The Bad Plus Manhattan Symphonie [ORIGINAL RECORDING REMASTERED] Dexter Gordon Phantoms Acceptance On Ne Change Pas Celine Dion Get Right with the Man Van Zant To Love Again [ENHANCED] Chris Botti Life [DUALDISC] Ricky Martin The Essential Dion [ENHANCED] [ORIGINAL RECORDING REMASTERED] Dion Faso Latido A Static Lullaby Change It All Goapele Susie Suh Susie Suh My Very Special Guests [ORIGINAL RECORDING REMASTERED] George Jones Broken Valley Life of Agony Silver's Blue [ENHANCED] [ORIGINAL RECORDING REMASTERED] Horace Silver Z [ENHANCED] My Morning Jacket

Re:Thanks

[Anonymous Coward]

Unfortunately that won't work either. Perhaps if the artist in question is an Eminem, or U2, but even then the chance that they can actually do anything is minimal.

I wrote several bands about "protected" CD's, let me quote from the answer I got from one of them:

The copy-protection is nothing we can do anything about.
Its the policy of EMI/Virgin Records, not ours.

We have tried to help our fans,
by giving them hints on how to rip the cd,
so they can burn copies for the car, vaction etc.
Heres one free program: www.audio-grabber.com

And if you already have the album, you can always download it.
Maybe its not legal, but it sure is ethically proper.

In the long run,
I beleive that record labels will discontinue the copy-protection,
because what ever system they apply, it will eventually get cracked.

The artist are as much hostages of the industry as the consumers are.

Re:Thanks

[BCW2]

My post was deleted and my sign up is now invalid. I just have an opinion, Sony has advertising dollars.

But...

[bhirsch]

Do people actually install the crap that comes with audio CDs?

Re:But...

[kuzb]

Often times you're not presented with a choice. The first time you insert a CD, it will autoplay - this is when this crap makes it in. I know you can shut that feature off, but most people either don't knwo how, or won't.

Re:But...

[bhirsch]

I guess I am just a relic with a normal CD player. Though I want to say that the last Windows computer I setup had autoplay disabled. I'm not sure if it was done after the initial OS install or a Windows update.

Re:But...

[Namronorman]

Yes, some people DO install the stuff that comes with their CD's, because sometimes that "crap" gives them the ability to rip so many licensed copies of the song to share with friends.

For example, a friend of mine wanted to share a few Velvet Revolver songs with me so she used the built in feature to rip them to a phone home .wma, which of course I couldn't use...

Re:But...

[chill]

From the article...

"The DRM reference made me recall having purchased a CD recently that can only be played using the media player that ships on the CD itself and that limits you to at most 3 copies."

Why anyone would purchase a CD under those terms to begin with, is beyond me.

Do formats like this not violate the Red Book standard and thus forfeit their right to be called "CD Audio"?

  -Charles

Re:But...

[Anonymous Coward]

which of course I couldn't use...

You're better off.

Re:But...

[WWWWolf]

Yes, some people DO install the stuff that comes with their CD's, because sometimes that "crap" gives them the ability to rip so many licensed copies of the song to share with friends.

After being presented with a sell-your-babies-to-the-almighty-record-label EULA, and before shoving awfully encoded WMA format files down their throats.

Hint #1: There's no "copy protection" on CDs. For most parts, it's misshapen multi-session CDs. cdrdao read-cd --session 1 ... Hint #2: If you're encoding the files to MP3, Vorbis or, good heavens, WMA, digital rips are wayyyy overrated and plain old CD player, analog RCA-to-RCA cable and an audio recorder app can do really wonders. =)

Re:But...

[lord_rob the only on]

This is an audio CD but It's not a CD-audio though, this is just a CD-ROM with DRM'ed audio data on it. This means if I've understood correctly that you cannot even play this CD in your hifi, only on your computer, and only if it's running Windows.

And i also don't understand, to quote you, "Why anyone would purchase a CD under those terms to begin with ?". A possible reason is "by mistake". People aren't careful enough and then buy those copy protected "audio-CDs", then later complain the CD doesn't play correctly on their car CD player, if it plays at all.

I have also been tricked into buying copy protected CDs, not much but still too much. Now when I consider buying a CD, I'm very careful not to buy that crap. If everybody does the same, majors will see immediately the impact of DRM on their sales and stop using it. It has worked for me. I was buying every releases of "Solid Sounds", a belgian techno compilation. I stopped buying thoses CD when they introduced a copy protection mechaninsm. I suppose I wasn't the only one to do that because later they stopped protecting their CDs.

I know, I'm going slightly off-topic here but this kind of attitude from big companies that earn way too much money really disgusts me.

Re:But...

[arkanes]

The kind of DRM that installs as soon as you put the CD in the drive is almost certainly technically illegal under US law. It's a shame that the power & influence of big money can keep people from addressing this issue.

Re:But...

[EddWo]

Its a multi-session CD, part Audio and part CD-Rom. It will play in a HiFi, but when you put it in a Windows machine, it will autorun a program from the CD-Rom portion and install a driver which will then prevent you from accessing the CD-Audio portion through the Windows APIs.

This variant seems to go even further, and will install a persistant filter driver on all drives that will detect CD burning commands sent to the drive and attempt to prevent more than a fixed number of copies being created.

Hmm

[Anonymous Coward]

Let me guess, this root kit installs itself and is designed to be completely hidden, too?

Re:Hmm

[redshadow01]

To make matters worse, not only is everything hidden, but you can't just delete the files and reg keys or you'll cripple your system...the author of the article is a developer and he spend a lot of time just getting rid of the damned thing...I know I couldn't do it

Re:Hmm

[networkBoy]

"the author of the article is a developer and he spend a lot of time just getting rid of the damned thing...I know I couldn't do it"

But thanks to his hard work, now we can! I for one love this guy.
Now I have another reason to dump Windows, this rootkit won't run on Linux or Mac.
-nB

Re:Hmm

[ChaosDiscord]

To say that the author is "a developer" is an understatement. This is Mark Fucking Russovich! He has spent his life dissecting Windows and making it dance for him. He knows more about the internals of Windows than many of Microsoft's Windows team. If Mark says something on Windows is hard, it is. Take it as you might a comment by Alan Cox on Linux.

Class Action Lawsuit?

[eyebits]

Sounds like an opportunity for a class action lawsuit. Everyone who played the CD on their windows system would be eligible. ...good opportunity for a group of lawyers to get rich. (The members of the action never do.)

I never buy this crap

[Arker]

But I know a lot of people here do. Please, every one of you that have bought faux-CDs with this junk on them, get together, find some lawyers, sue the bloody bejesus out of Sony, ok?

Could be . . .

[crimguy]

a DMCA violation to put that thingie in there.

Re:Could be . . .

[Anonymous Coward]

Nope, it's more likely a violation of the DCMA to try to evade it.

Re:Could be . . .

[E8086]

They'll probably try and use the DMCA to make it illegal to remove it without expressed written concent from Sony.

Re:Could be . . .

[crimethinker]

Actually, I think the guy violated the DMCA by circumventing the copyright protection technology.

Because I think the DMCA is a ridiculously bad piece of law, I would like to see Mark prosecuted for violating it, so that people can see just how bad it is.

-paul

Re:Could be . . .

[robfoo]

"the guy violated the DMCA by circumventing the copyright protection technology"

When did he do that? All he did was discover the dodgy software, and remove it. At what point did he enable his computer to make (non-DRMed) copies of the CD?

In fact after removing their software he won't be able to play the CD again, without (re)installing the rootkit/player.

This has gone too far!

[Billly Gates]

What is next? Drm that will rewrite your bios and turn your pc into an expensive doorstop for copyright violation?

As if spyware itself is miraculiously legal and now we have this? Rootkits and spyware programs that append to windows in the mbr so even a reinstall wont delete thim IS TOO FAR!

I agree with a previous poster that is should be a criminal offense the same catagory as spypainting someones house or breaking an entry. Why do we allow this crap to be legal?

Its time we wrote our elected officials and inform them about what is happening and about Sony's drm and demand civil and criminal responsibility for malware makers. I dont care if its the CEO of some company spraypainting my house vs a teenage kid. Its still illegal and Sony should be held accountable.

I was reading on cnn about the drop of ecommerce even though there is still a rise in internet usage. This is due to all the spyware/scams/malware that is infecting pc's at record rates. This is killing out economy and many companies such as Google, Amazon, and Ebay are already getting hit with their wallets over these scams.

Lets organize and make a difference. This is a slippery slope and I fear what is coming next.

Re:This has gone too far!

[Anonymous Coward]

Please hire an editor before you write anyone in the U.S. Congress.

Re:This has gone too far!

[burnsy]

"What is next? Drm that will rewrite your bios and turn your pc into an expensive doorstop for copyright violation?"

Yes, look for it in your next Blu-Ray Disc Player.

http://www.engadget.com/entry/1234000737057152/

"On top of that, consumers should expect punishment for tinkering with their Blu-ray players, as many have done with current DVD players, for instance to remove regional coding. The new, Internet-connected and secure players will report any "hack" and the device can be disabled remotely."

Re:This has gone too far!

[wud]

i just want to know what spypainting is, that sounds cool.

Re:This has gone too far!

[cryogenix]

Yes that's exactly what's next. Remember recently one of our esteemed elected officials (in the USA that is) who wanted the ability to physically remotely destroy the pc of someone infringing on copywrighted material? I don't want to name the name because I'm not sure which one it was. I have it narrowed to 3 in my head, but I don't want to falsely slam the wrong person.

Re:This has gone too far!

[mcrbids]

Lets organize and make a difference.

OK, let's. I assume that this is a call to join a foundation, organization, or movement. What have you decided to call this organization? What's the mission statement? What are the goals of the organization? Meeting times? Rallies?

Yep, I just might be interested. Really.

If you're serious, that is - but I don't think you are. See, if you were, you'd have to stretch yourself outside of your current "comfort zone", which currently includes your computer, and quite possibly your mother's basement, but not much else.

But, if you WERE serious, and you REALLY DID put out enough effort to register a domain name, make a website, put together some business cards, talk to REAL LIVE PEOPLE (instead of your laptop) at real, live events, you'd find out very quickly what real, live people think. You'd grow immensely, as a result. Your skills at working with people, and your earning power would be forever improved, and your understanding of your true role in society would be much, much firmer.

You would forever be a bigger, better person.

I dare you to put together an organization of at least 100 members towards your cause. In order to be a "member", they have to have contributed at least $10 in CASH towards your cause's war chest. (And, I know you can do it, because I did)

Re:This has gone too far!

[frogstar_robot]

Remember recently one of our esteemed elected officials (in the USA that is) who wanted the ability to physically remotely destroy the pc of someone infringing on copywrighted material? I don't want to name the name because I'm not sure which one it was. The whackjob in question is Orrin Hatch.

Re:This has gone too far!

[cryogenix]

That was who I was thinking of but I couldn't confirm it at the time of posting.

Re:This has gone too far!

[Anonymous Coward]

Exactly!
I wonder how many of the 300+ respondees to this thread will leap up to get a PS3 when they come out?

Re:This has gone too far!

[xenobyte]

"On top of that, consumers should expect punishment for tinkering with their Blu-ray players, as many have done with current DVD players, for instance to remove regional coding. The new, Internet-connected and secure players will report any "hack" and the device can be disabled remotely."

What is it with those regional codes?! - Even tamper-proof drives will not prevent you from simply having a second player coded for another region at your disposal. THEY WILL NEVER WORK!!!

They need to think global and market their releases globally at every step (cinema, tv, home) instead of a local offset of several months. It will seriously cut down on piracy in itself and eliminate the need for stupid thing like regional codes.

Besides, even with advanced call-home systems people will simply buy a black box from some non-DRM country that will filter the call-home communication and thus allow modified players unrestricted use, similar to the region code killers available today.

At some point these corporations will have to realize that the many gazillions thrown into development of protection schemes and bribes/lobbying for more DRM is a waste of money because they all get defeated almost before they are ready to be put into use.

Re:This has gone too far!

[loraksus]

This might be a slightly odd response, but I think part of the reason is that in a situation such as a computer crime, there really isn't any possibility of the victim going apeshit (or doing something in retaliation) on the perpetrator if caught.
During sentencing (and really, during the entire judicial process - the police probably won't respond in the first place if you call 911 and say "those darn kids are crossing my lawn", even if they do, the prosecutor probably won't try them for tresspassing) maybe the actual crime itself is irrelevant, but what is taken into consideration is how the crime is perceived by the majority of people and what the majority believes is appropriate punishment.
Right now, most people feel that rootkits, malware, etc aren't really an issue - be it lack of education or whatever. If that changed (perhaps this could be spun as a "corporate espionage which aids terrorists" type of thing ;), I think viewpoints would change and the punishments would get harsher and maybe someone in the justice system would actually take the issue seriously.

Re:This has gone too far!

[Anonymous Coward]

Or, more likely, you'd quickly figure out that people suck. That they don't understand or care what's happening. That for 95% of the people, most DRM is ok cause they weren't planning on ripping the CD anyway so they had no idea - same goes for their DVD player. Most people don't give a crap that it won't let them tinker with the insides.

This will depress you to no end. You'll go back to your basement and never come out again.

BTW, truth be told it's hard for me to have an issue with a DVD player that prevents tinkering - I don't EXPECT to crack open my DVD player and muck with it. Very small minority of people being affected here.

Re:This has gone too far!

[Anonymous Coward]

I direct you to article 8 of the EULA.

My reading of this is that Sony intentionally installed a rootkit, will install a backdoor, and will install any damned software they please. After all, you "agreed" to it. If you don't allow them to install their shit, then they will trash your computer in a fit of pique.

Article 8. UPDATES TO THE LICENSED MATERIALS

The SONY BMG PARTIES may from time to time provide you with updates of the SOFTWARE in a manner that the SONY BMG PARTIES deem to be appropriate. All such updates shall be deemed to be part of the SOFTWARE for all purposes hereunder. In the event that you fail to install an update, the SONY BMG PARTIES reserve the right to terminate the term of this EULA, along with your rights to use the LICENSED MATERIALS, immediately, without additional notice to you. The SONY BMG PARTIES shall not be liable for any loss or damage caused by reason of your failure to install any such update or your failure to do so in the manner instructed.

Re:This has gone too far!

[mcrbids]

Well, this thread is stale, but I want to make one more point.

Your issue of how few people really care isn't, I feel, cause for apathy - rather, it highlights how important the activist really is.

Suddenly, you realize how critically important it is to care, and how much power you can amass if/when you do. At the age of 21, I was involved with an organization that promoted strict adherence to constitutional guidelines. We had a cable-access TV show, and routinely got mention in the local newspapers. (at least weekly mention, and more than a few front pages) In fairly short order, we had hundreds of attendees - it's easy to pick out a few hundred people willing to get together, attend a lecture, and drink a beer or two when you have a televised reach in the tens of thousands of homes!

Suddenly, you might realize how much power is wielded by those who give a damn!

Re:This has gone too far!

[Anonymous Coward]

I know you can do it, because I did

Ah, I was beginning to wonder if there was a point to your rambling... I guess self-aggrandizement is a point, sort of.

Like unto a virus

[Shadow Wrought]

Man, Sony'll do anything to make sure your system has their Cell in it.

Re:Like unto a virus

[myowntrueself]

Man, Sony'll do anything to make sure your system has their Cell in it.

At least its not Frieza and Cell joining forces...

Perhaps it's time to restart my 1 man boycott

[Anonymous Coward]

of Sony Music. I can't believe what he had to go through to remove that software. I don't have nearly his level of expertise, so I'd have had to wipe my system and start clean. Just another reason why I hate Sony (and AOL, and am starting to worry about Google. We KNOW MS is somewhat evil, so they don't scare me nearly as much as the others).

TIme to...

[heinousjay]

Turn off autorun.

Re:TIme to...

[sqlrob]

And stop running as an admin level user.

Re:TIme to...

[Kevinv]

doesn't prevent this. According to the article it's installed when you run the player off the cd. There is no prompt for install either, it does it while the player is playing the cd.

Re:TIme to...

[Anonymous Coward]

What idiot would run an EXE from a music publisher? That's as dumb as downloading EXEs from porn websites to view their porn. If the standard CD player applet doesn't work, then the CD is defective and should be returned for refund (or fixed with a Sharpie).

Re:TIme to...

[alan.briolat]

... run an operating system they haven't written their crapware for? Where their crapware won't work? Or does that mean that non-Windows users just aren't allowed to listen to music on their computers?

When I question the morality of music piracy, crap like this makes me say "fuck the labels".

Re:TIme to...

[endoplasmicMessenger]

I'm sorry. You have turned off autorun. You are in violation of the DMCA. Do not attempt to leave the building. A security force will shortly arrive at your location to escort you to your new domicile.

Re:TIme to...

[Ilgaz]

No, you don't have to turn off autorun. You just don't buy products from a company which installed ROOTKIT! to unsuspecting people who only made the fault to stay away from piracy.

Re:TIme to...

[Ilgaz]

99% of desktop computer users who just want to listen to CD they just purchased will give their admin name and password to "CD Player" "to play smoothly". There goes the awesome "do not run as admin" tip :)

OS X got excellent way/scheme of asking user password when something critical happens. Who really think before giving it especially if they downloaded from a legit looking company?

Believe me they don't think.

Tell me again

[Anonymous Coward]

Just why we do business with Sony?

What part of protected == rootkit?

[Anonymous Coward]

There's a slight difference between a copy restricted CD and an "install a rootkit on your computer" CD, though...

Bills/Laws

[davro]

Quote from AKAImBatman "We *really* need to get a anti-spyware bill on the books."

Remember two Law's don't make a Right.

I think I speak for all of us..

[Psionicist]

I think I speak for all of us when I say someone should sue their fucking ass off. Talk about a double standard! Sony doesn't want the people to infringe on their content, but they themself are perfectly fine with destroying a users system. I don't live in the US, but weren't there laws passed against malware in several states? I do hope so.

Heck, Sony and RIAA treat their CD's as physical property (for example, they use the word theft and stealing instead of copyright infringement). Isn't this the equivilance, using their logic, of breaking into my house and installing cameras (or whatever the rootkit actually does).

Re:I think I speak for all of us..

[Anonymous Coward]

Don't speak for us all! I'm Sony, you insensitive clod!

FTA

[hereschenes]

> I next turned to LiveKd, a tool I wrote for Inside Windows 2000 and that lets you explorer the internals of a live system

Clearly, this man has been using Windows for too long!

Re:FTA

[ScytheBlade1]

This guy is without a doubt, one of the most knowledgable about the internals of ANY Microsoft OS. He (and his company) have written more top-notch, high grade software than any other company out there (for purposes of exploring just what is on your computer, remote administration, and "peeking under the hood").

On top of that, a majority of their tools are completly free, light, and do the job WELL.

They have tools made to defragment your registry hives, to actually execute a process as another user (don't mention "runas", their stuff takes it to another level), monitor the registry hives for changes, and this disturbingly well-done root kit revealer.

Sysinternals is god when it comes to actually looking at what is wrong with a MS OS, and there's no way around it.

Re:FTA

[John Muir]

Neat.

In that case a good sound witness for the Sony trial!

Mind, if I were on Sony's multi million dollar defense team, I'd use the longevity and depth of this guy's Windows use to try to prove his insanity. ;-)

Re:FTA

[ScytheBlade1]

He'd be a perfect witness for a lawsuit against Sony concerning this software. In case you didn't notice from TFA, it took him all of a half-hour to rip through the entire software and see just what it does ;)

The Power of a Hammer...

[PortHaven]

I swear, it's crud like this that makes me want to walk into Circuit City with a hammer and smash all the copies.

Look at the manager any say...."send them back to SONY...explain to them that installing of viral code is illegal" because it's pretty well known that "illegal" only applies to "us - the individuals" and NOT large corporations. Because they "purchased" the laws...therefore, they do not have to abide by them.

- The Saj

irony?

[Anonymous Coward]

It's installed with a DRM-encumbered music CD, Van Zant's "Get Right with the Man". (Mmmm, delicious irony!)

I wouldn't call it irony... more like truth in advertising, really.

Has sony realized...

[Spy der Mann]

they could face lawsuits for jeopardizing a computer's security with this rootkit?

Re:Has sony realized...

[Anonymous Coward]

Too bad its not actually a rootkit.

DMCA

[randyflood]

Will Sony now sue the author of the Article for violating the DMCA and reverse engineering their technology that was intended to protect their copyrights and trying to help people illegally copy their music? I'm not saying he did any of that, because he certainly didn't. But, I'm just wondering if Sony will try to take that position...

Profit

[future assassin]

Read Slashot
Get Van Zant's "Get Right with the Man". Cd
Install Cd
Get pwned
Call lawyer
Sue Sony
Profit!!!! for you and Van Zant

Re:Profit

[GeffDE]

You forgot to add the ??? step...

Sony DRM Installs a Rootkit

[Anonymous Coward]

And now we know why Sony hasn't been a party to the last two iTMS. They couldn't convince Apple to add the rootkit to fairplay.

What if you refuse the EULA?

[BeBoxer]

I know you can disable auto-run and such to get around this type of crap. But what happens if you just 'disagree' or whatever on the EULA? I assume that Sony will then not install the rootkit and you can rip the CD with whatever tool you normally use? Or does Sony install the rootkit anyway, setting themselves up for criminal prosecution? Does anybody have a copy of this thing to try and answer that question?

It just seems kind of silly to have DRM which is totally dependant on the user to request it be installed. Or can refusing an EULA be considered a violation of the DMCA?

This is as good as...

[elgee]

Getting a cockroach with my just purchased pizza.

Re:This is as good as...

[Thomas Shaddack]

Getting a cockroach with my just purchased pizza.

And getting a cockroach forced into every subsequent pizza you purchase.

Re:This is as good as...

[Reziac]

More like getting a tapeworm with your pizza, which you don't realise you have until it's already firmly attached to your gut.

Great corporate thinking

[sikandril]

This is exactly the same mentality that brought us the memory stick and the mp3 walkman who could not play mp3's, only ATRAC. Incidentally, Sony profits are down 46% this quarter. I can only add that this is another nail in the coffin of a company once known for its innovation, high standards and uncanny understanding of the consumer's mind. They better hope the Ps3 saves their collective asses

Re:Great corporate thinking

[Stormwatch]

But consider the recent rumors of PS3 prototypes literally melting... let us hope they are true!

Rootkit? No evidence of that.

[krisamico]

It is disappointing that the article does indeed call this a rootkit without providing proof. All I see is some DRM shovelware that is surreptitiously installed and hard to remove, which is bad enough without resorting to hyperbole. IMO, the article needs to prove that this software maliciously intercepts communication or opens holes to be able to use that word.

Re:Rootkit? No evidence of that.

[WWWWolf]

I think the article provided enough evidence as is. Yes, it is "DRM shovelware", which is an offense in itself. Yes, it's hard to uninstall, which is bad. But it's also trying to hide itself, which is really nasty, and it hides stuff indiscriminately, which is worse.

It is a rootkit, because it messes with the OS to hide specific files. It is a dangerous rootkit, because it hides all files that start with some prefix, not just the specific files used by the DRM mechanism - this could be potentially used to hide more mischief from the same source.

Re:Rootkit? No evidence of that.

[burnsy]

Don't confuse the included media player with the rootkit files. The author clearly states that 'Rootkits are cloaking technologies that hide files, Registry keys, and other system objects from diagnostic and security software', and that is exactly what is happening here.

Re:Rootkit? No evidence of that.

[majest!k]

shovelware? wtf? the author used "rootkit" because the DRM software:

-was installed without the users knowledge
-hid itself deep inside the registry/filesystem
-hooked itself to system calls
-monitored its components at the cost of the user's CPU resources
-protected itself ""
-didn't include an uninstall method
-had the potential to destroy the machine (if they attempted to incorrectly remove it)

it ran under the localsystem account ("root") and wasn't a single binary - it had several components all maliciously working together (a "kit").

http://en.wikipedia.org/wiki/Rootkit for more

Re:Rootkit? No evidence of that.

[Anonymous Coward]

He shows Sony installs software which runs in kernel mode and hooks system calls to hide itself in the filesystem, all without informing the owner. That is root and kit, he shows you the screenshot that proves the points, how can you call it "No evidence"?

Re:Rootkit? No evidence of that.

[rpdillon]

Err, he provides plenty of evidence. The one I can mention here off the top of my head is that the software patches the system service table to intercept system calls and redirects those calls to the drivers that came with the CD.

Sorry, but any software that is patching the *kernel's system service table* and intercepting calls to those services without my permission is a rootkit. It alters the fundamental behavior of the machine, does so without user's permission, and tries to cover it up. Not OK.

Re:Rootkit? No evidence of that.

[krisamico]

The "rootkit" does indeed do the things you specify, but this does not make it a rootkit, IMO. A rootkit maintains a backdoor for another entity -- one should look at intent as well as behavior when classifying these things. IMO, if there is no backdoor, there is no rootkit, though the software does indeed incorporate many behaviors in the style of a rootkit to achieve its purpose, which is to try to prevent Customers from having direct access to some data. This is isn't even a virus because it does not want to propagate. I am not sure what to call this crap other than a trojan, but I thought rootkit was hyperbole derived of the author's outrage at finding it so hard to detect and remove, which does the otherwise excellent article a disservice.

I tend to think of software more in terms of purpose than behavior, as behavior can be incorrect. Regardless of anyone's disagreement with the way I categorize this software, my comments do not intend to diminish the article's value or the pertinence of Sony's ignorance. It is clear that Sony's executives either have no clue about what their DRM software is doing or do not care -- either way, a change needs to be made.

Re:Rootkit? No evidence of that.

[Dirkyn]

Are you nuts? What would it take for you to accept the fact that Sony is using rootkit technology? What is your definition of a rootkit? Rootkits are stealth technology that enable processes/files/directories/ports/even user accounts to be hidden even from the OS itself. That seems to sum up what Sony has done here (rather clumsily actually).

Re:Rootkit? No evidence of that.

[ryanr]

IMO, if there is no backdoor, there is no rootkit,

You're welcome to your opinion, but be aware that it differs from those that work in the AV industry, InfoSec companies, and Rootkit authors themselves.

EULA's do not trump the law

[LM741N]

You can't enter into a contract which violates the law. Thus a "contract killing" is not a valid contract.

Re:EULA's do not trump the law

[terrymr]

If you want to get technical ... that would be a unenforceable contract.

Re:EULA's do not trump the law

[Anonymous Coward]

Damn - now you tell me! Does this mean I didn't have to really pay the money?

Since when did you like Trusted Computing ?

[Anonymous Coward]

You just described Palladium .. more-or-less

Better than that

[Anonymous Coward]

If it walks like a duck, talks like a duck, and looks like a duck, then it is a duck.

Whoa! What you actually have there is a talking duck. Start negotiating the TV show and merchandising options immediately!

Re:Better than that

[Rei]

I've been randomly having to stifle laughter for the past fifteen minutes. Thanks a lot ;)

Re:Better than that

[bhtooefr]

Can it say "AFLAC"?

Re:Better than that

[SoSueMe]

Given the "duck" reference and it being Hallowene and all, what do we do with witches? Burn Them!

Here is what a kid had to say...

[cyclocommuter]

...after he tried to rip another Sony produced CD "Healthy in Paranoid Times" by the Our Lady Peace:

Disappointing, to say the least..., October 14, 2005

A Kid's Review (Amazon.com)

I tried copying this CD, not knowing that it was protected. So, I ripped it to my hard-drive and burned it. But, when I inserted the burned copy into my computer, the screen froze for a while, and an installer icon appeared on the taskbar in the bottom right. It installed somthing - and now I cannot burn anything, with any program. I've even tried using a different, external CD burner. A disk error comes up during burning, even if I am not not burning audio CDs. This was not a fluke. I've talked to other people this has happened to. Avoid anything with "copy protection." Sony might as well burn viruses onto the CDs they distribute.

Re:Here is what a kid had to say...

[Anonymous Coward]

Has this review been censored?

I cannot find it.

Sony, do us a favor

[Spy der Mann]

Stick to the gaming business and let us play our fsking music.

Arigato -_-

It's immoral to buy RIAA music

[Jason1729]

I used to buy a lot of CDs but stopped around the time of the napster lawsuit. I would probably still be buying 2-3 discs/month if I didn't consider it immoral to buy CDs.

Re:It's immoral to buy RIAA music

[lavaface]

I hope you are just talking about RIAA discs, because there's a ton of stuff being produced by small, independent artists that could use your support.

Let Sony music know how you feel

[babaloo]

At http://www.sonymusic.com/about/feedback.cgi

Awesome

[suwain_2]

On this CD's product page, there are several negative reviews on account of spyware. My favorite puts into plain English why this is bad: "I am very unhappy, since I now listen to all of my music using my IPod."

I think this is the way to fight DRM. When we complain about DRM rights, we're fighting a crusade on principle, and few people really get what's wrong. When you say, "This CD that I paid for can't be transferred to my iPod," people will see that it's outrageous. When people see that it's installing spyware on your computer, they'll flip. Cheers to whoever's left this feedback.

Re:Awesome

[Fo0eY]

everyone should visit amazon and mod up those informative links as "helpful"
seems strange that most of those kinds of reviews are currently all being modded down

Re:Awesome

[Reziac]

I read all the reviews. Some of the totally-positive reviews smell suspiciously like astroturf, or to be exact, like press releases. One has to wonder if that's an attempt to counter the flood of reviews that are negative solely by reason of the DRM/rootkit.

no server room music

[dindi]

we used to pop in a CD in the server room into the servers to listen to something other than that warm fuzzy hum, or cold blowing of the airco, or the shouting of the 5 vents on the cisco access servers .....

of course then there wasn't drm, nor we had software, just the play button on most of the cd drives....

not a good idea anymore?

it wasn't a good idea either since those over used cds messed sometimes with the drives (e.g. when linux refuses to eject or do anything other than presenting a LOOOOOONG atapi error running on the console ....

but well back then sysgodz (OK, that is a lame word) were allowed to do all kinda crap, besides no puny humans entered the restricted refrigerator area :) other than cleaning staff to take the 256^2 dirty coffe cups from the corner and to clean up the "accidentally damaged" remains of shattered keyboards ....

Re:no server room music

[Flower]

It wasn't a good idea back then! I'm... I'm just at a loss for words.

Replying to other people's posts

[Anonymous Coward]

Step 1. Use the Reply to This link to get a form to reply to someone else's post.
Step 2. Post your reply.
Step 3. ...There is no step 3. There's no step 3!

It is NOT a rootkit

[hal9000(jr)]

Kids, read the entire blog. It's a piece of DRM software that hides itself.

Mark doesn't say whether it open a backdoor or does anything nefarious other than hide.

I agree that it sucks and is a bad move by Sony, but I have seen other pieces of DRM. A recently purchased Dave Matthews CD, I think Stand-Up, used some piece of shit driver on the CD that installed a CDROM shim when auto-play activated. I didn't read the case before I bought it where there was mention of DRM software on the CD (otherwise I wouldn't have bought it), but the warning was there in little type.

Re:It is NOT a rootkit

[sqlrob]

It does almost exactly what Hacker Defender does.

Are you saying Hacker Defender is not a rootkit?

Re:It is NOT a rootkit

[rpdillon]

As I said above, any software that patches the kernel's system service table to redirect system calls to trojan software without permission while hiding (and making itself impossible for your average user to remove) is a rootkit. It only makes it worse that it *never stops running* and *starts up even in safe mode*. These are all hallmarks of a rootkit. Just because it doesn't send spam and all your passwords/credit card numbers to a server in Russia doesn't mean it isn't a rootkit.

Re:It is NOT a rootkit

[object88]

It's a piece of DRM software that hides itself.

It's a piece of software that hacks into, essentially, a kernal function lookup table... isn't that by definition a rootkit? Sysinternals defines a rootkit as "the mechanisms and techniques whereby malware, ... attempt to hide their presence...". Arguably, DRM isn't malware, but I take the stance that it is as it prevents me from exercizing my rights (hence, malicious). Would you disagree?

Re:It is NOT a rootkit

[hal9000(jr)]

Are you saying Hacker Defender is not a rootkit?

Hacker Defender is a root kit because it has the capability to backdoor the system it is installed in. As in remote attacker can connect to this port and control the machine.

The DRM that Russinovich describes does't seem to make or listen for network connections nor does it seem to do anything other than hide itself, stop user from ripping CD's and other stuff.

Re:It is NOT a rootkit

[EddWo]

The "hiding itself" part is what makes it a root kit. It disrupts the normal operation of your operating system without permission. With it installed any file starting with "$sys$" will become undetectable to everything but the most specialist tools. Network connections are not required.

Re:It is NOT a rootkit

[sqlrob]

Backdoor has nothing to do with whether or not it's a rootkit, that is simply one of the common things a rootkit is used for.

It's kernel level code that hides itself and other things. As other posters have said, if it looks like a duck and quacks like a duck...

Re:It is NOT a rootkit

[qeveren]

It indescriminately hides any file beginning with "$sys$". Not just its own files. Any file. Now tell me this isn't a rootkit.

Van Zant

[mOdQuArK!]

Has "Van Zant" or their agent made any comment on how they feel about what Sony is doing to their audience in their names? (Would they even understand what Sony has done?)

*phew*

[Alan]

I'm glad I get my music off of p2p networks and don't have to worry about trojans and rootkits and that evil hacker stuff!

Re:*phew*

[neovoxx]

I wouldn't be so sure that was a joke. With good virus protection, I don't have to worry about this DRM and rootkit from Sony BS. Whatever happened to the days when you could legally purchase an MP3 from a legitimate website and burn, transfer to PDA, iPod, etc. without having so many insane restrictions. Now, I know that if piracy on a large scale hurts the artists, but when they make only a dollar or so per album sold, who's the one actually getting screwed? The artists and ourselves. The **AA bigwigs are the only ones laughing all the way to the bank.

Re:*phew*

[CRC'99]

Usenet is faster.... or so I've heard....

Re:*phew*

[John Muir]

Step 1. Get pissed off with illegal file sharing
Step 2. Make the legal alternative poisonous to loyal customer's hardware
Step 3. PROFIT!

Re:*phew*

[owlstead]

This is funny? I've got 4 official DVD's that won't run on my player, and 3 or 4 CD's that don't play in my computer. If *they* are not going to play fair with me, I sure as hell will return the favour. I bought an offical DVD, and all I got was a cheap skate menu and 10 minutes worth of adverts and warnings. Bleh.

Re:*phew*

[Anonymous Coward]

you know what's funny, i've downloaded gigs and gigs of pirated stuff off irc over the last decade, and i can't recall getting ONE virus/rootkit/spyware program that came with what i downloaded.

i trust the pirate groups more than i trust the companies.

Re:*phew*

[Anonymous Coward]

I would say the parent is more Informative than Funny. Nowadays you can get a non-DRM copy of ANYTHING from p2p of the day, usenet, irc - you name it. In many cases you get full quality as well (full DVD rips, lossless compressed CDs). Easy to copy/back up, easy to watch. CDs with spyware, DVDs with non-skipable warnings, zones and whatnot, books with printing/select/exporting disabled and so on. And if anyone thinks this is to protect the rights of the authors how about this one:

Title : US Constitution with the Declaration of Independence
Size: 123Ko
Price

3,86 / 4,65 $

Caution : this ebook is copy protected with Microsoft DRM 5 system ("owner exclusive ebook(s)"). This means that it will be possible to read it only on the devices activated with the same Microsoft Passport account. Reading requires the last version of Microsoft Reader, which runs only on PC computers equipped with Windows 95 or later and on Pocket PC PDA's equipped with Pocket PC 2002 or later. This ebook cannot be lent, nor printed. Text-to-Speech add-on is not available.

Click here Click here for more information on Microsoft Reader and activation
Activate my public domain paid-for book?! Give me a break.

Re:*phew*

[dascandy]

mod parent "+5 scary, not funny anymore"...

Re:*phew*

[TCM]

i trust the pirate groups more than i trust the companies.

That's the most insightful comment I've read in this whole discussion.

Re:*phew*

[Anonymous Coward]

This is inevitable, because whilst the music cartels have a monopoly and hence no real requirement to not do this stuff, to charge fair prices etc, there's no monopoly on pirated stuff. If a group starts releasing bad/trojan files it'll die so fast nobody will remember it in a months time. Hence any large, organised internet pirating group is bound to have incredibly reliable releases and quality because if they didn't, they wouldn't be around.

For a similar situation, see the anime fansubbing groups and the same reputation-based social grouping.

Re:*phew*

[Scarletdown]

Title : US Constitution with the Declaration of Independence
Size: 123Ko
Price

3,86 / 4,65 $

Caution : this ebook is copy protected with Microsoft DRM 5 system ("owner exclusive ebook(s)"). This means that it will be possible to read it only on the devices activated with the same Microsoft Passport account. Reading requires the last version of Microsoft Reader, which runs only on PC computers equipped with Windows 95 or later and on Pocket PC PDA's equipped with Pocket PC 2002 or later. This ebook cannot be lent, nor printed. Text-to-Speech add-on is not available.

Fortunately, both the Constitution and the Declaration can be downloaded free and without any DRM.

http://www.gutenberg.org/etext/5
http://www.gutenberg.org/etext/1

And Sony blows it again

[Anonymous Coward]

At this rate, they're looking at a buyout within a decade. I hope it's MSFT that buys them out.

EULA?

[Henk Postma]

Wouldn't there be some kind of limitation on the EULA anyway? I never understood this, so perhaps some legal expert can advise:

1. Most extreme case: writing a letter saying someone is allowed to kill you, doesn't give the killer the right to kill you. They will still get tried, because they are still breaking the law. It is my understanding that the law is more important than any document you write, right? This is why euthanasia is such a hard issue in the USA ...

2. Now back to the EULA, where it seems that somehow I can waive my right to expect stuff not to break my computer.

Which is right here? 1. or 2.?

More evidence of rooting

[ferretous]

No no no no no - lets get this right - rootkits only permit you to root a *nix system. On Windoze systems, the System Administrator is already rooted.

Re:More evidence of rooting

[Tony Hoyle]

OK maybe it's an Administratorkit...

mod parent up

[Anonymous Coward]

The most insightful comment ever. I hope DRM enters every aspect of our lives just to piss off all you faggots. WE MUST PUT DRM ON TEH INTERNETS.

Not very good DRM

[oboreruhito]

It's worth noting that the DRM in question, which prevents a CD from being ripped into an iPod-compatible format, can be circumvented by the following step:

1.) Insert CD into a Macintosh

(And yes, little Timmy, Linux/BSD/FreeDOS/whatever)

Why won't sony post the EULA??

[tx_kanuck]

I did a quick search on Sonymusic.com for EULA, and got nothing in return. I looked in their help section, and saw nothing. Gee, I wonder why they won't post that..........

Wouldn't happen if you dont run MainstreamOS.

[smallstepforman]

I'm really suprised by the comments here at Slashdot. Slashdot used to be the refugee of technology enthusiasts, who would flock to newer/interesting/alterantive technologies. This used to be the meeting place of people running various Operating Systems, from the exotic (Plan 9 / Elate) to the antique (Amiga...), and everything in between. The community used to be proud of not running a mainstream OS. Having read the article and the comments, I expected a "MEH" and "not a problem on my system" type of response. Instead, I see lots wannabe devotees, but in their hearts and their desktops, they run the Mainstream OS (*gasp*). Typical case of of do as i say, not as i do.

Well if the reader base of Slashdot alone used a non-mainstream OS, Google statistics would shold an increase in the number of alternative OS's, and this would in a round-about way remove this root-kit problem all together, since at the end of the day, there would be no financial incentive by Sony (or others) to finance a DRM and copy protection scheme which would only be effective for

Want to stop this nonsense from happening in the future? Actually run a non-mainstream OS. That shouldn't be hard for most of the visitors of this website, shouldn't it?

Re:Wouldn't happen if you dont run MainstreamOS.

[spaceyhackerlady]

Want to stop this nonsense from happening in the future? Actually run a non-mainstream OS. That shouldn't be hard for most of the visitors of this website, shouldn't it?

Indeed. I've actually been a little disappointed with the DRM on CDs. When I put them in my Linux boxes they just play. I can rip to MP3 until the cows come home. No problem.

I actually wanted one to fail so I could see how it was failing and maybe do something about it. Contribute something to the community, ya know.

...laura, not a U.S. resident, not covered by the DMCA

Re:Wouldn't happen if you dont run MainstreamOS.

[Anonymous Coward]

Are you kidding? Judging by the comments on Slashdot most people here, as just about everywhere else, are idiots. That's why they don't run other operating systems. They're the same morons you see spouting off on some Windows site about how l33t they are because they hax0red their machine and changed the boot up screen. Then they come here and talk about how great Java or Lisp or Linux or whatever is even though they barely know how to use it.

Slashdot is nothing special. Look at the browser stats, 90+ percent Windows/IE. They don't even use alternative browsers. Slashdot is mainstream.

Re:Wouldn't happen if you dont run MainstreamOS.

[Anonymous Coward]

Want to stop this nonsense from happening in the future? Actually run a non-mainstream OS.

Or at least run Windows under a limited user account. System-wide crap like this requires admin access to install. (not an actual guarantee)

Re:Wouldn't happen if you dont run MainstreamOS.

[tyldis]

Which is funny, because the record companies insists on claiming that this is to hurt the 'big guys' and that the problems the average user has is just collateral damage. Seeing how easy it is to circumvent that argument fails miserable.

Sony is protected by the DMCA

[dmoen]

I see this as a real exposure to a lawsuit. If I accidently install this rootkit on my system, then try to remove it...

If you do this, then you are deliberately disabling a copy protection system, which is illegal under the DMCA. So Sony can sue you.

[Note: this varies with your jurisdiction. No DMCA in Canada, yet.]

Doug Moen.

Re:Sony is protected by the DMCA

[hazem]

Doug, I think you're wrong.

I can disable a copy protection system on my own computer - specifically removing it. They didn't have permission to put it there, and I think it would be a tough case to prosecute me for repairing my own computer. My computer is not Sony's medium to do with as they please - it's MINE - I paid for it, and I licensed the software.

Now, removing the protection from their media - or extracing the content and freeing it from the DRM, yes, that's circumvention, and probably prosecutable under the DMCA.

But my computer is MINE and they don't have the right to secretly fuck with it.

Re:Sony is protected by the DMCA

[drewxhawaii]

so if i install it and DON'T try to remove it, can i sue them?

Re:Sony is protected by the DMCA

[ickleberry]

My computer is mine, they shouldnt even be allowed to put code on it that limits what I do with my own computer. They dont have the right to fuck with it, secretly or not.

Re:Sony is protected by the DMCA

[kubevubin]

Assuming that the installation of this rootkit is entirely automated with no user prompts, I don't see how Sony could put together any sort of defense. I mean, the simple fact of the matter is that their lack of responsibility caused damage to consumer property.
You know, between this, that defective camera component fiasco, and cutting an assload of jobs, I'd hafta say that Sony isn't doing so well. Heh. I can't wait to see how the PlayStation 3 launch turns out.

Re:Sony is protected by the DMCA

[redcone]

IANAL but it seems to me he didn't set out to disable a copy protection scheme. He set out to identify the source of a potentially damaging program installed without his knowledge or consent. I think it is unlikely that SONY could successfully invoke DMCA protection under those conditions (though I realize that putting the rights of consumers ahead of corporations is happening less and less in US courts)

Re:Sony is protected by the DMCA

[Andrew Tanenbaum]

They don't put it there. You do. They just packaged it for you. If you didn't want to give them permission to run arbitrary executables on your computer, then WHY DID YOU RUN THEIR EXECUTABLE??

Re:Sony is protected by the DMCA

[indigoid]

indeed. for the purpose of deciding who is running something, is autorun.inf "us" or "them" ?

Re:Sony is protected by the DMCA

[MikkoApo]

Autorunning executables from cds' autorun.inf is the default action in some of Microsoft's OSes.

Re:Sony is protected by the DMCA

[KarmaMB84]

because windows runs them automatically?

Re:Sony is protected by the DMCA

[br0ck]

Suing them IS trying to remove it, so suing them invokes the DMCA.

Re:Sony is protected by the DMCA

[shadowkin]

I really think it would depend on whether or not the CD had a EULA printed in the booklet. If it did, then technically you would consent to its install.

But then that brings up EULAs and is a horse of a whole different color.

Re:Sony is protected by the DMCA

[pjbgravely]

How is it going to install without you knowing,
that is unless you are running as Root/Admin,
and who in their right mind would do that?

Re:Sony is protected by the DMCA

[Anonymous Coward]

Probably becase the executables were run without the user's permission under the guise of being something else.

I doubt highly that there was a box saying "We would like to install a rootkit on your machine. Press OK to continue."

Re:Sony is protected by the DMCA

[shibashaba]

Consumer puts a cd into their computer with the intention of playing the cd. The cd takes advantage of a feature in Windows and installs software in the background without your knowledge. No court would find Sony not liable for damagaes caused because the user didn't disable autorun. It's the same as an email viruses, just because the user never turned off macros doesn't let the person who runs the virus off the hook.

This isn't the first time Sony's had this idea. Years ago they asked someone to write a virus to subliminally provide marketing to people. This motivated the person they asked to write a book called Coercion.

Re:Sony is protected by the DMCA

[Fnkmaster]

I call BS on this. When you put what you think is an audio CD in your CD ROM drive and click on the drive icon, you don't expect to be giving permission to anybody to install a rootkit.

Furthermore, your argument is simply insane, even if applied to software CDs. Do I give permission to any software vendor to install anything they want when I run the installer executable? Do I give them permission to wipe my hard drive? Install malicious, intentionally uninstallable programs? Monitor my activities when not using their software?

Even the most ardent proponent of EULAs couldn't make the claim that you give such permissions by default. Unless they specifically ask, they don't have permission to do anything that isn't specifically part of the product as a reasonable person would perceive it to be.

Re:Sony is protected by the DMCA

[Sylver Dragon]

I would bet that, when you install their player, the EULA has a line in it about Sony, or whoever, not being responsible for and damage caused to your machine. e.g. A general "not our fault" clause. And once you click "I agree" you've pretty much let them off the hook. Granted, you might be able to get a judge to throw that part of the EULA out, or might even get this piece of software exempted from that clause, since they knowingly are damaging part of your system, but you'd be in for a long legal fight.

Re:Sony is protected by the DMCA

[Braedley]

It's an autorun. If you aren't fully forewarned (like I was for another of Sony's CDs), you have no choice but to install the software. Also, although it's hear-say, there are some specifics about the software that isn't mentioned in the EULA (which, for once, I did read (well, at least some of it)). And if I'm not mistaken, there is some DRM software installed before you even agree to the EULA, just so that if you don't agree, you can't go back and do it properly.

Re:Sony is protected by the DMCA

[hey!]

Are you being ironic? If so you're being a bit subtle even for me, which is a bit like having breath that smells bad to a wino

Re:Sony is protected by the DMCA

[shibashaba]

Sorry, last sentence should be let whoever wrote the virus of the hook.

Re:Sony is protected by the DMCA

[jefe7777]

autorun? ok. so we sue microsoft. ;-)

Re:Sony is protected by the DMCA

[dnoyeb]

There is a such thing as good faith. You cant make an escuse to shit in someone's dining room just because they let you in their house can you!?

Re:Sony is protected by the DMCA

[mrBoB]

Unfortunately, this is only something that could be dealt with at a trial. Whose rights are more valuable, the content provider, or the paying customer? A person has a reasonable expectation of privacy and security on his or her home computer. Any attempt to circumvent this privacy or security should be construed as trespass. On the flipside, recording artists and the companies that represent them have an expectation that their work is compensated, and that "legal" means to protect their interests be respected. I'm not arguing for the DMCA here, however it _IS_ law. By removing the Sony-installed malware, Mark has broken the law. But so is trespass illegal, so tell me, which is a greater abomination?

      I'd vote for trespass, but I also don't have any content to sell. Mark, how's the adminpak selling? I hope you've got some good DRM on your CD's if you're any indication of the talent that's out there...

Re:Sony is protected by the DMCA

[Arapahoe Moe]

And if I put it there, then I can remove it. Why? Because I own the hard drive and all the magnetism inside of it. The same thing can be accomplished via reinstalling the OS or running a magnet over my hard drive. This is not in any way different except in semantics. It's all just 1s and 0s.

Re:Sony is protected by the DMCA

[stonedonkey]

Even the most ardent proponent of EULAs couldn't make the claim that you give such permissions by default. Unless they specifically ask, they don't have permission to do anything that isn't specifically part of the product as a reasonable person would perceive it to be.

And the EULA doesn't mention this rootkit or anything like it, from what I've read. In my opinion, I have the right to create a secure environment for my data, and the rootkit subverts that. Since the EULA doesn't mention it, I'm free to remove unauthorized the unauthorized code.

Bad Sony! No biscuit!

Re:Sony is protected by the DMCA

[andy_t_roo]

And if I'm not mistaken, there is some DRM software installed before you even agree to the EULA, just so that if you don't agree, you can't go back and do it properly.
in that case agree to the eula, then remove the DRM that was installed before you agreed to it . .

Re:Sony is protected by the DMCA

[Anonymous Coward]

becuase it didn't say...
"this will compromise your system" on it.

Re:Sony is protected by the DMCA

[Suddenly_Dead]

An EULA in the booklet? Do you have to read and click agree on the booklet before you can use the CD? A contract like that isn't going to hold up if one party doesn't agree to it in the first place, or may not even have knowledge of its existance.

When I buy a CD, I shouldn't have to expect it to install a rootkit, and have to check the included materials to see if it does; it's Sony's responsibility to tell me they're messing with my software, and ask for consent...

Re:Sony is protected by the DMCA

[Anonymous Coward]

17 USCS 1201 (2005)

  1201. Circumvention of copyright protection systems

(a) Violations regarding circumvention of technological measures.
      (1) (A) No person shall circumvent a technological measure that effectively controls access to a work protected under this title. The prohibition contained in the preceding sentence shall take effect at the end of the 2-year period beginning on the date of the enactment of this chapter [enacted Oct. 28, 1998].
            [...]
      (2) No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that--
            (A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title;
            (B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or
            (C) is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.
      (3) As used in this subsection--
            (A) to "circumvent a technological measure" means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner; and
            (B) a technological measure "effectively controls access to a work" if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work.

(b) Additional violations.
      (1) No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that--
            (A) is primarily designed or produced for the purpose of circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof;
            (B) has only limited commercially significant purpose or use other than to circumvent protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof; or
            (C) is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof.
      (2) As used in this subsection--
            (A) to "circumvent protection afforded by a technological measure" means avoiding, bypassing, removing, deactivating, or otherwise impairing a technological measure; and
            (B) a technological measure "effectively protects a right of a copyright owner under this title" if the measure, in the ordinary course of its operation, prevents, restricts, or otherwise limits the exercise of a right of a copyright owner under this title.
[...]

Re:Sony is protected by the DMCA

[Taladar]

For that matter who would let autorun enabled more than a few minutes after a fresh windows installation? It gets disabled right along with the stupid "hide file extensions", non-classic themes, non-classic start menu, IE links, the standard desktop wallpaper and the system sounds. Not to mention a few other things I almost certainly forgot now but never forget after a windows install as they are simply to ugly default settings to not notice them within the first few hours of actual system use.

Re:Sony is protected by the DMCA

[Dark_Lord_Prime]

Unless the EULA also has a line (or lines) about "You hereby authorize us to install this malware on your system, thereby exempting us from any and all future lawsuits resulting from such", then it doesn't absolve or excuse them from installing the software without your knowledge.

As for removing it being a breach of DMCA, the DMCA makes it illegal to disable or circumvent the DRM measures for the purpose of copying the content, doesn't it? If you simply remove the unwanted software, you are not "disabling or circumventing," because it will be reinstalled every time you attempt to use that CD in your system. The only thing that would make removing it completely illegal is--as someone else mentioned--copying the CD and removing the rootkit from it, thereby allowing you to use the CD without
(re)installing the malware with it.

Re:Sony is protected by the DMCA

[unixbugs]

WHY DID YOU RUN THEIR EXECUTABLE??

Oh shut up Andy. Insightful enough for this site, but what else are 'they' gonna do? Quit buying music? Good one Sony... just one more reason not to use Windows. I bet the BSA is REAL happy about THIS little debacle. Chalk up another one for OSS!

Give me Monolithic Kernels or give me death!!!

Re:Sony is protected by the DMCA

[Anonymous Coward]

mod parent up, that is the (I won't say ironic, lest I be called A.M. reteatedly, with extreme prejudice) truth.

Re:Sony is protected by the DMCA

[j-cloth]

Even that would be a tough thing to argue, given that Sony tells you how to get around their DRM in order to import songs onto the iPod

Re:Sony is protected by the DMCA

[Dark_Lord_Prime]

In that situation, you have their permission to do it, which would, one would assume, negate any protection they might have (or had) under DMCA, right?

Re:Sony is protected by the DMCA

[j-cloth]

wonk wonk blame windows.
I would call this one more reason to not buy music from Sony. I have no problems listening to music from (almost) any other label on my computer -- regardless of the OS.
I have contacted several bands on the Sony label and explained my reasons for not buying their CD (I do buy a LOT of CDs and would have bought CDs from these bands but I cannot agree to the licensing terms). If the consumers can't force Sony to behave, perhaps the artists can.

Re:Sony is protected by the DMCA

[Anonymous Brave Guy]

They'd better hope it's them, because if it's us, then it's not circumventing their copy protection scheme to hold down shift while I load the CD, is it?

On the other hand, if it's them and they install software on my PC without my permission in the UK, my lawyer would like to talk to them about the Computer Misuse Act.

Oh dear. This sounds like a lose-lose proposition for Sony. That's really, y'know, too bad and all. :-)

Re:Sony is protected by the DMCA

[bahgheera]

I can disable a copy protection system on my own computer What makes you think its your computer?

Re:Sony is protected by the DMCA

[despisethesun]

I have the right to create a secure environment for my data

You're right, you do, but by leaving the Autorun "feature" on, you have failed to create this secure environment. That's not to say what Sony did was right, but if Autorun is what lets Sony install this rootkit, it would be easily preventable.

Re:Sony is protected by the DMCA

[j-cloth]

My take on it is that since Sony itself publishes ways to get around the DRM (email them, they'll give it to you) all of the crap they put on the CD can't even be called a rights management system -- it's more of a barrier to entry than anything else. As such one could argue they never had any rights under DCMA to begin with.

Re:Sony is protected by the DMCA

[badmammajamma]

No, it is placed there without the user's knowledge. He cannot give permission for something he doesn't even know is there.

Re:Sony is protected by the DMCA

[laughingcoyote]

I'm not sure what jurisdiction -you're- in, but the last I checked anywhere, those general "not our fault" clauses don't mean a thing against something done intentionally. If you are with full awareness doing something malicious, that is a totally different animal then accidentally releasing bugged software, and "not our fault" won't even begin to protect them.

Re:Sony is protected by the DMCA

[arminw]

....When you put what you think is an audio CD in your CD ROM drive and click on the drive icon,....

On a Mac, when you put an audio CD in the drive, iTunes opens and you get music. If there were some Mac version of a rootkit installer malware on a DRM-ed CD you would get a window asking for a password, but ONLY after clicking on the installer's icon. There is absolutely NO way to install such crap on a Mac by simply clicking on the CD disk icon or merely putting a CD in the drive. Only after giving the admin password would such garbage be able to install. Around here, none of the users know the admin password. I would fault the insecure Windows OS for a) autorunning the software on a CD and b) for allowing users write access to the deepest system internals without the slightest warning or notice. If Windows were more secure, such dastardly exploits would be a lot harder, although not impossible, since stupid users that know the admin password would likely type it in. Still for a commercial company to stoop to such tactics is abominable and probably skirts the edges of the law.

Re:Sony is protected by the DMCA

[zcat_NZ]

Note that Sony don't tell you how to get a GOOD mp3 copy (rip the CDDA tracks using cdex)

They tell you to burn a CD in media player which I expect would taken from the protected WMA files, then use media player to convert it to MP3 which introduces even more quality loss. Not to mention that Windows Media's MP3 encoder is really, really shitty (Intentionally so, because they want to make WMA look good in comparison)

The only reason Sony published this advice is the hope that people will find their advice first, and are less likely to stumble on _better_ advice such as using cdex..

Re:Sony is protected by the DMCA

[plilja]

Actually, many folks misread this section of the DMCA. The DMCA allows an individual to circumvent copy protection for thier own use through the "fair use" provision.

What it prohibits is the disemination of knowlege and tools on how to circumvent copy protection.

Anyone is free to do anything they want to rid themselves of any copy protection on media they own...as long as they keep the knowlege of it entirely to themselves. (There are some exceptions for encryption research and, to a lesser extent security research, as well)

Re:Sony is protected by the DMCA

[Shelled]

Considering the intent of Copyright was a limited short-term monopoly on commercial distribution for the promotoion of Art and Science in society, and not the 'ownership' monster those distributors have created, that's an easy one to answer. In a sane society that is, out here in corporate lobby land it's anyone's guess. I do however find it ironic that a foriegn multinational appears to be protected by law from repurcussion for in effect hacking American computers to 'save the artists.' How far we've traveled.

Re:Sony is protected by the DMCA

[mindstrm]

Err, circumventing copy protection mechanisms on your own gear is legal, I believe.
It's distributing methods or devices for circumventing this protection that is illegal.

Re:Sony is protected by the DMCA

[Anonymous Coward]

I recently bought Idlewild's latest disc. It's not Sony, but EMI. When I pop the CD into my computer, it asks me if I want to install DRM technology on my computer. So technically, I am specifically telling the disc manufacturer that they can run an executable. Sony's discs probably work the same.

In order to get the tracks into MP3 without installing the DRM, the latest Windows Media Bloat Center, burning to a blank CD and ripping... I just listened to the CD through its Flash media player and did a little man-in-the-middle recording. I can probably be sued for this. However, EMI has explicily given me directions on circumventing the DRM by means of the CD burning technique, so I feel they are giving me license to break the DRM however I see fit at this juncture.

*sigh* I can't wait to tell my kids someday how easy it used to be to listen to music.

Re:Sony is protected by the DMCA

[arminw]

....can i sue them?....

Of course you can. Anybody can sue anybody for anything in our corrupt legal system. But you better make sure you have more money to spend on legal expenses than they do. It's all about money, not liberty and justice for all.

Re:Sony is protected by the DMCA

[spagetti_code]

I dont think this is right.

He didn't remove the DRM for access to songs.

He removed the DRM from his computer (effectively
a manual uninstall). They did imply in the document that he was allowed to uninstall it.

Re:Sony is protected by the DMCA

[Bastian]

I'm not convinced that removing the rootkit from your computer would be a violation of the DMCA. However, I only read it once, and that was several years ago, and the damn thing is longer and more tangential than a Tolkien book, so I'm not about to go supporting my claims.

The basis of my argument would be that, if you are just taking the rootkit off, it wouldn't be a circumvention of the copy protection, because the rootkit would be reinstalled as soon as the CD is inserted again. Of course, this means that you couldn't remove the rootkit and then someohow prevent it being installed again - you'd have to get rid of the CD.

I think the much hairier question is, is putting one of these Sony DRM-encumbered CDs in a Macintosh a violation of the DMCA?

Re:Sony is protected by the DMCA

[kg4gyt]

Under most law it is illegal to put software on a computer without first letting you know what it is going to do to your computer, unless they state that the EULA that the "rootkit" will be placed on your computer, then placing it there is the falls in the same category as a virus, deceiving the user to place software on your computer, therefore giving you every right to remove it.

Re:Sony is protected by the DMCA

[kd5ujz]

Does anyone have a copy of the ULA? I would assume it mentions something about this software, but since no one ( or almost no one) reads the damn thing, sony can mention it, and not worry about people resisting the install.

Re:Sony is protected by the DMCA

[gstoddart]

They don't put it there. You do. They just packaged it for you. If you didn't want to give them permission to run arbitrary executables on your computer, then WHY DID YOU RUN THEIR EXECUTABLE??

See, the problem with this is you did not give them permission. You didn't even run their executable. It happened without your expectation, knowledge, or consent.

You popped in what you thought was a nice little audio CD. Because Microsoft has been configured to run the software on these CDs by default, you end up running it -- that's not permission. When you put in an audio CD, you expect to hear, well, music. Not to have something installed on your computer which compromises its security.

You can't say that someone accepted terms of use when Microsoft, acting in conjunction with these companies, decided that what needs to happen is that any CD with executable code on it needs to be executed blindly and without user confirmation.

For the vast majority of users, playing a CD in their computer is shockingly like playing a CD in their CD player. It is neither a tacit nor an explicit agreement to run any and all software they may have installed on it.

It is a complete mis-representation to claim that you gave permission for them to do anything they wanted to do with it. If I open my door to a solicitor, that doesn't give them the right to enter my home and do anything they damned well please.

This absurbd notion that what is, in effect, trojan software has been accepted by the user simply because they decided to play an audio CD in their computer is complete and utter tripe. And saying that you "should have known better" is a complete cop-out -- we already know that the vast majority of computer users simply lack the knowledge to prevent this sort of thing. Especially when the OS manufacturer has decided a priori for you that is what will happen.

Now, if they put in big honking letters on the CD case that if you play this CD on a Windows machine, software will be installed on your machine, your argument might have merit. But the simple fact that it is NOT spelled out in big font, means that, for all intents and purposes, this is a trojan.

Imagine extending this totally absurd argument to credit cards -- 'by handing your credit card to the waiter to pay your bill, you tacitly agree to paying for the staff trip to Aruba'; Oh, didn't know? How dare you? It's a bullshit argument in either case, because you imply consent where, clearly, none was given.

In either case, you show me where the user has actually agreed to anything, and your point might be valid. Otherwise, it's after-the-fact rationalization based on the absurd notion that the user knew what would happen.

Now, I realize as I'm writing this that your ID lists you as Andrew Tanenbaum -- so I'm forced to conclude one of two things -- 1) It's a popular, but misleading name on Slashdot, or 2) the Great Andrew Tanenbaum has absolutely no clue about what is reasonable for a company to do to the end-users machines. In either case, I'm not impressed. If 2), then you're just a standard Slashdot schmoe, and I expect nothing more, but you're still misinformed. If it truly is 1), then I've lost a great deal of respect for you -- because a professor of this stuff should know better, because you bloody well get paid to be informed about this stuff. Asserting that you somehow gave permission somewhere in that process is utter crap! An agreement I was never shown is null-and-void.

Cheers

Re:Sony is protected by the DMCA

[drgonzo59]

But is the disk you bought technically "their" media or yours? You payed for the disk just like you payed for the computer. Is the little piece of plastic and aluminium actually Sony's property?

Then also, if you say that the disk is theirs and the computer is yours, the software on the disk should play on your computer so it has to "mess" somehow with your computer. Obviously the old way when you just bought the data and played it as a passive data stream wouldn't work with DRM too well. By having DRM they technically will have to fuck with your computer to stop you from doing certain things with it (like copy their music). So I think what you really meant to say is "fuck DRM" wich I agree with.

Re:Sony is protected by the DMCA

[jim_v2000]

Of course, there's the part in the license about being able remove or delete the software. However, when I tried to do this (delete the files related to the program), I guess it broke the driver and Windows wouldn't boot.

Re:Sony is protected by the DMCA

[coaxial]

I don't know if the rootkit is part of the DRM system or not, but you can't install a rootkit on someone's computer without their permission. Simply saying, "You need this to play the music," isn't enough. You have to say, "You have to let us install something so that we can monitor and control your computer remotely or you can't listen to the music." If you don't spell it out, then you're commiting "cybercrime." People have gone to jail for saying less than , "this will let you play music."

Re:Sony is protected by the DMCA

[sd_diamond]

On the flipside, recording artists and the companies that represent them have an expectation that their work is compensated, and that "legal" means to protect their interests be respected. I'm not arguing for the DMCA here, however it _IS_ law. By removing the Sony-installed malware, Mark has broken the law.

I don't think it's so clear-cut, even strictly within the bounds of the DMCA. Yes, he disabled their DRM by removing the malware, but that does not count as "circumventing" the DRM (the real issue under the DMCA as I understand it) because it doesn't get him any closer to being able to copy the content of the CD.

Of course, as you say, this is one of those legal Heisenberg zones that will not take on a definite value until/unless it is determined in a court of law.

Re:Sony is protected by the DMCA

[Pofy]

> would bet that, when you install their player, the EULA has a line in it about Sony, or whoever, not
>being responsible for and damage caused to your machine. e.g. A general "not our fault" clause. And
>once you click "I agree" you've pretty much let them off the hook.

Good thing many civilized countries have consumer protection laws that either forbids or simply voids such terms though.

Re:Sony is protected by the DMCA

[Anonymous Coward]

The is presumably something installed silently through an autorun is it not? By your logic the stoned virus is something you "install" on your computer by errantly leaving an infected floppy disk in your computer on reboot.. Heh, I said stoned.

Re:Sony is protected by the DMCA

[ajdlinux]

Is the rootkit actually DRM? It seems to be software installed along with DRM, and it also seems to not be protected by an EULA.

Re:Sony is protected by the DMCA

[Xanlexian]

I paid for it, and I licensed the software.

Slightly off topic, but this is part of the mentality that is screwing all if us over. You just accept that you are "licensing" the software, and you no longer own your own copy. Excellent comment, otherwise!!!

--Xan

Re:Sony is protected by the DMCA

[CaptnMArk]

Except that autorun is not easy to disable for most people.

(but it should be (and by default),
cause it can be a serious security hole)

Re:Sony is protected by the DMCA

[CrossChris]

>>My computer is not Sony's medium to do with as they please - it's MINE - I paid for it, and I licensed the software.

Nope. Examine the license for your "operating system" - it pretty much allows for anyone to install anything they like on your machine. This is how Microsoft avoid being perpetually sued. There is probably also a "license" invoked when you remove the shrink-wrap from the Sony product.

Re:Sony is protected by the DMCA

[Anonymous Coward]

In Soviet America, copy protection disables you. :-)

Re:Sony is protected by the DMCA

[vikks]

Yeah, in USA {Sony|DMCA|your CD|...} sues you!

Re:Sony is protected by the DMCA

[Alsee]

I don't know why this idea keeps cropping up, and particularly why it got modded to 5. The DMCA most certainly does NOT permit circumvention for Fair Use purposes.

US Law Title 17 section 1201:
Circumvention of copyright protection systems
(a) Violations Regarding Circumvention of Technological Measures.--
(1) (A) No person shall circumvent a technological measure that effectively controls access to a work protected under this title.

The act of circumvention itself is indeed criminalized by the DMCA.

Note that the DMCA also says:
(c) Other Rights, Etc., Not Affected.--(1) Nothing in this section shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use, under this title.

That sounds pretty good, right? Except it's pure bullshit, law literally written by lawyers employed by the publishing industry. It means absolutely ZERO. It says it protects/preserves Fair Use defenses to Copyright Infringment. However CIRCUMVENTION CRIME is not copyright infringment. Circumvention crime has absolutely nothing to do with copyright infringment. There is no Fair Use defence to cricumvention crime. So what that section really says is that a NONEXISTANT defence is not affected. It sure sounded nice though, didn't it?

-

Re:Sony is protected by the DMCA

[Decker-Mage]

For reference, Mark posted the full EULA. Yep, it does have the exclusion but what is even more interesting is the line much earlier. "Once installed, the SOFTWARE will reside on YOUR COMPUTER until removed or deleted." Which is interesting since they went out of their way to insure that you can't uninstall or delete it unless you are a fellow practioner in the Mark Russinovich school of black-belt system administration.

Re:Sony is protected by the DMCA

[bit01]

WHY DID YOU RUN THEIR EXECUTABLE??

The label said that the CD was music, not a root kit that compromises the basic integrity of the computer.

Sony lied and should be prosecuted for fraud and trespass.

---

Paid marketing parasites are the worst zealots.

Re:Sony is protected by the DMCA

[coats]

I'll wager you a Coke against a Pepsi that Mark Russinovich's computer was password-protected. Sony deliberately and surreptitiously evaded that password protection to invade and change settings on Mark's computer. Tell me why he should not sue SONY for DMCA violation!

Re:Sony is protected by the DMCA

[rtb61]

Once you have created your own content on your own computer, you can consider the system of security in place on your comupter as the means by which you protect you content.

So upon that basis it could be said that in implementing an auto installing root kit upon the simple insertion of a CD (bearing in mind the failure to provide a clear and concise warning, in bold on all labels and packaging, considering the implications and ramifications of installing said media) that will break your computer's security and as a result break the system of protection of your content, then Sony is knowingly infringing upon the DMCA and should be subject to a criminal as well as civil action.

Your content is just as entitiled under law to protection as is any commerical bodies content.

Re:Sony is protected by the DMCA

[Squishy Eyeball Jeff]

Such a horseshit argument.

If you buy a Dewalt cordless drill for yourself, and Dewalt decides to put an aerosol form of anthrax in the box with your drill that is fired upon opening the drill box, is it YOUR fault you opened it? Dewalt didn't advertise the anthax, and they just packaged it for you. YOU'RE the one who caused its release.

So, everything's OK there. No lawsuit potential at all.

Right?

Re:Sony is protected by the DMCA

[Decker-Mage]

This is one time it pays to RTFA as Russ provides you with the details you need to kill the sucker dead without killing your system. Also read the comments as there is some advice their about how to take ownership of the keys that are registered to LOCAL SYSTEM.

Re:Sony is protected by the DMCA

[ObsessiveMathsFreak]

Do I give permission to any software vendor to install anything they want when I run the installer executable?

Pretty much yeah. And according to most EULAs, they can also come to your house, steal everything there, burn what's left, kill your family, poision your cat and still be well within their rights.

If you want an example of what companies can and will do with EULA carte blanc, just read up on the whole Blizzard WoW spyware controversy that Slashdot simply refuses to report on. I guess CmdrTaco is working hard for that custom name!

Re:Sony is protected by the DMCA

[Kjella]

There is no Fair Use defence to cricumvention crime. So what that section really says is that a NONEXISTANT defence is not affected. It sure sounded nice though, didn't it?

In short, what it says is that you can be found guilty of circumvention and not guilty of copyright infringement. It's the paragraph which gives the safe (DRM) far more protection than the contents (copyrighted work). The crime is no longer "copying the contents" it's "breaking into the safe". Here you also see that fair use is not a right - it's an affirmative defense. Technically fair use isn't dead, it still allows for news commentary and other non-copying fair uses. But they gutted 99% of it.

Kjella

Re:Sony is protected by the DMCA

[FireFury03]

The cd takes advantage of a feature in Windows and installs software in the background without your knowledge. No court would find Sony not liable for damagaes caused because the user didn't disable autorun.

By that reasoning, if I wrote a virus and emailed it to a bunch of people who ran it then it would be considered their fault and I would be innocent since I hadn't forced them to run it, I only supplied them with the malware (which I probably disguised as something they wanted).

I think you'll find you're wrong (and there have been enough arrests of virus/trojan writers, who under your interpretation are innocent, to prove this)

Re:Sony is protected by the DMCA

[Pollardito]

If you do this, then you are deliberately disabling a copy protection system, which is illegal under the DMCA. So Sony can sue you.

you forgot to add the bit about "in Soviet Russia..."

Re:Sony is protected by the DMCA

[cayenne8]

"How is it going to install without you knowing, that is unless you are running as Root/Admin, and who in their right mind would do that?"

Unfortunately, the answer is "most people".

Re:Sony is protected by the DMCA

[Cally]

I can disable a copy protection system on my own computer - specifically removing it. They didn't have permission to put it there, and I think it would be a tough case to prosecute me for repairing my own computer.

Unfortunately, you're mistaken in your understanding of the DMCA. But where they've *really* got you by the short and curlies is that you *have* given them permission. Isn't there a license agreement of some sort that comes with the CD? Either a hidden file, or a normal click-thru scroll-past-and-hit-accept type EULA? If so, I guarantee that installing a rootkit is covered by the small print. When Apple's iTunes license includes provisions enabling them to retroactively change the agreement *however they want*, and that by installing the sw you agree with this, that means that if Steve Jobs decides he wants you to come over and lick the tyres clean on his new Lexus, he just has to say "Make it so" - your iTunes license is changed to force you to go and lick his tyres, and you've already agreed to do it, and anything else he wants you to do, too.Of course, nice trustworthy Mr Jobs would never do a thing like that,... which makes me wonder why that clause is in the license in the first place? As with this broken CD from Sony, the only way to win the game is not to take part.

Re:Sony is protected by the DMCA

[ezeri]

It doesn't realy matter what the DMCA says on the matter of fair use though, since the courts have overruled the DMCA. And in the US, what the court says is what the law realy is.

Re:Sony is protected by the DMCA

[Sylver Dragon]

Actually, the this fun part is from section 3:
Upon the expiration or termination of this EULA, you shall immediately remove all of the LICENSED MATERIALS from your personal computer system and delete or destroy them, along with any related documentation (and any copies thereof) that you may have received or otherwise may possess

So, pretty much what they want me to do is, if I decide to terminate the agreement I have to re-format my system.

Re:Sony is protected by the DMCA

[pocketfuzz]

I'm wondering what their EULA has to say about this?

Re:Sony is protected by the DMCA

[Alsee]

the courts have overruled the DMCA. And in the US, what the court says is what the law realy is.

???
What case are you reffering to? The Lexmark printer case and the garage door opener case certainly didn't say anything defending Fair Use, they basicly said the DMCA didn't apply when if you try to hijack the DMCA to protect a fundamentally physical product. The Elcomsoft case didn't overturn anything either. There was no judge ruling of law overturning anything in the DMCA in the Elcomsoft case. The judge laid out the DMCA law as a slam-dunk case against Elmcomsoft. The Elcomsoft acquittal was pretty much a case of jury nullification. Jury nullification has absolutely no value as precedent, it is not a ruling, and it does not change the law. It just means that particular defendant got away with it. Plus the fact that Elcomsoft didn't address circumvention crime anyway. It was a "trafficing in tools" case. I'm not aware of even a single circumvention-crime case ever coming to court. Skylarov's case was dismissed, and Felton *tried* to create a case but the RIAA dodged it with a judge that didn't want to address it.

Is there another case that I missed? I'd be surprised if there was a case with such a major ruling that I hadn't heard about, but it would be a very pleasant surprise :)

-

Re:Sony is protected by the DMCA

[LittLe3Lue]

There is really only one safety precaution one can take to make sure something like this does not happen again.

I, like many of you, would not have a swell time trying to remove a rootkit from my computer and an not willing to take the risk.

I say, until we can be sure that music CD's provided to us by corporations are safe, we must continue to use the tried and proven safe method of audio in the form of mp3's.

There are many places to get such music, and sure, it doesn't come with a nice case or any cover, you have to burn it yourself, and is often of lesser quality, but DO NOT take the risk of having your computer intruded.

Please, take precautionative measures, boycott music cds provided by corporations!!

And remember kids, they gave us no alternative!

Re:Sony is protected by the DMCA

[Dare nMc]

> but by leaving the Autorun "feature" on, you have failed to create this secure environment.
just for the record, Autorun is not the only thing you have to avoid to stop this.

I have autorun turned off, but in windows 2000 explorer, clicking on the CD Icon runs autorun, unless I right click, and choose browse/rip/play, etc. because I also have all the daemons that enable the autoplay disabled for real, winamp, and the itunes installs on this PC and thus click on the CD icon to do all this.

Re:Sony is protected by the DMCA

[ivan256]

Removing and bypassing are two completely different things. If removing DRM software from your computer was illegal under the DMCA, simple tasks like formatting your hard drive, or throwing out an old DVD player would be illegal. Additionally, if you delete it the system is still in place on the CD (presumably to be automatically re-installed next time you insert the disc), and thus not defeated.

Re:Sony is protected by the DMCA

[AxelBoldt]

since the courts have overruled the DMCA.

What court case are you referring to?

Re:Sony is protected by the DMCA

[Anonymous Coward]

You're right, you do, but by leaving the Autorun "feature" on, you have failed to create this secure environment. That's not to say what Sony did was right, but if Autorun is what lets Sony install this rootkit, it would be easily preventable.

and what next? if i leave my house unlocked it makes it okay to steal my stuff? Whatever! Get a life. Autorun is a default setting and as such is how windows is suppose to run. and forget about that root/admin bs. Don't you know that a lot of software/games require admin rights to run properly? Most mom and pop folks don't even know what autorun is.
get out of your den.

Re:Sony is protected by the DMCA

[Ziwcam]

If you do this, then you are deliberately disabling a copy protection system, which is illegal under the DMCA. So Sony can sue you.

In Soviet Russia, perpetrator sues YOU! (Sorry, had to do it)

Re:Sony is protected by the DMCA

[KDR_11k]

Can I consider the people who made it "related documentation"?

Re:Sony is protected by the DMCA

[KDR_11k]

That's not an attempt to circumvent a copyprotection, that's computer crime (15 years of jail and 250k$ fine!) plus wilful damage to property (having to reinstall Windows constitutes damage). He should call the police on Sony because wilfully spreading viruses is a felony. An additional class-action lawsuit for damages caused by the program is optional.

Re:Sony is protected by the DMCA

[Anonymous Coward]

WHY DID YOU RUN THEIR EXECUTABLE??

In the article, Mark says the CD "can only be played using the media player that ships on the CD itself".

Re:Sony is protected by the DMCA

[Anonymous Coward]

No court would find Sony not liable for damagaes caused because the user didn't disable autorun.

Wow. Nice. A triple-negative sentence.

Re:Sony is protected by the DMCA

[gregjmartin]

Because we wanted to see you pop a vein!?! :)

Re:Sony is protected by the DMCA

[shibashaba]

I made a typo on the last sentence. It is sony's fault, and it is the fault of the virus writers.

Re:Sony is protected by the DMCA

[hazem]

I think the installation of their root-kit is a totally separate issue from circumventing the DRM.

Let's assume I put their CD in my computer, and it installs this rootkit without my permission. I agree that this is tresspas.

So, I remove the rootkit.

At this point, I feel I can sue Sony for damages. Stopping here, I've not tried to listen to the CD again on my computer, so I've not circumvented their DRM. I just removed it from my computer.

Of course, this goes to the idiocy of holding the shift key while inserting the CD. Is that circumvention? Or is it using a normal "feature" of the DRM?

Going from there, suppose I DO put the CD back in my computer, holding the shift key, and then listen to the CD. Again, have I really circumvented their DRM? I believe I've used an "undocumented feature" to access the material. Should I be held liable for that? If their DRM is so lame that it can be so easily ignored, have I really circumvented it?

What if Spybot SD can remove this rootkit. Have I violated the DMCA because it does so? What if their rootkit turns my computer into a machine for hacking DOD computers. Does this only leave these choices:
1) violate the DMCA by removing the rootkit
2) violate the USA PATRIOT act by not removing it (proving material support - my computer - to hacker terrorists
3) destroy my computer

Now, I realize that if I burn a copy of that CD and remove the DRM from the copy - then yes, I've violated the DMC. But that's not what we're talking about.

Re:Sony is protected by the DMCA

[Scarletdown]

Nope. Examine the license for your "operating system" - it pretty much allows for anyone to install anything they like on your machine. This is how Microsoft avoid being perpetually sued. There is probably also a "license" invoked when you remove the shrink-wrap from the Sony product.

I just examined the license for my operating system. I saw nothing there that allows for anyone to install whatever the hell they want on my computer. Check it out for yourself. ;)

GNU GENERAL PUBLIC LICENSE

Version 2, June 1991

Copyright (C) 1989, 1991 Free Software Foundation, Inc.
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA

Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.

Preamble

The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too.

When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things.

To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it.

For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.

We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software.

Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations.

Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all.

The precise terms and conditions for copying, distribution and modification follow.
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as

Re:Sony is protected by the DMCA

[Anonymous Coward]

tsk tsk. perhaps mod should check what TIMES posts are made before modding something redundant. metamods if you read this for context, please spank that mod.

Re:Sony is protected by the DMCA

[shibashaba]

If your gonna nitpick my grammer you might as well also point out my spelling mistakes. Really though, you could have better shown off your mighty IQ by having had something intelligent to add to the topic which was being discussed.

Re:Sony is protected by the DMCA

[quigonn]

I would do the following: tell it the Department of Homeland Security. And that's the logical reasoning to get Sony fucked:
- terrorists install spyware and rootkits on computers to use them for terroristic acts.
- Sony installs rootkits.
- ergo: Sony is a terrorist organization.
- ergo: nuke Japan and put the local Sony employees into detention camps.
- problem solved.

Re:Sony is protected by the DMCA

[dohadeer]

I was always under the impression that simple cases of copyright infringement are generally considered an issue for the courts of equity (ie. a civil issue). As far as I understand, and again I could be completely incorrectly, those FBI warnings at the beginning of all our media generally refer to the mass-production/organized crime aspects of committing this tort, not to any single commission or commissions of the act. Therefore, I would figure the criminal harm of trespass would supercede any civil claim Sony had.

Re:Sony is protected by the DMCA

[ddimas]

Operating System - Linux (Fedora, GPL Licence).

Hardware - Individually bought and installed components.

Hardware/Software Support Services - Me.

If this computer system is not MINE then there is no such thing as private property. If you install software on this system without my consent you are stealing from me.

Re:Sony is protected by the DMCA

[Anonymous Coward]

That's what makes the plausible deniability of corporations so deliciously evil. "Huh? I dunno what you mean unless it was... THAT GUY (points at scapegoat programmer who is offshore and/or doesn't speak english) -- Hey you, you're fired! There, problem solved (until next time, heh henh)."

Re:Sony is protected by the DMCA

[xmartinx]

but disabling it is circumventing copy protection, didn't you know?

Re:Sony is protected by the DMCA

[Anonymous Coward]

The DMCA is crap, anyone who thinks they can control a population through cowardly BS law is full of crap. With all the laws in this country built to protect deep pocket corporations I wonder if the next revolution will be not against our governement but the corrupt control of governement via corporate dollars. Freedom isn't free.

Re:Sony is protected by the DMCA

[jim_v2000]

Unfortunately, I did this before this article came out :(

On the upside, I just turned off autoplay on my cd drive and used Cdex to rip the tracks off. The DRM didn't get installed...woohoo.

Re:Sony is protected by the DMCA

[Anonymous Coward]

Why bother removing the DRM? Just use it to defeat itself - rename your ripping software to $sys$whatever.exe and watch as it goes completely undetected and you get a perfect copy of the tracks you want

No

[vlad_petric]

The ability to run arbitrary code as a regular user is bad enough. It'll turn the computer into a zombie anyway. Microsoft does makes the problem worse, but they can't prevent it.

Simple solution

[van der Rohe]

Work hard to make sure that CDs using intrusive and possibly illegal DRM are the ones MOST ACTIVELY distributed via P2P.

This should be done not because "information wants to be free", but rather because businesses who engage in these sorts of practices should be made to fail financially.

When the labels have their annual shareholders luncheon and are forced to show the fancy Powerpoint presentation entitled "Effectiveness of DRM Solutions at Limiting Piracy", the graphs should be embarrassingly skewed in the wrong direction.

The only thing that works is money. So make sure they, and the band, see none.

"The band?! Surely you can't be serious?! They're probably just innocent victims." Bullshit. No one forced them to sign away their souls like whores. It doesn't take a rocket scientist to know that Sony and all others of their kind are customer hostile. Take your music elsewhere. Because that's what I'm doing with my money. And if you're only in it for the money, then you don't get to have any.

Re:Simple solution

[qeveren]

What, you think they'll actually use real data in those Powerpoint presentations to the shareholders? What a strange fantasy world you live in. ;)

Re:Simple solution

[Anonymous Coward]

Work hard to make sure that CDs using intrusive and possibly illegal DRM are the ones MOST ACTIVELY distributed via P2P.

Until they settle on a business model that isn't the equivalent of an assraping, I refuse to support the [RI/MP/*]AA in any form until they stop behaving like assholes. They've made it way too convenient to get content via the net as a means of avoiding both the annoyances that they bundle on media as well as the insane prices one has to pay for that media.

So, to the *AA I say: Screw you, and have a nice day.

I'll get my music from the net, and I'll watch movies at home from netflix. I won't accept your copyraping, and I won't accept your ridiculous price tags. And in the case of movies, I will watch them at home and pause the movie at my leisure, and without having to deal with assholes on cell phones or their screaming brat children.

Besides, the content coming out of both of those sectors is (mostly) stagnant, so I'm not willing to support the artists/actors until they do something more innovative.

See this movie to see why AV is now outdated

[svallarian]

The problem with rootkits is that once you've been infected, there's no way to clean the infection without booting to another OS.

For a great movie showing the author of hacker defender defeating most all of the current rootkit-defeating programs see the following link:
http://www.hxdef.org/download/brilliant.php

Re:See this movie to see why AV is now outdated

[bhtooefr]

And I'm going to follow a link mentioning rootkits that's in the comments on a Slashdot article.

Especially considering I *AM* running Windows.

Yeah, sure.

(If it *IS* safe, though, sorry...)

Re:See this movie to see why AV is now outdated

[owlstead]

Neh, he's a 40-something. Should be ok :)

Re:See this movie to see why AV is now outdated

[Reziac]

[sics Getright on link]
http://www.hxdef.org/download/brilliant.php
=================
HTTP/1.1 200 OK
Date: Tue, 01 Nov 2005 05:02:59 GMT
Server: Apache/1.3.33 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 PHP/4.3.9 FrontPage/5.0.2.2634a mod_ssl/2.8.22 OpenSSL/0.9.7a
X-Powered-By: PHP/4.3.9
Content-disposition: attachment; filename="Brilliant Hacker defender presentation movie MSV1.rar"
Content-Length: 843679
==============

[downloads file, extracts contents, discovers 12mb .AVI inside, sends it to Photopaint for disassembly]

The AVI consists of 1930 frames, all textmode screenshots (far as I looked), which is why it compressed so well. It would be somewhat smaller if only unique frames were represented and you played it one frame at a time (as can be done in an image editor). On peering at it with LIST, I learned that it was built with VirtualDub build 18160/release. Anyway, it doesn't seem to contain anything malicious.

Re:See this movie to see why AV is now outdated

[Jaseoldboss]

Yeah, it's safe enou%$(£%*($£)[NO CARRIER]

Answer: This is truly evil

[shanen]

So should I sell all of my Sony stock, or buy more?

Seriously speaking, this shows two things. One is yet another demonstration of the fundamental evil of Microsoft's "security" model. Even if you weren't running as root/Administrator (and everyone does, don't they?), then the "reputable" installation from the "reputable" company would just ask you to elevate your privileges.

The other thing is that power is always abused. If not now and by Sony, then tomorrow by some other "reputable" company. (Or put on your tin hat and say "Yesterday by the NSA.")

I hope they track this story, and if it is not another misguided /. rumor, I certainly hope that Sony repudiates the technique and the software. Soon.

Then they should apologize.

Then sack the person responsible.

Then sack the person responsible for not sacking the responsible person earlier.

[Infinite loop warning.]

Re:Answer: This is truly evil

[Nogami_Saeko]

I was sort of wondering about this - how many rootkits/exploits could still be installed if the user didn't run under admin access, but only as a power user?

I doubt it would get rid of all of them, but it should prevent the vast majority should it not?

N.

Re:Answer: This is truly evil

[Anonymous Coward]

yet another demonstration of the fundamental evil of Microsoft's "security" model. Even if you weren't running as root/Administrator (and everyone does, don't they?), then the "reputable" installation from the "reputable" company would just ask you to elevate your privileges.

Would you mind please explaining how this has anything whatsoever to do with Microsoft and the security model in Windows? What is it, exactly, about the way Windows is designed that makes this possible on Windows but not on, say, Linux? Or were you just blowing smoke out your ass? If you give me permission to install a driver on your Linux machine, I can do things equally evil. And using pretty much the exact same techniques as it turns out.

Re:Answer: This is truly evil

[Anonymous Coward]

I think the parent's point is that Windows is pretty much crippled unless you run as a local admin, thus forcing you to be 'root', thus exposing you to system level compromise.

Re:Answer: This is truly evil

[ezzzD55J]

So should I sell all of my Sony stock, or buy more?

Offtopic, but..
If you think a stock will move but don't know in which direction, buy get and put options at the current price. They'll be in the money after any significant stock movement. Called a Long Straddle.

Re:Answer: This is truly evil

[Sylver Dragon]

I doubt it would get rid of all of them, but it should prevent the vast majority should it not?

Not really. With the windows installer, you can check to see if you have admin rights during the install. If you don't you just ask the user to provide a username/password pair for an admin account so that the install can continue. Since the user wants to use your application they will provide the necessary username/password.
It might stop some of the remote IE exploits, but even then I would doubt it. As always the weakest link in security is usually the interface between the chair and the keyboard.

Re:Answer: This is truly evil

[penix1]

"As always the weakest link in security is usually the interface between the chair and the keyboard."

This goes for *nix just as much as any other OS. Microsoft just makes it easier and more lethal. I help loads of people making the "switch" and their biggest beef until recently was that it didn't have autorun. What happened recently? You guessed it! Most distors instituted automount/autorun.

As to this topic, any program that is NOT specifically run by the user is by default not agreed to. Just ask the spyware folk who just recently lost a case (can't recall where but it was covered by /.)

The US Congress / Courts are so busy protecting the rights of corporations they have completely forgotten the rights of people. It is a sad commentary on the times we live in.

B.

Re:Answer: This is truly evil

[KirkH]

Yep, but depending on the price of the options, you can still lose money if the stock doesn't move enough.

Re:Answer: This is truly evil

[Thing 1]

I'm no expert, but would it make sense to sell those options instead? Then you have the income in case of no movement, but I'm not sure whether movement in any direction would be profitable or if any movement would eliminate a profit.

My idea is based on "70% of all options expire worthless", so it's best to be on the selling side. Perhaps the above strategy is really only worthwhile with a stock that doesn't move?

Re:Answer: This is truly evil

[CaptainCarrot]

Then they should apologize.

Then sack the person responsible.

Then sack the person responsible for not sacking the responsible person earlier.

[Infinite loop warning.]

Well, shit. By the time they get down to the llamas, there won't be anyone left to sue!

Re:Answer: This is truly evil

[arminw]

....I certainly hope that Sony repudiates the technique and the software. Soon....

They won't unless this story appears on the front page of the NY Times or something like that.

Re:Answer: This is truly evil

[Grym]

So should I sell all of my Sony stock, or buy more?

It was only after I wrote a scathing response that I realized that you were joking. And yet, for that I think I can be forgiven because I can't help but think that some people, upon hearing about this, were asking themselves just that question.

Sometimes the acerbity of feeling like the only sane man left in an insane world rushes over me when I see how people treat and speak of the stock market. It's not some game to be played. It's not some magical money generator without cause or consequence. And just in case anyone had forgotten, we always have moral obligations to one another--even in situations of diffused responsibility (yes, this includes investing).

But more importantly:
What ever happened about being proud of how you got your money and where you spent it?
What ever happened to doing the right thing--even if it didn't maximize our individual profits?
What ever happened to our dignity?

-Grym

Re:Answer: This is truly evil

[shanen]

Interesting questions. My response it that, at least in America, proud ignorance and mindless greed became the fashions of the day. I think the long-term results will not be pretty.

Root cause? I actually blame it on the "free lunch" mentality that led to advertiser-sponsored "free" radio broadcasts, which led to even worse advertising on television, and which is now threatening the Internet, too. It's not as though they were unaware of the dangers, and the radio stations were originally required to consider the public interest. However, in the long run the profits have eclipsed everything else. Advertisers are not interested in creating well-educated citizens and careful voters. Their concern is with creating pliable shopping robots.

Have you already forgotten the famous BushCo advice about not launching "new products" in August? So how'd you like to buy a nice war?

As regards the Sony comment, that wasn't completely a joke. I really do own some Sony stock, and I really can't decide what to do about it. On the other hand, I certainly don't think that Sony is going to pay a whole lot of attention to what any minor shareholder does or thinks. However, if I react to every news item that is related to my stocks, the only beneficiaries will by the stockbrokers, since they rake their commissions off the top.

Re:Answer: This is truly evil

[6th time lucky]

In Australia at least i often hear stories in the media after i had read them on /. Particularly the local radio stations...

Re:Answer: This is truly evil

[Anonymous Coward]

glad I don't take investment advice from you then, writing options can have a very hefty downside, at least going long a straddle you know your maximum downside. The long straddle covers what the parent said, a big move either way , selling a straddle does the opposite.

Re:Answer: This is truly evil

[Eunuchswear]

Why do people keep saying this.

It's not true.

Re:Answer: This is truly evil

[hplasm]

Jeff Minter works for Sony now?

Re:Answer: This is truly evil

[bit01]

and I really can't decide what to do about it.

I'd check the size and income of the Sony Electronics division (consumer products) versus the Sony Pictures (content creation). To some degree they're in conflict with each other (consumer friendly versus unfriendly) and whichever "wins" will have a significant impact on the direction of the company and how much DRM they use.

Myself, I think Sony's quality has gone down a lot recently after the trinitron patent expired. I don't buy their consumer products anymore, not only because of the poorer quality but also because of various forms of DRM and consumer unfriendliness they're using.

---

Paid marketers are the worst zealots.

Re:Answer: This is truly evil

[bit01]

Why do people keep saying this.

It's not true.

So M$ should have no problem releasing a patch now to change the default Microsoft Windows/XP install to non-admin?

Thought not.

Having said that, M$ have now lifted their game a little in this area (finally, after 25 years!). They should be much more aggressive in encouraging their client vendors to lift their game too so we can finally ditch the M$ lack-of-security model.

---

Paid marketers are the worst zealots.

Re:Answer: This is truly evil

[TheoMurpse]

What ever happened to our dignity?

If you recall, about 7000 years ago Eve made Adam eat some damn apple...

Re:Answer: This is truly evil

[Micah]

> writing options can have a very hefty downside

Only if they're naked options, which most "average" investors are not allowed to write. Writing covered calls requires that you already own the stock, and writing covered puts requires that the cash to buy the stock at the strike price be in your account. So there's a limit on losses.

Still, buying options is a heck of a lot more fun than writing them!

Re:Answer: This is truly evil

[Micah]

Main problem with straddles is that the stock has to move a LOT before you really start to make money. Like, on the order of 20-40%. In most cases it's better to figure out which way you think the stock is moving, and just buy one.

Re:Answer: This is truly evil

[rust42]

You can buy more, just make sure you don't do it with your credit card in case they install a rootkit on it

Don't just boycott Sony Music

[Anonymous Coward]

Boycott their stereo's, TV's, PS-Whatever, and their movies.

Re:Don't just boycott Sony Music

[Anonymous Coward]

There are already many reasons to do that.
I always wonder why anyone would buy anything from Sony.

Re:Don't just boycott Sony Music

[Achromatic1978]

You just /know/ that most people here are going to be amongst the hordes salivating at stores at midnight on PS3 release date, for all their "SONY EVIL!" diatribes here.

Further enhancements

[shutdown -p now]

I wonder if the next version of the rootkit will also have a blacklist of web sites (those describing what it is and how to remove it), and block any access to them. That's just about the only thing they forgot to add, apparently.

Not going to buy Sony ANYTHING

[Anonymous Coward]

Now is that *sony's* rootkit, or a soon-to-be-former-sony-employer's rootkit?

I was going to buy a Sony PC this weekend, but just deferred the idea indefinitly. No more Sony for my home... unless this is false.

Someone at Sony should be fired, putting installable code on a CD that modifies the OS and hides itself is criminal. If this article can be substntiated, then Sony should be prosecuted under the criminal justice system.

People need to get the word out...

[Anonymous Coward]

This is a perfect opportunity for those of us that want to end abusive DRM practices to get the word out to media outlets. They are a lot more likely to run articles with possible headlines of "Sony Hides Spyware on Music CDs" than "EFF Fights Restrictive DRM". People are also more likely to read it. A majority of internet users have suffered at the hands of spyware and are likely to respond negatively to this sort of tactic. If we can associate DRM with Spyware in enough minds maybe we won't have to be treated like criminals by corporations that we make rich.

Or maybe I'm a crackpot.

UnBOOlievable

[dcapel]

Its UnBOOlievable that Sony would pull the trick of letting a vampire company suck the life-blood of out a normal villagers computer, instead of treating the users to a safe use of their music.. They should be helping to prevent zombies on the web. I might just use google's spider to carve out my solution to this proverbial black cat move of the industry. But, witch query should I do!?!

Britain's Computer Misuse Act...

[jd]

...could probably be used in this way, for this software. The program was unquestionably not authorized by the user, as it is not declared in the EULA. As there is no apparent (yet) "Phone Home" capability, it would not violate the Data Protection Act. It might violate tresspass/break-and-entry laws, as the only reason the hacker of Prince Philip's e-mail account escaped conviction was that a transient tool was not considered a lockpick. This is a permanent tool that permits repeated intrusion, so I would guess the courts would be more sympathetic to the argument that it was breaking and entering. IANAL, but most people in computing in Britain have covered the DPA and CMA to some degree, because these are things IT people need to be careful of. It is possible - though unlikely - that the EU could also prosecute Sony over this, as it may infringe on privacy and computer protection laws in Europe. It's very doubtful the EU would take such action - they barely took any action against Microsoft for anything it did - but if Sony or other companies agravate the situation enough, there ARE elections in Italy coming up and the ruling elite there could do with someone to victimize.

America - well, there's no privacy in the US of A. The trade in personal information is open and widespread. There is an excellent chance that if anyone tried to prosecute Sony over privacy infringements that it would be laughed out of court. You can't protect what you don't have. Posession is 9/10ths of the law, and Americans posess very little - much as they often like to believe otherwise.

Sony actually has a much stronger case. Reverse-engineering their DRM scheme is in direct violation of both the letter AND the spirit of the DMCA, which is explicitly intended to prohibit exactly this kind of research (ie: the study of the spyware) and this kind of result (ie: the removal of it, afterwards). Depending on who Sony licensed the rootkit from, there is a possibility it might also violate aspects of the PATRIOT act. (If the rootkit is also used by any law enforcement groups, then this study could compromise wiretapping provisions in the act.)

Re:Britain's Computer Misuse Act...

[Tony Hoyle]

The computer misuse act makes the unauthorised alteration of computer data a criminal offence... that's the whole anti-hacking bit that has been used to prosecute a few teenagers (and scare a few thousand others).

Since I did *not* authorize Sony to install a rootkit (authorisation to play a CD won't stretch that far) they have broken the law, and should be prosecuted.

Luckily we have corporate legal liability in this country too...

Re:Britain's Computer Misuse Act...

[paedobear]

It's actually interesting as the software developer is based in the UK - you'd assume that they were aware as trained professionals that their software was probably illegal in their home market. Anyone know of any CDs released in the UK that use this system?

Re:Britain's Computer Misuse Act...

[irw]

the Computer Misuse Act 1990 has three charges:

1. unauthorised access
2. unauthorised access with intent to commit or facilitate commission of further offences [my emphasis]
3. unauthorised modification

therefore, if the rootkit opens back doors, or makes it possible to hide programs, charge #2 applies.

Re:Britain's Computer Misuse Act...

[Anonymous Coward]

Well Sony executives still haven't been jailed for flyposting, though they have been threatened with ABSOs (anti-social behaviour orders). If only they were in the food business they would be put away by now (e.g. "Anchor butter" executives were temporarily jailed for importing butter that was too high quality into the EU, since it breached quotas).

Re:Britain's Computer Misuse Act...

[jd]

I'd say #3 also applies, if the rootkit is hiding itself (and files) by modifying the OS' kernel or kernel configuration. Since that is generally (but not universally) how rootkits work, that option might also have some credibility.

(Especially to a non-technical audience, too, as Sony would then be put in the position of having to explain how their DRM did all this without modifying anything. There's no fifth to claim in the UK, and the right to silence was abolished. Hey, I detest those changes, but they cut both ways and I've no scruples about putting Sony through the wringer.)

This house is...

[m0nstr42]

... CLEAN.

If it's a commercial rootkit

[doodlelogic]

do they do a mac or linux version?

Incentivising Piracy

[SpecBear]

My refrain to the copyright holders: The people being hurt by this DRM software are people who have already communicated their intent to do the right thing by purchasing the CD. Sony has just guaranteed that a lot of people will never make that mistake again.

Welcome to a Brave New World: People who pay for their music get viruses, while people who download it at no cost from illegal sources get clean MP3s that they can freely copy and use on whatever devices they own.

Re:Incentivising Piracy

[WuphonsReach]

That's pretty much what went through my mind.

A) Purchase a CD from a store. Find out that either I can't rip it to my hard drive / MP3 player or find out that it's installed something nasty and annoying on my system.

(On the upside, I sleep well at night because I "do the right thing">)

B) Skip option A and go directly to pulling the already ripped, no DRM nonsense MP3s off of a file sharing service. Which I can then easily play on my computer / MP3 players.

(I'll sleep even more soundly because I'm not worried about an audio CD breaking my system. But I'll probably toss and turn once or twice because I wish the artists could've gotten $0.10.)

Remind me again why I want to use option A? Especially since, with the advent of DRM-protected CDs, I'll have to use option B in order to get my tracks onto my MP3 players?

Re:Incentivising Piracy

[Scarletdown]

B) Skip option A and go directly to pulling the already ripped, no DRM nonsense MP3s off of a file sharing service. Which I can then easily play on my computer / MP3 players.

One other additional step that you can add is to then pay the buck or two at a thrift store, yard sale, pawn shop, or any other place that sells used music and buy the original without having to fork over any money to Sony or the RIAA (they already got their cut the first time it was sold). I don't know if this has ever been tried in any court, but it seems like this might be a way to legitimize one's collection of downloaded music, since you can show that you have the originals (no matter what format it may be in).

Re:Incentivising Piracy

[Anonymous Coward]

Exactly. Go buy the CD, and what do you get? A disc that won't play in most if not all CD players, a virus spread to any computer you place the disc in, and music that you can hardly do anything with. Now, download the same music illegally. What do you get that you didn't get with the CD?

• Ability to play the music without screwing up your computer.
  
• Ability to play the music in pretty much any device; even an 8-track player if you happen to have a recorder handy.
  
• Ability to copy the music to your MP3 player, or your hard drive. Keeping music on your hard drive means no having to shuffle through hundreds of discs, and being able to play it while the CD drive is in use (eg during a game).
  
• Ability to burn a CD with the tracks in a different order, or with tracks from a different CD.
  
• Backups.

All without the hassle of copy protection. Now, which sounds better to you?

At least I'm free...

[donothingsuccessfull]

Currently downloading:
Van Zant - At least I'm free.
The only result in a gnutella search.

Re:At least I'm free...

[donothingsuccessfull]

It's terrible.

Re:At least I'm free...

[Anonymous Coward]

I found about half the tracks on gnutella, probably could find them all with some diligent searching....didn't bother to download the crap though...fuck dixie

Here they are!

[Anonymous Coward]

http://www.first4internet.co.uk/

Google Groups thread with Ceri from first4internet.co.uk looking for help to write his fucked-up CD drivers...
http://66.249.93.104/search?q=cache:hDmbqX5yahgJ:w ww.osronline.com/showThread.cfm/

What's depressing is that Sony undoubtedly paid them a good deal of money to write this shit.

Windows Vista is a start towards this

[Solr_Flare]

I don't know the full details as I'm not beta testing Vista, but I do know that Vista has some protections like this in it. This is in large part why MS talks about Vista being much more "secure" than past windows releases. A good example of this is is device drivers. As started in this article(a Q&A with the head of ATI's driver team):

http://hardwarefanatics.com/modules.php?name=News& file=article&sid=6

"Vista requires a brand new driver model. It is actually called WDDM (Windows Vista Device Driver Model). Whereas before, device drivers were something called kernel mode based, they are now user mode based. This means that drivers do not directly talk to the operating system and have the ability to crash it. The end result will be greatly improved stability for devices on Vista. The amount of work to support the new driver model is tremendous. It is basically a re-write of the entire driver. However, we are very much ahead of the game, and feel good that we will have the best Vista support when it is actually released (and even sooner with our beta drops)."

what happens

[OneArmedMan]

if i wanted to play that disk in my car cd player ? or my Diskman ? or in my HiFi setup in the home theater room ?

Re:what happens

[NtroP]

if i wanted to play that disk in my car cd player ? or my Diskman ? or in my HiFi setup in the home theater room ?

It will play just fine. It's only if you run Windows. Fine with me. I use Linux and OS X.

Re:Alternative OS users

[failure-man]

As the 2% of the population that actually understands what this thing is, does, and means we can and should be angry and vocal. The vast majority of computer users run Windows, with autoplay on, and will get thoroughly owned by this. They'll just think their computer is broken and keep buying RIAA crap with that assumption.
 
(What's more, if I have to clean up another non-technical friend/relation's owned computer I think my head's gonna explode.)

The Solution:

[evenSong]

PM me for a torrent of this CD.

Labels simply don't get it.

[iSeal]

What's supposed to be the logic behind this move? Curb piracy?

And its in that respect that record companies simply don't get it. First of all, they're completely punishing their fans for purchasing their product. After all, how do these CD protections benefit the consumer in any way? The only thing that results is more nuissance for that consumer - thanks to Sony's protection, they aren't able to put the music they bought on an MP3 player for instance. They aren't able to put the MP3s on their computer so that they can listen it from there.

Do they not realise that people use their computers for music these days? Nearly every student I know has some kind of MP3 jukebox set on their machines, where they shift songs between their entire music collection. The companies have been operating on a basis that their products should not be compatible with computers at all, going so far as deceivingly installing these virus-like programs. They think that that will reduce piracy. Fact is: it hasn't, nor will it ever.

As the old addage goes: where there's a will, there's a way. And I've yet to see a CD where its contents could not be ripped. So this does not curb piracy in any way - meanwhile, it makes the CDs less appealing to the fans. Why spend $20 on a product that only half-works? A product that behaves like a computer worm and installs a rootkit?

Piracy doesn't exist because people can do with their CDs as they see fit. It exists because people are getting fooked around by the record industries left, right, and center. Infecting PCs with worms, preventing people to listen to music they legitimately purchased, are hardly steps forward to make the CD format more appealing.

The record labels simply do not get it.

and to make things worse....

[Anonymous Coward]

From the CD's EULA: "You may not decompile, reverse engineer or disassemble any of the LICENSED MATERIALS, in whole or in part."

This is fucking hilarious....

Required removal?

[whoever57]

From the EULA:

Upon the expiration or termination of this EULA, you shall immediately remove all of the LICENSED MATERIALS from your personal computer system and delete or destroy them, along with any related documentation (and any copies thereof) that you may have received or otherwise may possess.

So now Sony has you in the unenviable position of not being able to uninstall the software that you agreed already to uninstall.....

Sony inc. creates botnet for the RIAA?

[ali3nxx]

Another fine example of why the music industry is loosing support and people would generally just download music off irc or p2p. Good work sony! If sueing 8 year old kids that the RIAA cannot verify to actually exist http://recordingindustryvspeople.blogspot.com/2005 /10/oregon-riaa-victim-fights-back-sues.html is in question why not install a backdoor like a common botnet cracker. Dont wait in line for my purchace...

This is NOT a music CD

[Anonymous Coward]

At least as far as Phillips are concerned, anyway.

Re:This is NOT a music CD

[Anonymous Coward]

I saw nothing in the article that would support that claim. It could be a normal MixedMode CD, the fact that it contains a rootkit does not violate the AudioCD standard - this is different from other copy protections what worked via e.g. invalid sectors or TOC entries and often broke "normal" CD players.

iTunes Australia and Japan

[Anonymous Coward]

Sony still hasn't agreed to come on board with iTunes, which I find damn annoying. Everytime I search for an artist and don't find them (considering they're a big artist), I go and search for that artists publisher.. and what do ya know, always sony.

I'm really starting to hate that company. This BS "DRM" is just the icing on the cake. Sure, iTunes has DRM, but it's quite benign (5 computers, unlimited ipods, unlimited burns per song, 7 burns per album).

They're too big, and have their hands in too many pots. Time for Sony artists to take a stand and go with somebody else (quite difficult, considering the ass-raping contracts they probably had to sign). Essentially, Sony are denying their artists a source of income to satisfy the needs of their consumer electronics department. I'd be pissed.

Re:iTunes Australia and Japan

[SirPavlova]

Essentially, Sony are denying their artists a source of income to satisfy the needs of their consumer electronics department.

It's the other way around - they used to make good consumer electronics, but that branch is being screwed over by the content divisions. It was shortly after they aquired their music & movie divisions that the electronics got their DRM & crap.

Of course, the artists are still being screwed over as well... but it's the label part that's doing it.

What's really scary ...

[hal9000(jr)]

Is that Russinovich actually chides the DRM developers for weaknesses in the implementation meaning that it could be made more stealthy and stable.

Maybe someone should hire Russinovich to write a DRM.

the big guys take punches like candy...

[DigitalEntropy]

... the little guys are more likely to crumble. Why not target the source of this crap? I did. Though, admittedly I'm sure SONY keeps their wallets fat enough to ignore us. See below:

===

Mail-To: info@xcp-aurora.com, info@first4internet.co.uk

Subject: attn: Mathew, Tony, Peter, Nick; re: Extreme displeasure with your XCP product.

To Whom it may concern:

I would like to address the outstanding issue regarding the software your company licensed to SONY BMG here in the United States. This software proposes to be a harmless DRM solution for the corporate customer as a method of protection against malicious users. However, what your software critically FAILS at is conscientiously protecting the end user against exploits of your poorly, shit-house written utilities.
Personally, I'm glad that your nasty parlour tricks were recently exposed by SysInternals.com (http://www.sysinternals.com/blog/2005/10/sony-roo tkits-and-digital-rights.html) for the disreputable practices they are, and for identifying "First 4 Internet" (sounds like a shoddy store-front operation for a bunch of Black Hat rejects) as the company directly responsible for the most vile intrusion my system has ever received. And the fact that your ill-conceived product leaves my system open to additional intrusions of this nature is unforgivable.
May whatever sink-hole from whence you rose quickly swallow you back. You have no right to voilate my computer's integrity. You have no right to scan the contents of my computer. You may have the right to hide in the darkness of Windows' subsystem like cowards, but that does not mean you won't be seen. You have no right to abuse the trust garnered by SONY from the citizens it regularly calls customers (or, perhaps more appropriately, "guinea pigs"). I hope the light of truth sends you roaches scurrying.

With the wretched taste of bile at the back of my throat,

[my name]
[my email addy]

===

Personally, I purchased "The Dead 60s" latest album, and sure enough it had the exact same copy-protection crap as described on sysinternals.com. That article sure shed some light on the behavioral difference in my system since I got that CD (significantly slower start up and execution times on a 1.2 GHz, and constant 5 - 10% CPU usage with almost nothing running). Fuck them. Fuck them right in the ear.

It was stated before, and I'll reinforce it: This kind of DRM ADVOCATES piracy. You are safer without DRM. I intend to zap my Windows machine and go to Debian (as I've been considering, but now have good reason for security purposes), and return this CD by mail to SONY BMG in a thousand tiny pieces, but not before I copy it and distribute out of sheer spite.

Re:the big guys take punches like candy...

[Technician]

return this CD by mail to SONY BMG in a thousand tiny pieces, but not before I copy it and distribute out of sheer spite.

Never admit that publicly. DMCA, RIAA, Evidence, I hope you weren't serious. These are not nice guys to deal with.

If you admit it, do it from a public terminal as an AC.

Re:the big guys take punches like candy...

[DigitalEntropy]

Good point, and in that case I rescind my offer to copy and distribute. The thousand pieces thing is still happening.

Re:the big guys take punches like candy...

[Burz]

Debian is more of a meta-distribution: A Linux that distributors can mould into something made for their end-users. By itself, Debian is pretty raw.

I recommend Xandros Linux if you're used to Windows. It consistently gets the highest marks from PC Mag, PC World, Cnet and others. And its based on Debian. I've used it for years and it has possibly the best hardware detection available, along with simple and complete integration with Windows Domains, VPN and home folder encryption setup, and a Control Center that actually makes sense (to me).

You can also buy Xandros with Crossover Office pre-installed. I haven't needed to run Windows programs for some time, but DVD Shrink runs well so I use that as a more convenient alternative to DVD::Rip.

SuSE (with KDE) and Linspire are two others that you may feel comfortable with.

Finally, do remember this: Once you leave Windows, no longer can you take hardware compatability for granted. Even if you get a bit lucky (as happened with me) and your chosen Linux distro works with 100% of the equipment you already have, careless purchasing could easily land you with a device that is driverless or a configuration nightmare. Check on the net (particularly with an HCL) before you buy.

Sony is flirting with trouble...

[TiggertheMad]

They don't put it there. You do. They just packaged it for you. If you didn't want to give them permission to run arbitrary executables on your computer, then WHY DID YOU RUN THEIR EXECUTABLE??

IANAL, however, I believe that contracts that are made in bad faith, or with the intent to decieve a particpant are not binding. If this is the case, I think that I wouldn't be hard to argue in a court that you have no obligation to keep Sony's rootkit (by deffinition an illicit and deceptive tool) on your computer. Moreover, you might also be entitled to damages resulting from said 'bad faith' agreement.

Even if my assessment isn't quite correct, it seems to me that it is probably fuzzy enough of a point to invite litigation. If I were a multimillion(billion?) dollar company I wouldn't be the one to test the legal water on something like this.

Re:Sony is flirting with trouble...

[Anonymous Coward]

I'm sure Sony has more than enough legal resources to consider taking this risk. No matter how much people bitch about it, I doubt many people would attempt a lawsuit against Sony unless they suffered significant losses because of this. The more tech savvy people that are likely to be able to work out that this rootkit was responsible for a security breach causing a loss would most likely avoid this DRM shit in the first place, and the people who would be affected by it would probably be clueless as to the cause of any security breach and not know it was Sony's fault.

This isn't a risk I would take if it was my decision, but that is because I don't think DRM is worthwhile, but someone who thinks DRM will actually work would consider this to be a wothwhile risk.

Random predictions

[Anonymous Coward]

* This story will not make it to high-profile offline (TV, etc) news sources.

* Most of the people you know will keep buying CDs in stores without checking for the "CD digital audio" logo.

* Most of the people you know will keep doing business with such companies.

Can we do anything about any of it?

It's called Trusting the consumer - NOT!

[Anonymous Coward]

Phil Wiser - CTO at Sony and in charge of DRM.

He said this in 2003:

"All copy-protections can be hacked," Wiser said. "But if give people what they are asking for in terms of value, they won't go out and steal it. It's called trusting the consumer."

I guess he is no longer trusting YOU - buy some other product then.

http://www.wired.com/news/digiwood/0,1412,61161,00 .html?tw=wn_tophead_7/

In case this link melts down what follows is the whole article on Wired. Reuters 08:55 AM Nov. 10, 2003 PT Sony Music, home to such artists as Beyonce Knowles and Bruce Springsteen, said Monday it plans to introduce new CD technology in Germany that prevents users from copying songs to file-sharing sites, but allows them to make copies for their personal use.

The record industry blames its recent sales slump on file-sharing services like Kazaa, which it says are havens for piracy. Last year, major labels issued "copy-protected" CDs that prevent them from being played on computers.

The copy-protected discs faced a backlash from customers and music fans, and several lawsuits emerged from some customers that complained these CDs caused their computers and other devices to malfunction.

But Sony thinks it has an appealing approach: Give customers added incentives to buy copy-protected CDs.

On Monday, Sony will release R&B group Naturally Seven's new CD in Germany with a so-called "second session." The disc can be played on almost any device conventionally, said Phil Wiser, Sony Music's chief technology officer.

It also contains a compressed digital copy of the music that can be quickly copied onto any computer. From the computer, users can copy that music onto Sony portable digital music players.

The CDs also allow users to connect to websites with exclusive features such as bonus songs and concert tickets. The features are only available if you have the original CD.

Such features are already available with Sony artists like Tori Amos and AC/DC. But the new discs combine the "second session" copy protection with the bonus features, which Sony is calling "ConnecteD."

Sony plans to evaluate customers' reaction to the new technology before introducing it in other countries. Wiser declined to specify a timetable for which the technology will be available in the United States.

A label on the disc will say it includes the new copy protection software features.

There are several limitations. The digital files will only play on Sony-licensed digital music players. Wiser said Sony is working on plug-ins that allow the files to be played on more popular players like Microsoft's Windows Media. He expects the plug-ins to be available early next year.

To copy the music to the Sony portable player, the technology requires an extra step to copy the files to a separate program to transfer the music to the portable player.

At this point, music can be transferred only to Sony portable players, although Sony executives note that Apple Computer's popular iTunes service works the same way with the Apple-branded iPod.

Earlier this year, BMG introduced similar technology with its hip-hop performer Anthony Hamilton.

BMG, which announced plans to merge with Sony Music last week, is using software from SunnComm Technologies to restrict the amount of copies that could be made of Hamilton's music. The software, however, did not work on some operating systems and was quickly hacked.

"All copy-protections can be hacked," Wiser said. "But if give people what they are asking for in terms of value, they won't go out and steal it. It's called trusting the consumer."

But does it EVEN WORK???

[davidwr]

Can I copy it using Linux or a hardware CD duplicator and wind up with an exact image?

How about if I stick it in a Windows box and hold down the SHIFT key and use run-of-the-mill CD-copy software?

Assume the software or hardware duplicator is neither designed to overcome nor honor copy protection, that is, they to their best to faithfully copies any bits they can read, failing on "unreadable" bits but not aborting the copy when they see readable bits that indicate a copy-protection "signature."

EULA Details

[TiggertheMad]

RTFA, the EULA does not mention this at all...the writer of the article made a specific point with respect to this.

It's awful hard to conceal a rootkit if it is mentioned explicitly in the EULA....

You, the user, will not remove or tamper with the rootkit we have installed at c:\winnt\system32\secretsonyrootkit. You will not interfere with it communicating with servers at 64.27.129.244 on ports 62001-62004, or stop the windows service labeled 'svchost_mgr'. If you fail to comply with the terms of this binding legal agreement, you will be forced to by Brittiny's next five (5) albums.

You just helped with my PSP/PS3 decision

[Bodhammer]

Sony, you have gone too far...

No PSP for Christmas!

No PS3 next year!

So you protected a $15 CD by killing ~$700 of hardware purchases plus whatever games I would have purchased.

No wonder your stock sucks and your revenues are down!

Your DRM works, I'm exercising my right not to purchase your products any more!

Re:You just helped with my PSP/PS3 decision

[tciny]

>> Sony, you have gone too far...
>> No PSP for Christmas!
>> No PS3 next year!

Firstly: Sony DADC and Sony Computer Entertainment have barely anything to do with each other apart from the similarity in the name; so that alone is just rediculous.
Apart from that: Do you really think Microsoft is any better than Sony in this respect? Both the PS3 and the XBox360 will rely heavily on their internet connection, meaning that both companies will spy on you just as badly as Valve is doing with PC gamers right now.

Re:You just helped with my PSP/PS3 decision

[idontgno]

Firstly, they're owned by the same corporate. "Barely anything" is a bit too strong.

Secondly, learn to spell "ridiculous".

Thirdly, GP post mentions absolutely nothing about Microsoft, or XBox360, or any other purported alternative to a PS3 purchase. There's always the time-honored alternative, "none of the above". But it was a lovely straw man while it lasted.

Re:You just helped with my PSP/PS3 decision

[DeadlyDonkey]

Valve is spying on you? Wow, that's a new one, considering you can perfectly easily close, disable, uninstall, and not have steam running. It only needs to be open when you are playing a Valve game, and the only statistics it takes are which games you are playing, and for how long. The results of that logging can be pretty interesting too.

Re:You just helped with my PSP/PS3 decision

[SpooForBrains]

I couldn't agree more. That's why I intend instead to get one of these. Admittedly it won't play Burnout 26: Chunderstrike, but I would have been more interested in the hobbyist side of the PSP anyway.

Re:You just helped with my PSP/PS3 decision

[Anonymous Coward]

Sony DADC also make "SecuROM" which stops (shop-bought) games from running on PCs unless they have the exact right model of CD-ROM drive.

Re:You just helped with my PSP/PS3 decision

[Madoc Owain]

Why deprive yourself of Sony's products without need? Simply buy them used. They don't get a red cent from you, and you can still enjoy the products.

I planned on buying a new PS2 after the PS3 came out and prices dropped, but this was the last straw. I'll buy a PS2 used, along with used games, along with my music CDs.

Re:You just helped with my PSP/PS3 decision

[Achromatic1978]

which games you are playing, and for how long

And that's not spying?

Re:You just helped with my PSP/PS3 decision

[danpsmith]

Why does this information need logging? I'm getting quickly tired of that "consumer research" line as an excuse to spy on users. If you want research and statistics from your consumers, try asking them for christ's sake...

Re:You just helped with my PSP/PS3 decision

[Anonymous Coward]

You sound like you need a dictionary.

Fucktard.

Windows-only attack

[Anonymous Coward]

This is a Windows rootkit. Mac just became the "trusted" platform for music storage/playback. Sony just became an "avoid at all costs" brand name.

It's interesting that DRM is coming to mean "untrustable" to the average consumer. Microsoft's Trusted Computing is taking on similar connotations with lay people. Not just geeks. The man on the street feels that it can't be trusted.

great

[akhomerun]

rootkits are an example of DRM gone horribly wrong. at least with online music stores, they let you make copies of a CD and it doesn't run buggy Sony code and screw with your already insecure windows environment.

DRM is acceptable if it's consumer friendly and is only made to stop mass illegal distribution. Ideally DRM should make copying and sharing digital music over the internet equally inconvenient as it is for analog mediums.

DRM shouldn't be a way to make up for lost music sales due to piracy. the industry needs to adapt. they have to realize, if they embrace online distribution with extremely light DRM, then piracy won't be an issue.

If the industry sold songs for around $0.39, or something low like that, people wouldn't find it worth the effort to even download illegal copies. lowering the outrageous prices for music is a DRM in itself. Everyone knows that it costs way less to put a song online than it does to package it and distribute it to 900,000,000 WalMarts. Heck, with BitTorrent I could distribute a whole album at absolutely no cost to me, no real bandwidth concerns, nothing.

Okay I'm straying from the topic...but what if online music stores used technology like that in BitTorrent plus light DRM so that the online music stores could make more money? They would eliminate bandwidth costs, and they could possibly set up some backup servers to do normal http/ftp downloads if a songs aren't popular enough to find enough peers.

even i can think up so many ways to squeeze out more money of music sales without taking advantage of the consumer.

This House is Clear?

[jambarama]

I read this article not 30 minutes ago. Thought it was very insightful and good investigative work. What happened? Now the link is dead, no mention of the article on the sight, coral cache can't dig it up, nor can google cache?

Where did it go? Anyone got it in cache? How about a mirror?

Re:This House is Clear?

[parking_god]

For the moment at least, Mark's Sysinternals Blog main page ( http://www.sysinternals.com/blog/ ) will get you there. The funny thing is that the permalink is http://www.sysinternals.com/blog/2005/10/sony-root kits-and-digital-rights.html , which is exactly the same link quoted in the /. entry, and is (as you noted) broken.

Re:This House is Clear?

[Kickasso]

Still at http://www.sysinternals.com/blog/2005_10_01_archiv e.html

Well, well, well...

[RoffleTheWaffle]

Cat's out of the bag now. Congratulations, Sony. You fucked up big time.

I'd like to take this opportunity to dissect the article in question here, to point out just how positively obscene this is. There are a few key points I'd like to highlight that I feel we should all take into consideration.

It would appear that Sony has deliberately begun shipping rootkits with its DRM protected CDs. According to the article - and this is a pretty good definition, by the way - "Rootkits are cloaking technologies that hide files, Registry keys, and other system objects from diagnostic and security software, and they are usually employed by malware attempting to keep their implementation hidden." In a nutshell, this means that the program shipped with the CD in question here - and possibly other Sony CDs - is designed to hide itself and other programs from view. In other words, once installed, it will allow Sony and any other interested party familiar with this particular rootkit to operate programs on a compromised system without the user knowing it.

Let's take a step back here to consider the implications of this. Sony is distributing a rootkit, but what does this have to do with DRM? Well, if you really think about it, it has everything to do with DRM. A DRM program that cannot be seen or easily accessed can operate secretly, monitoring and manipulating the system behind the user's back. Any future DRM software Sony distributes could infiltrate a computer secretly, and burrow deep into the system files of said computer.

According to the article, the rootkit was produced by First 4 Internet. Upon investigating the company itself and the products and services it offers, the author dredged up this lovely little nugget of joy: "... However, the fact that the company sells a technology called XCP made me think that maybe the files I'd found were part of some content protection scheme. I Googled the company name and came across this article, confirming the fact that they have deals with several record companies, including Sony, to implement Digital Rights Management (DRM) software for CDs." That right there should be proof enough that this is no accident, and anything but legitimate DRM. Not only does having a rootkit handy make the DRM difficult to thwart, but also allows it to operate secretly.

Now, you'd think that you could just remove this software, right? Wrong. Dead wrong, as a matter of fact. The author of the article had a hell of a time removing the rootkit, actually, and not only that, at any given time, it was consuming between one and two percent of the CPU's power - a small 'penalty' for even having it. (And any programs it's hiding would also have to leech off the CPU and RAM as well.) As he attempted to remove this shit, he discovered even more about the software: "As I was deleting the driver Registry keys under HKLM\System\CurrentControlSet\Services I noted that they were either configured as boot-start drivers or members of groups listed by name in the HKLM\System\CurrentControlSet\SafeBoot subkeys, which means that they load even in Safe Mode, making system recovery extremely difficult if any of them have a bug that prevents the system from booting." Suddenly, this is more than a performance issue. This software could theoretically disable a system should it break or be manipulated by the software it's hiding. It would appear, however, it is possible to remove, but only after eviscerating a handful of driver files, registry entries and keys, and other lovely goodies from your system. The rootkit and the DRM attached to it do not have an uninstaller, and unless you take the same steps the author took to remove this flaming pile of garbage from your system... Well, he puts it pretty well:

"The entire experience was frustrating and irritating. Not only had Sony put software on my system that uses techniques commonly used by malware to mask its presence, the software is poorly written and provides no means for uninstall. Worse, most users that stumble across the cloaked files wit

Re:Well, well, well...

[Anonymous Coward]

Now here's where you can sue them. Their DRM not only slows down your computer, but costs you money. That's right, because they installed their crap on your computer and are sucking up your CPU time, you pay more in electric bills.

Re:Well, well, well...

[Anonymous Coward]

So you win and get 18 cents in damages.

Re:Well, well, well...

[Anonymous Coward]

Better yet they offer 10 Sony cd's for the price of 1...

Re:Well, well, well...

[Anonymous Coward]

Boy I am so glad that diagnosing such shit on my system would only consist of booting a CD and checking /sbin/init and /etc/rc and go from there, if it were possible to happen on my system of course.

It's infinitely better to have all things concerning system bootup in clear text files using easy shell scripts than to have this registry monstrosity that loads drivers and applications in hundreds of different places and is useless with a plain text editor.

Re:Well, well, well...

[Burz]

OTOH, if this came down as a Microsoft service pack or an OS upgrade, then the rootkit would no longer be considered a rootkit.

Sony Should Be Shot For This

[Nom du Keyboard]

Sony should be shot for this. Slammed so hard financially that they'll never even think of trying this again

How long for another, slightly different DRM rootkit starts fighting with this one with each trying to take control away from the other as both run on your system?

Of course, it needed some level of privilege to run. Does this CD simply refuse to play if you're not Administrator or Power User?

"Funny"?

[RedCard]

I'm glad I get my music off of p2p networks and don't have to worry about trojans and rootkits and that evil hacker stuff!

Modded funny? If I have to put up with rootkits when I buy a CD, this might as well have been modded "Insightful".

Re:Alternative OS users

[Tony Hoyle]

What we *can* do is write a detector (only takes one of use) and hopefully a remover. Distribute it widely. Make it plain where this malware came from too... the non-technical will soon understand that playing a Sony CD will break their computer - that's all the knowledge they need.

God! Can't Sony Get Anything Right?

[8127972]

First they come out with copy protection that's easily defeated by a magic marker. Then they they come out with a rootkit as part of DRM.

No wonder they're losing piles of money. They're wasting it all on stupid stuff like this!

all our base...

[Anonymous Coward]

...are belong to sony?

this is illegal under Minnesota law

[swschrad]

it's a 5/$5000 penalty, class C felony, to knowingly distribute harmful software to a PC in Minnesota. 1992 law, I believe it was. demonstrating this is a rootkit is prima facie evidence that this would be harmful software.

somebody with means should get a case opened....

Re:this is illegal under Minnesota law

[Reziac]

If it's a felony, file charges with your local district attorney, and let the DA's office take it from there (you may be called as a witness, but you don't have to defend yourself or hire a lawyer, tho doing so might not hurt). Criminal prosecutions aren't like a civil suits, where you have to finance the operation yourself. In criminal cases, your tax dollars have already funded it, and the other guy is on the defensive by default.

Interesting thought: what if, propelled by enough such prosecutions, DRM alone became grounds for "reasonable suspicion of criminal activity"??

Re:this is illegal under Minnesota law

[Anonymous Coward]

Sure, go ahead and file criminal charges. The prosecutors will confiscate your PC as evidence. It will be returned when the case against Sony is closed.

Re:this is illegal under Minnesota law

[Reziac]

So be smart enough to use a "disposable" PC for the purpose.

Re:this is illegal under Minnesota law

[milimetric]

ok, good point, but... what would the result be? Sony gets charged $5000 dollars? Even per CD that's nothing to them. The problem is the trial process. Something as this should be an automatic fine. Sony wouldn't be sued and made to pay the money, it would automatically happen. Otherwise, who's going to go to war with a monster like Sony over $5000?

Re:this is illegal under Minnesota law

[John Hasler]

> ok, good point, but... what would the result be? Sony gets charged
> $5000 dollars? Even per CD that's nothing to them.

I think that they would notice a $5000 fine for every such CD sold in the state. They'd also notice the threat of much more severe punishment should they ever do it again.

In practice, though, the DA would ignore the complaint and nothing would come of it. Much better to complain to the state attorney general and try to get him to make a "consumer" issue of it.

> Something as this should be an automatic fine.

I see. So if someone were to accuse you of something like this you should be automatically fined: no trial or anything.

Re:this is illegal under Minnesota law

[milimetric]

I get your point, and I'm not saying no trial lightly. But it should be like fining companies for dumping waste. They get caught, they get fined. It's not like some intricate elaborate thing you have to prove, they did it, end of story

TFA - text & mirror

[Anonymous Coward]

Since I got a 404 not found at the actual article link, I found the story at mirrordot.

Mark's Sysinternals Blog
Monday, October 31, 2005
Sony, Rootkits and Digital Rights Management Gone Too Far
Last week when I was testing the latest version of RootkitRevealer (RKR) I ran a scan on one of my systems and was shocked to see evidence of a rootkit. Rootkits are cloaking technologies that hide files, Registry keys, and other system objects from diagnostic and security software, and they are usually employed by malware attempting to keep their implementation hidden (see my âoeUnearthing Rootkitsâ article from the June issue of Windows IT Pro Magazine for more information on rootkits). The RKR results window reported a hidden directory, several hidden device drivers, and a hidden application:

Given the fact that Iâ(TM)m careful in my surfing habits and only install software from reputable sources I had no idea how Iâ(TM)d picked up a real rootkit, and if it were not for the suspicious names of the listed files I would have suspected RKR to have a bug. I immediately ran Process Explorer and Autoruns to look for evidence of code that would activate the rootkit each boot, but I came up empty with both tools. I next turned to LiveKd, a tool I wrote for Inside Windows 2000 and that lets you explorer the internals of a live system using the Microsoft kernel debugger, to determine what component was responsible for the cloaking.

Rootkits that hide files, directories and Registry keys can either execute in user mode by patching Windows APIs in each process that applications use to access those objects, or in kernel mode by intercepting the associated kernel-mode APIs. A common way to intercept kernel-mode application APIs is to patch the kernelâ(TM)s system service table, a technique that I pioneered with Bryce for Windows back in 1996 when we wrote the first version of Regmon. Every kernel service thatâ(TM)s exported for use by Windows applications has a pointer in a table thatâ(TM)s indexed with the internal service number Windows assigns to the API. If a driver replaces an entry in the table with a pointer to its own function then the kernel invokes the driver function any time an application executes the API and the driver can control the behavior of the API.

Itâ(TM)s relatively easy to spot system call hooking simply by dumping the contents of the service table: all entries should point at addresses that lie within the Windows kernel; any that donâ(TM)t are patched functions. Dumping the table in Livekd revealed several patched functions:

I listed one of the intercepting functions and saw that it was part of the Aries.sys device driver, which was one of the images I had seen cloaked in the $sys$filesystem directory:

Armed with the knowledge of what driver implemented the cloaking I set off to see if I could disable the cloak and expose the hidden processes, files, directories, and Reegistry data. Although RKR indicated that the \Windows\System32\$sys$filesystem directory was hidden from the Windows API, itâ(TM)s common for rootkits to hide directories from a directory listing, but not to prevent a hidden directory from being opened directly. I therefore checked to see if I could examine the files within the hidden directory by opening a command prompt and changing into the hidden directory. Sure enough, I was able to enter and access most of the hidden files:

Perhaps renaming the driver and rebooting would remove the cloak, but I also wanted to see if Aries.sys was doing more than cloaking so I copied it to an uncloaked directory and loaded it into IDA Pro, a powerful disassembler I use in my exploration of Windows internals. Hereâ(TM)s a screenshot of IDA Proâ(TM)s disassembly of the code that calculates the entries in the system service table that correspond to the functions it wants to manipulate:

I studied the dr

Legal Precedent in other forms

[istartedi]

If I kill you to prevent you from killing me, killing you is self defense and not a crime. Seems reasonable that if I kill Sony's process to prevent it from stealing my ID that it's self defense and not a crime. The DMCA is one of those laws that is so out of whack, nevermind the US Constitution. It probably violates Brittish common law, the Magna Carta, and if you look hard enough it probably violates the code of Hammurabai and the social order of primitive hunter-gatherer cultures too.

Re:Legal Precedent in other forms

[Jussi K. Kojootti]

Hey istartedi, if you ever find yourself in a court of law, get a lawyer. Seriously.

Re:Legal Precedent in other forms

[istartedi]

Duh. Only a fool represents himself. It's 3 am. I just got back from a Halloween celebration that involved alcohol, and I still realize that. So what's your point? Idjits!

Root

[PenGun]

How in hell did a CD get root ... oh right windose will fuck anything.

    PenGun
  Do What Now ??? ... Standards and Practices !

Damn, I thought I was first

[muzzy]

I thought I was ahead of time, when I implemented a rootkit DRM just a few days ago. My rootkit is a part of my project, trying to show how malware and DRM systems can get really close to each others, and both get protected by law. Under EU Copyright Directive, it's going to be illegal to remove this rootkit.

You can read about my copyright projects here:
http://muzzy.net/files/copyright_projects_en.txt

Re:Damn, I thought I was first

[Tim C]

I strongly suspect that covert installation of software is itself illegal in the UK under the Computer Misuse Act. They're also opening themselves up to the possibility of being sued for at least negligence if anyone exploits the rootkit to do (even) more nefarious things; it's a pretty obvious security hole, and they've clearly chosen to ignore the potential consequences of introducing it to other people's computers.

Exactly...

[msauve]

as you pointed out, it says "CD." "CD" is a trademark, and can only be used (per Philips) to describe optical media meeting certain standards. In the case of audio CDs, that would be the "Red Book." As this piece of plastic clearly does not meet that standard, it should not be have been called a CD. It is (legally) safe to assume that anything called a copy protected CD has only benign protection, such as the copy protection offered by copyright law. Anything which uses technical means of copy protection is not a CD.

Re:Exactly...

[mikiN]

Anything which uses technical means of copy protection is not a CD.

Not true. There is exactly one type of copy protection allowed by the Red Book standard (in fact all implementations have to adhere to its technical specification, whether they enforce it or not), and it is a variant of SCMS.

Basically, SCMS defines whether a source is copy-restricted or not, as well as whether it is an original or a copy. The idea is that anyone can make at most one copy of a copy-restricted original, but not a copy of a copy-restricted copy. See also here.

A distinction was made between consumer-grade (stand-alone) CD copiers (which should always obey SCMS) and professional CD-writers (which were not required to obey SCMS). Strangely, CD-writers attached to computers were treated the same way as professional units (presumably to allow users to copy-restrict their own work).

This strange treatment of computer-attached CD-recorders, combined with most recording software ignoring SCMS altogether in case of direct CD-to-CD copying seems to me the root cause of the current problems with non-conforming copy-protected CD's.

It is an interesting question whether either or both parties are violating the DMCA. I think that either CD-reader/CD-recorder manufacturers should have disallowed ripping of audio-CD's altogether, or they should have output a DRM-ed data format which can only be written to audio-CD's again by software compliant with SCMS.

Re:Exactly...

[BillyBlaze]

I think that either CD-reader/CD-recorder manufacturers should have disallowed ripping of audio-CD's altogether, or they should have output a DRM-ed data format which can only be written to audio-CD's again by software compliant with SCMS.

I think that would have sucked.

Re:Exactly...

[Anonymous Coward]

Computer drives were considered professional equipment because of the fact they were connected to general purpose computers and it would be fairly easy to circumvent SCMS anyway. Since it would have taken at worst a firmware flash to bypass SCMS the decision was made to treat computer hardware as professional equipment.

Would you accept that excuse?

[jbn-o]

Why should Sony be able to get away with blaming it on an errant employee?

Court of Public Opinion

[ZachPruckowski]

So, um, what's going to happen when this gets out (if it does) and DRM is equated with virii/malware/trojans/hackers etc?

Somehow, I don't think Sony wants to be known as the guys who put illegal software on your computer to protect "digital rights".

Boosts Apple's Profits

[kahrytan]

This kind of stunt will only boost Apple's iTunes profits. People could just buy it from their store when available.

        As for the legal discussion for disabling the rootkit. No one should assume if Sony would win or not unless they are a lawyer.

        Copy Protection is copy protection. If Amazon.com says it has copy protection, then it includes whatever method the manufacturer used including the rootkit.

  To avoid this rootkit, then don't buy the cd. Show your disgust for Sony's actions.

Deathmatch: Sony vs MS

[mik]

Shouldn't MS be upset at this? After all, here is Sony, willfully damaging MS's intellectual property in order to protect their own. The battle has been joined - the giants are at war and the battleground is your windoze pc...

File trading safer from rootkits?

[Jamesday]

So, with things like this going on, what's the relative prevalence of rootkits on music purchased on CD from a store and music downloaded (legally or illegally) from file trading networks?

It's starting to look as though it's more secure to go with the file trading networks than the stores.

Re:File trading safer from rootkits?

[Anonymous Coward]

Assuming you stick to file formats that are pure music or movie data and can't contain executable code (i.e. no Windows Media) it is unlikely you will have to worry about a rootkit as it would have to use a buffer overrun or similar exploit to infect you. Even in that case such an exploit would probably be targeted at Windows Media Player so using a un*x media player like Mplayer, Xine, or XMMS or anything other than Windows Media Player on Windows should be enough. Note that an exploit might be targeted to the codecs so replacing as many Windows codecs with alternate ones such as using Windows ports of ffmpeg is a good idea too.

1st semester contract law

[Anonymous Coward]

IANAL, but I did watch many of the classes for a semester of contract law on the campus classroom TV channel without being enrolled in that class and learned a few things.

I think you mean that it's not an "enforcable" contract. All these words have very weird technical meanings, but that's a fairly stock example :) Thus, if you go to court, the Court will refuse to enforce the contract because the performance required by it is unlawful (and you'll probably get in trouble once you tell the Court about it). Valid means something else; I don't have a legal dictionary handy, but I believe that it's concerned with whether or not there was a valid exchange of promises or something like that (e.g. a contract might be invalid if it were not agreed to by one of the parties, etc.).

There are also void and voidable contracts (voidable ones *can* be voided, but haven't been yet--the actors can still perform if they wish to). The stock example here is a contract with a minor that is not for a necessity (so, e.g. emancipated minors can still rent housing, etc.) or who is not acting as someone else's agent (e.g. if you have your 2-year-old agree to a EULA on your behalf in an effort to escape it--you consent to the EULA by your actions in using the software if you're merely aware of it... a legal result I understand but hate in the case of EULAs).

I can't remember any other classes of contracts just now, but I wouldn't be surprised if I missed a few :) Like I said, I wasn't exactly enrolled in the class I watched on TV, so I probably missed a few things other than the general notion that you really do need a licensed attourney if you want legal advice :)

DRM at its best

[Nicolas MONNET]

Here's what happened to me last month: american brother of a friend comes to visit. He brings a handful of DVDs, we try to watch them but lo, I haven't dezoned my DVD writer. After 30 minutes of trying to find the patch I give up, and spend about 30 secs to look the movies up in a bittorrent site and initiate download.

We watch them the next day with excellent quality and no FBI warning crap.

Wait wait WAIT

[Pichu0102]

Norton actually REMOVES viruses?!
The sounds like something the National Enquirer would do a story on. "Norton Actually Removes Viruses instead of just showing you you're infected!"

Not on my portion of the Internet

[xixax]

And just how is such a device going to reach the Internet?

iptables -A INPUT --mac-source XX:XX:XX:XX:XX: -j DROP

And they can hardly send in the storm troopers based on this sort of evidence, "Midunno, the house got hit by lightning, maybe that screwed it up? I can't show you the device, it was broken so I threw it out".

That would also make for a nasty payload for a Windows virus. Not only does your DVD player get turned into a paperweight, the victim might also get raided by the DRM police.

Xix.

Re:Not on my portion of the Internet

[Kjella]

And just how is such a device going to reach the Internet?

Good question. Because without Internet access to renew its keys it will simply stop working. Welcome to the DRM future.

Re:Not on my portion of the Internet

[Alsee]

I admit I might be confusing this with one of the other HD-DVD DRM schemes I read up on, but I'm pretty sure they plan to burn revokation codes onto all new disks as they come out. Put a new disk in your drive and it no longer works. And with the huge capacity of the new disks, it takes up negligable space even if they include a hundred thousand revokation codes.

-

Re:Not on my portion of the Internet

[xtracto]

Just a little thought.

I am sure that "call home" approach of the Blue Ray players will not be a problem.

I remember wonce I downloaded a crack for a program which protection mechanism consisted in a key validation. To validate the key the program sent it to the company servers.

I thought the crack was really awesome as it simulated the actual company server and you only had to tell the program you where using a "proxy" to connect to internet and point it to 127.0.0.1:XXXX. While running the crack program.

When the program tried to connect to the server to validate your key, the crack program responded saying the key was valid.

Once I did some cracks for some programs (just for education), never released anything. But I learned the different "levels" of cracks, being this crack one of the finest and cleanest one.

I am sure, after the Blu-Disk or HD-DVD PC drives come into the market, those kind of hacks will become available. It is just a mather of time.

If you think that encryption could stop this approach I am sure not, it is just a matter of "brute forcing" the keys in the messages that go through the localhost connection.

Neat uh?

Re:Not on my portion of the Internet

[endoplasmicMessenger]

And just how is such a device going to reach the Internet?

I would certainly like more information on how this is supposed to work.

For some reason, I had the idea that if/when the keys on a specific player were cracked, all discs manufactured after that point would be able to reject those keys. No internet access needed.

That would pretty much defeat any attempt at a linux player.

Which is why I personally will not be upgrading to this new technology.

Sack?

[CyricZ]

"Sack" as in fire him, or "sack" as in punch him square in the scrotum?

Frankly, I think he needs the punch before being fired.

The feedback I sent to Sony

[keraneuology]

Dear Sony Regarding the rootkit you are attempting to install on the computers of customers who purchase Van Zant's "Get Right with the Man": my relationship with you is over. I will never again purchase -any- CD from Sony Music. Period. Your intentional introduction of security holes and your undisclosed modification of the operating system is simply unacceptable and uncalled for. Your application of excessive, intrusive and unreasonable DRM has ensured that I will -never- purchase any work with the Sony logo. The number of pirated copies this prevents me from downloading or sharing? Zero - I don't pirate. I don't give people copies of my music. The number of future dollars your DRM (which is sure to be broken within weeks anyway) has cost your company? Beyond calculation: my life expectancy has me sticking around - NOT buying Sony music, by the way - for decades to come. Was this worth the trade? If you want my business then I demand nothing short of full public disclosure, an appology, and the very public firing of the executive who gave the green light to this horrible, horrible concept. Please note that I intend to share this letter with others. With luck they too will refuse to purchase Sony music in the future.

MD5 Checksums?

[MichaelSmith]

How hard would it be to keep a checksum of every important file in C:\WINDOWS on a CDROM, along with a program to verify each file against the externally stored hash?

The only problem I can see is that the rooted kernel may interfere with the program which does the check, but I suppose you could get around this with a bootable CD.

Re:MD5 Checksums?

[Mechcozmo]

And after each update, the MD5 sums would change. Could be quite annoying, especially with all the different combinations of patches and the files they modify.

Hmm...

[TX297]

So the RIAA pitched to us last year that illegal music downloads were poorer-quality and that pirates faced "lots and lots" of viruses to wade through.

But now the legitimate users are getting rootkits installed while the pirates can download a DRM-free version of the album? I'd rather take the chance on an illegal download than put something in my computer that I know will install a rootkit on my system.

If Sony's DRM ever gets popular enough (and I hope to god it won't) then what's to stop virus makers using the cloaking abilities of a rootkit ALREADY INSTALLED for nefarious puposes? Sony is bound by their EULA not to collect information, although that EULA mentions nothing of removing the software. Hell, they could even claim under the "reverse engineering" clause of the DMCA that removing it requires disassembly and then sue you.

I really hope this goes to court and Sony gets handed their ass on a platter. Otherwise this will be a real blow to privacy and (even though corporations/government don't care about it any more), fair use.

Stay away from this Sony crap.

What a bunch of losers

[cdrguru]

Let's review here: someone has found a publicly distributed driver that when properly installed on Windows hides files and folders. It may have some additional and yet unknown functionality and may be coupled with a driver which, under the right circumstances, disables access to a CD drive.

Sony is distributing this as part of some larger, possibly effective DRM system for music CDs.

What I see here is an endless amount of whining about how awful this is. You are overlooking the potential of this. The key here is that this is now out in the wild and can be exploited. The contest should be to come up with creative (and possibly destructive) things to do with these drivers when packaged with other software.

The result of this should be interesting. I think the responsiblity for all of this rests with Sony and First 4 Internet, but I would really like to see something creative done with this, such as an ActiveX control that disables the CD drive of anyone who visits a web site. The point is to make as much use of this as possible. Sony has provided the tool, it is now up to everyone to make as much use of this as possible.

Re:What a bunch of losers

[RoffleTheWaffle]

You are an evil, evil man.

You're also hitting the nail right on the head.

This -is- out in the wild. This -is- on other CDs and is almost certainly embedded in other products. It's hard to say how long Sony has been doing this, or how many systems have been compromised by this rootkit, but one thing is certain: they did a horrible job of making sure other programs stay out of it, and chances are the damage is already very widespread.

According to the article, any process prefixed with $Sys$ will be hidden. This is so easy to exploit it's not even funny. The author of the article went out of his way to figure out what the rootkit was, where it came from, and how to get rid of it, but what else does this rootkit do besides hide files? Are there other complimentary or supplimentary programs available that already exploit this rootkit not listed in the article? This should be investigated heavily. Once we all figure out the full potential of this rootkit, we'll know the extent of the damage done, and what can be done with this software on machines that have already been compromised.

Hackers will have a field day with this one. It's just too bad that Sony and F41 likely won't be held accountable if their DRM software makes it possible for a highly destructive virus to take advantage of several thousand - if not more - compromised systems here in the U.S. (And worldwide, that number will only grow, of course.)

Props for stating what should be the obvious. The real reason this should be considered 'awful' is because it can blow your machine wide open to attack, over everything else that's horribly wrong with this.

Rage, but it's hard to defeat The Golden Rule

[the_mushroom_king]

Whoever has the gold, makes the rules.

In the US, we have a powerful group of people who buy and sell legislation on a daily basis. We call them Lobbyists.

---
Just because I'm paranoid doesn't mean they aren't out to get me.

First Payola, Now Rootkits

[Nom du Keyboard]

First Payola, now Rootkits. Sony music is just about as dishonst as they come.

And this doesn't even get into business partnerships with Michael Jackson!

Can we sue?

[Anonymous Coward]

Can we sue Mark for violation of the DCMA?

Years ago, yes; Now, ?????

[WindBourne]

It seems like the dems took away our rights for fair use and the republicans are taking our rights to sue. So your guess is as good as anybodies. Maybe even better.

What if you "just say no" ?

[quentin_quayle]

Evidently Russinovich ran the executable and clicked "Agree" on the EULA. He didn't look into what happens if the user opts out.

If you click "Don't Agree" and it installs the rootkit anyway, I'd say there's a crime and a tort, maybe more than one of each.

/ not a lawyer, but am a LS grad.

As seen previously on Slashdot

[FromWithin]

The technology used in this rootkit appeared on Slashdot about six months ago.

At least now we know how it works.

Most likely...

[CupBeEmpty]

I think it's far more likely that Sony knew what this software did, and chose to distribute it anyway. This could have been a result of incompetent testers, poor communication between QA and management, overbearing management anxious to get a product out on a strict deadline, or any number of other things.

It is most likely that this is actually an elaborate ploy to ruin the lives of Van Zant fans by die hard Lynrd Skynrd fans.

My definition of "Non-Application Software"

[Khyber]

And I'll use my favorite game as the example. Enemy Territory. It's perfectly legal. It tells you that you will need to enable punkbuster (a separate piece of software) in order to play on many servers, in order to prevent cheating. You're given the option of disabling the software, and even playing on servers that do not have punkbuster enabled.

Punkbuster counts as application software, IMHO. Now, what Sony is doing, I do not believe is application software. First off, this is an Audio CD. It's application is to play music. Installing software on your computer, let alone a rootkit, is not part of the application function of playing audio, to me. IANAL. I think Sony's rather fucked on this, as long as someone actually bothers to think of this sort of point.

Though, I hate to see it when playing an audio cd requires even a hardware-enabled DRM chip in your cd player to tell the laser how to read the data, or integrate the rootkit as an essential function of the game (I.E. the game system crashes because a 'critical' file has not been found.) At that point, I think I'll be playing classics for a LONG time. Well, that's not too bad, I think. Old games kicked ass and were innovative. Now everything follows the same pattern (for the most part, not EVERY game is a damned rip-off or clone,) in almost every genre. Asides from neat games like Katamari Damacy, and a few others that I'm too drunk to recall, there hasn't been much innovation. Shoot, kill, rinse, repeat. Fly, bomb, land, repeat. Look for items, talk to people, fight monsters, save game, repeat. *sigh*

I'll stop my rambling, now. My head hurts. Damned cheap Aldi beer.

I'm glad to see this too.

[YesIAmAScript]

I bought a CD from Amazon that was protected 2 or 3 years ago (it was imported from Germany, US didn't have protected discs yet). Amazon didn't say it was protected. When I got it, I saw it was protected, so I didn't open it, I returned it. Then I went to Amazon and posted a review that said don't buy this, it is protected, you can't use it with your iPod (not that that meant that much back them). Amazon deleted my review!

I'm glad to see Amazon now not only allows these reviews, but marks the CDs as protected at the top. I will not buy protected CDs.

Really, it's important we not buy protected CDs from retailers. And return each one we buy by accident, even if you think you can beat the protection. Our only hope to stop the sale of protected CDs is if retailers stop stocking them because they don't make them any money.

SO DON'T BUY PROTECTED CDs!

Re:I'm glad to see this too.

[Tadu]

I'm glad to see Amazon now not only allows these reviews, but marks the CDs as protected at the top. I will not buy protected CDs.

This is wrong. I bought those CD-ROMs
http://www.amazon.de/exec/obidos/ASIN/B000069L0Z
http://www.amazon.de/exec/obidos/ASIN/B00007M8LY
and as you can see it is still not marked playing disabled and there is no review either.

On top of that, there is no human intelligence in their faked-no-reply-possible-email-answered web support. They apologized that I couldn't play the CD-ROMs on my device (if I had tried, they wouldn't have taken them back), and went so far as to suggest that if I want to complain about the lack of those CD-ROMs beeing CD-ROMs and no AudioCDs, I should use the "correct error" link at the bottom which cannot be used to report those kinds of errors...

Copiable?

[mattr]

This seems to be the copy protection mentioned here where they say Sony BMG will email you instructions on how to defeat the protection if you complain. Also in a comment on that page:

I wrote BMG and asked for the instructions, here's what they said: To get around the DRM you have to install their software so you can access the pre-ripped WMA files they've "generously" provided on the disc. Then you hafta burn the WMA files to yet another CD in order to re-rip them into iTunes.

TFA says drm software required for playing, someone else suggests it can be played through iTunes.

Is this CD playable without the drm software after using cdparanoia or some other tool? SonyBMG is now added to my list of labels not to buy due to copy protection, which previously included ToshibaEMI and Avex Trax for their (cdparanoia breakable) copy protection. In fact I don't buy CDs any more, I just keep a copy of cdparanoia around because sometimes people give me CDs as presents and often they seem to have some kind of copy garbling, erm protection.

Corporations are above the law

[Anonymous Coward]

...well, they act like it anyway. A blatantly malicious and illegal act like this is sure to get some 16 year old in Finland locked up, but a megacorp like Sony will face little, if any, repercussions. To me, this is just another wakeup call that big corporations can and do break the law and ethical boundaries all the time, and that they have no respect for Anything if it is not financially convenient for them.

Microsoft's reaction to this?

[alouts]

Isn't this something that Microsoft should have issues with? Sony isn't just installing its own software, they're overwriting part of the operating system, and in a sloppy manner such that it will prevent Microsoft from releasing patches to those drivers/services...

Although I'm sure they'd be noncommital in their official response, I'd love to hear what they think internally about this kind of thing. If "security" really is their #1 corporate focus as they've been so eager to tell us, this should have them screaming at the top of their lungs.

The chances of us slackers motivating our corporate-owned legislators to smack Sony is comically low, but if we could get a second big player in there on our behalf, there's a real chance to get this awful idea blackholed like it should be.

Anyone have any high-up connections within the Empire?

Re:Microsoft's reaction to this?

[Master of Transhuman]

Microsoft will probably license the technology from the company that developed it.

Oh, wait, no, Microsoft will APPEAR to license the technology from the company that developed it, then either buy them out or drive them into bankruptcy - then install the technology in Vista as a new "feature" for their Big Media clients.

Sony will then sue Microsoft for stealing "their" patented technology.

Then Microsoft will pay Sony $5 billion to settle the lawsuit.

Then the President of Sony and Gates will give a press conference and smile a lot about how they love each other (never mind about PS vs XBox.)

Sound familiar?

Meanwhile, no one will ever be able to play CDs or DVDs ever again - as long as they want a functioning computer.

All rock bands not doing direct broadcast over the Net of their concerts will go out of business, followed by the record labels.

The RIAA and several Senators (known to be on the payroll of the Russian-Israeli Mafia) will blame all this on P2P systems.

P2P systems will become illegal, and everybody having one installed on their PC will be sent to Guantanamo.

Re:Microsoft's reaction to this?

[Anonymous Coward]

Microsoft has removed the ability for applications to install system level hooks in Vista.

Re:Microsoft's reaction to this?

[Anonymous Coward]

correction you mean they CLAIM to have removed this option about the only thing they can remove is monet from dumbass wallets on legs ..

Not anon coward just cant be doing with all this logging in crap

Pete Nikolic

Re:Microsoft's reaction to this?

[Anonymous Coward]

Microsoft should sue - big time.

If I read this correctly, putting this CD into my Fedora system would cause no harm. It should even play, and may be rippable.

If word of such things gets out, that could cause serious harm to Microsoft's business. If this sort of thing happens, users are very likely to investigate alternative OS's.

Gee - Sony and Microsoft destroying each other. If the battle ground was other than innocent users' PC's it would be fun to watch.

Re:Microsoft's reaction to this?

[Anonymous Coward]

"The chances of us slackers motivating our corporate-owned legislators to smack Sony is comically low, but if we could get a second big player in there on our behalf, there's a real chance to get this awful idea blackholed like it should be." it's not that we're too lazy. i'm sure the most passionate of us, are also poor from all the music we buy. and that music we buy is based on all the music we download. CAN we even go after a company as we are without taking a deguasing magnet to all of our non-legit music we can't afford to buy (or find)?

Windows Vista finally stops this crap

[Anonymous Coward]

When you insert a CD under Windows Vista, it asks you what you want to do. It does not automatically run the autorun program unless the user asks for it. So you can get around this under Windows Vista by simply saying no, you don't want to run the autorun program. Then the disk can be played and ripped any way you please.

I was forced to post this as Anonymous Coward because I am currently under investigation by the FBI for alleged DMCA violations.

Re:Windows Vista finally stops this crap

[assassinator42]

You sure? I know Windows XP asks you what to do if there's no autoplay file on the disc. Do you know if it will ask you if you want to autoplay in the final version of Vista? Or is this just experience from a beta? And what happens when you double click on the cd icon?

I had a similar experience at work recently

[erroneus]

I forget who the artist or publisher of the CD in question was, but the software that auto-ran on the user's workstation installed software (after the user clicked 'yes' of course) immediately started to attack (attempt to modify) SAV10. (Symantec Antivirus) I was then called by the user who claimed he was getting rapid-fire popups from the antivirus software. When I arrived, several hundred messages had come from SAV and I just kinda laughed when I saw it. I asked to borrow the CD for study. I found that the CD was fairly easy to duplicate under Linux... but I was also able to duplicate it under Windows using Nero wile preventing the autorun from starting. (The autorun program disliked Nero a great deal and wouldn't run with Nero installed on the machine!)

It is getting rather ridiculous these days and there needs to be some clear-cut definitions on what the device-owner has the right to do with his own equipment without any consideration for media or content providers. Essentially, we need the consumer's bill of rights to declare unlawful any attempt to prevent a user from being able to do whatever he wants with stuff he owns. It should be illegal for a content or media provider to attempt to prevent me from doing what they might presume is illegal or otherwise undesireable to the provider. It is overstepping their bounds to attempt to control the consumer. It is an act against the free-market philosophy and should be ruled against. Such a bill of rights, if created and made law, should first be applied against DVD region-coding and Macrovision. ...rant ad infinitum...

Re:Large companies have no idea

[Anonymous Coward]

Large companies have no idea what they are buying most of the time. If you could see the worthless junk shitpile of software I have to use at work, you would understand.

I *write* software, that's my job. But for source code management I have to use someone else's off-the-shelf shitpile. Why?

Someone in management went window-shopping on a software list, and found a package that claimed to do a bunch of wonderful things, someone else demonstrated it, and it seemed friendly enough. Management bought it because of *feature* list, not usability. They don't care how it works, or how well it works. Only that it meets their needs.

I thought I was jaded until I saw the company's CRM software - that shitpile makes my shitpile look like a bucket of fucking roses. Again, feature list won, probably without ever having been used. Certainly the people making decisions don't use the software every day or they would go absofuckinglutely mad.

Sony paid someone money for a package because it had a bunch of features. Not because they wanted a rootkit.

Someone in Sony is shitting out a cervix right now.

(note: I'm not defending Sony, you can bet the next 100 things I buy don't come from Sony electronics or Sony entertainment or Sony auto maker or whatever else they make)

Do make the switch..you will not regret it!

[Anonymous Coward]

When you do make the switch to linux you will find that Kaudiocreator works great. The latest K3B burns DVDs, cds, etc, and handles iso 9660 like a rocket. I suggest after you get used to ./configure, the make utilities, unix commands and file systems etc, switch to Slackware. I have found that Slackware is better all around for compiling from source and is, if not easier, then better for setting up multimedia and is certainly more reliable.

The Slackware installer using Xorg does a better job configuring X than any other distro I have tried, including the Debian varients. There are some things that you should learn like setting user permissions in fstab for your cdrom, floppy and other devices like other file systems. It is also good to learn how to edit the most important config files. But given some Linux experience these things are actually easy and one hell of a lot easier and more reliable than changing system preferences, user and file permissions in windows! Afterall Linux was built to set up file and user permission in the first place not as a security afterthought.

You will also find that OGG is an excellent codec for audio, (but you can still install any codec you chose). Debian varients like Mepis are a good way to start but you can do alot more in Slackware and it is alot closer to what a Linux OS should be, easily user configureable, as secure (as you make it), well documented and lightning fast.

Not worring about Microsoft security and DRM crap is worth the effort it takes to learn Linux. It pisses me off to no end, (as I am a musician myself) to have these assholes assume that I will steal their stuff. I paid for the friggin' disk go after the companies that pirate music and software and then sell it illegally. Sony and Microsoft can go for a flying phuck! They will get no more business from me and my family.

Re:Do make the switch..you will not regret it!

[Anonymous Coward]

If when you said OGG you meant Vorbis I strongly disagree. In terms of audio quality, FLAC is the best audio codec since you won't lose any quality, though it only offers about 50% compression. You can then re-encode to Vorbis , MP3, or AAC for whatever portable music player you use. Rewritable DVD media and hard drive space is cheap so why not use FLAC as your primary audio codec?

this would be some great TV...

[foQ]

I wonder what would happen if somebody brought a small claims court case based on this...

[waves fingers in front of face Wayne's World style]

Judge Judy: So I understand that this man's company facak'ded up your computer? And it cost you 600 meshugena dollars to get it fixed?
Random Dude: Yes, your honor. I bought some lame ass CD that Sony price gouged me for (they have DJs to pay off you know) and when I put it into the CD drive on my Sony laptop, the drive stopped working and the computer didn't function properly. I went to my local Sony authorized dealer to have my computer serviced, but they weren't able to fix it. Since they said it was a software issue and not covered under the warranty, they charged me $200 (they have call centers to outsource you know). So then I was going to reload Windows XP, but my Sony laptop didn't come with the original CD (they have Politicians to bribe you know). So that set me back $400 for a new copy.
JJ: That is unconscionable. What is your side of the story?
Howard Stringer (CEO of Sony): He forgot to mention that we sued his kid brother for having music on the computer.
JJ: You, sir, are below slime. I find for the Plaintiff.

Or if it was on Texas Justice:
Larry Joe Doherty: Hey boy! I hear this guy cost you some mucho dinero 'cause of your computer or something?
[same as above, but with a different end]
LJD: Give that boy his $600! Now come sit in this chair and put this hat on!

The same scenario on Judge Joe Brown:
Joe Brown: I'm from the streets, but I've never heard of this scam. Tell me how it went down.
[yadda yadda from above]
[the judge sticks a shiv in the CEO and then hands the wallet to Random Dude]
JB: Case dismissed.

And on Night Court:
Harold T. Stone: $50 and time served...and Dan will fuck your wife and sister while Bull pulls out your arms and beats you with them.
[the judge disappears in a puff of smoke]

An interesting side note...

[cdn2k1]

Here is the developer, on a kernel mailing list, asking for help with getting his rootkit off the ground.

http://66.249.93.104/search?q=cache:hDmbqX5yahgJ:w ww.osronline.com/showThread.cfm

Is there a way that I can get the CDAUDIO filter driver example in the DDK to load and unload dynamically?

This is GREAT!

[thetaco82]

So you're telling me that if I prepend a file name with "$sys$" it will be nearly undetectable? Finally! An easy and effective way to hide my pr0n. I can't wait to buy this CD

FTC - File a complaint

[minerat]

https://rn.ftc.gov/dod/wsolcq$.startup?Z_ORG_CODE= PU01 Bring this whole debacle to the FTC's attention. Innundate them with requests so they'll be forced to take action.

If you want to install any software on Windows...

[Anonymous Coward]

you have to run as Administrator.

Details were already widely available in the press

[Anonymous Coward]

Googling for Mathew Gilliat-Smith, First 4 Internet's CEO, reveals many articles:

http://news.com.com/New+CD+copy-lock+technology+ne ars+market/2100-1027_3-5492395.html
http://www.pcworld.com/news/article/0,aid,121949,0 0.asp
http://www.it-enquirer.com/main/ite/more/digital_r ights_management/

They claim to the press that their software will not damage or criple computers. Oops. The PCWorld article pretty clearly explains the extent to which First 4 Internet's product controls the number of copies you make.

a good thing perhaps?

[Qnaal]

This is, of course, a very, horribly bad, wrong thing. But it is, like jack thompson, so obviusly bad that it makes similer, less bad efforts, look bad, and could therefore be a good thing in the long run. opinions?
Anyways, in the mean time, just don't buy drm'd cds.

How soon before Van Zant (the band) sues Sony?!

[JimMarch(equalccw)]

This crap is going to cripple their CD sales. The maliciousness of this is probably enough to get them out of their contract with Sony with *massive* damages. Nobody who hears about this will buy a Van Zant CD - this could very well kill off the band entirely because they'll be the band best known for a connection with this insanity, simply because Mark Russinovich happened to be a fan!

The business view...

[phorm]

I'd say that this little rootkit might just f*ck it for anyone who listens to music at work. I remember laughing at a friend because his mom made him virus-scan all his CD's before putting them in the computer, because I big corp wouldn't bundle a virus, right?

So what happens when it gets out that music CD's will install a backdoor into you system. You will *not* be allowed to listen to you CD's at work.

On the bright side though, I'm hoping that a big corporation gets infected with Sony's little backdoor and then has them for lunch in court. There is no consent given to install the software, and installing a rootkit on a music CD is for all intents and purposes no more legal than sticking a spycam in with a light-fixture or something similar...

Re:The business view...

[pe1chl]

An IT department of a big corporation better doesn't allow office PC users to install software on their system.
With a well set-up office Windows system this kind of CD simply will not be able to perform its tricks.

So you....

[drgonzo59]

1) pretend you never read this story on Slashdot. 2) Ask someone you know from some 3rd world country to create a simple keylogger and prefix all executable with $sys$omgCo0LHackingPref1xS0nYIsL33t 3) Go to that someone's webpage and by chance your Internet Explorer 5 just happens to automatically install keylogger. 4) next day you find your computer ravaged by digital vandals from some far away country 5) you contact a good friend who just "knows a bit about computers" to help you and OMG!!! he finds that Sony Corp. (and throw in Microsoft there too for the full effect) aided those cyber fiends by opening the doors to your machine and so they contributed to the stealing and removal of priceless family photos, banking details etc etc. You tell the media how the cyber terrorists have been aided by SONY and how SONY is a threat to middle class suburbanville America. 6) sue Sony 6.5) ? [warning - obligatory South Park reference] 7) $sys$profit

Let's do our part...

[Rocketship Underpant]

I followed that link to Amazon's product page and "modded up" all the user comments that complained about the rootkit and DRM, so they will appear higher on the product page. I imagine both Sony and the artist will get the message if their high-profile page at Amazon.com is a big diatribe against them.

I encourage others to mod up such comments on the Amazon pages for this and any other playback-prevention CD they come across.

Well?

[buss_error]

As I've said many times in the past.... RIAA and MPAA members are evil. Quit buying their products. For those that can't quite wrap their mind around it, that means: 1. don't by music from RIAA artists. 2. Quit going to the movies. Simple.

knock, knock, knockin' on Darwin's door

[Hosiah]

Knocking on Darwin's door, screaming, "Take me! TAKE MEEEE!" That's what I'm reminded of when I see the people for whom corporations can do no wrong. No matter WHAT dastardly scheme the corporate evildoers hatch up as they twirl their mustaches and cackle with their henchmen, you can always find some round-shouldered wimp going, "Well, they were in their perfect legal right when they sodomized me, napalmed the village, and fed all those orphans to the crocodile pit."

SONY is WRONG to do this! Not law - shove the law! - they are MORALLY WRONG. Anybody who does anything on my hard drive for any reason and hides it from me is morally wrong. And thus am I ever justified in wiping it, cracking it, disabling it, or reverse-engineering it. It happened on my computer: therefore, it is entirely between me and whatever Deity I care to name what happens with it. And yes, Sony owes money to everybody they've done this to.

My God, don't people have any sense of basic human rights, anymore? Do you all want to be kept in dog kennels and fed dirt? Do you want ANY of the money you earn to go towards your personal enjoyment, or do you just work for the corporations for the priveledge of giving the tiny pittiance back to them? It's about time we brought back that term "MORALLY". Morals were here before laws, and they will be here long after the tinpot dictators who declared themselves God to make their stupid "laws" have crumbled to ashes and dust. And rightly so!

Wrong, DMCA does not apply

[snowwrestler]

If you do this, then you are deliberately disabling a copy protection system, which is illegal under the DMCA. So Sony can sue you.

Wrong. You are not disabling it, you are removing it.

The DMCA prohibits breaking digital encryption or protections that are in place to protect data from being freely accessed and distributed.

Software on your computer is neither encryption nor protection; it is a program. As long as you don't break or alter that program, you can add or remove it from your computer all you want. Adding or removing a program is not breaking it, as the capabilities the program provides are added or removed at the same time.

It's only when you alter the program, or design a new program that circumvents its protections to gain free access to the content that you tread on the DMCA.

My computer has a DVD player program that it shipped with. Do you really think it is a violation of the DMCA for me to remove this program from my computer?? Hint: it's not.

Not really....

[Otto]

Anything which uses technical means of copy protection is not a CD.

Not entirely true. While you're correct that this is "not a CD", it's not because it installs malware onto your computer. Previous copy protection schemes did that. Anything bypassed by disabling autorun or holding down the Shift key falls into that category.

But those *are* CD's. Why? Because Red Book isn't the only standard out there. Specifically, those can fall into the Blue Book standard, also known as "CD Extra" or "Enhanced CD". Basically it's normal Red Book audio on the first session, and a second data session that only computers see. What's on that data session is irrelevant to whether it's a CD or not.

Now, in the case of Sony's new licensed malware product, yes, the CD contains malware using rootkit like methodologies, however it is also know to contain a bad/malformed Table of Contents (TOC) in order to break ripping software even if you have prevented the software from installing. This can be bypassed with some software (like CDEx), and appearantly Mac's have no problem ignoring the bad TOC anyway, but this malformed TOC is what makes it "not a CD" in Philips eyes.

Nothing new to my opinion ...

[freaker_TuC]

enough said not?

This happened to me when inserting a friends original Beastie Boys CD in my PC to be ripped for my friend mp3 player; since he rips all his cd's here and uses his mp3 collection at home and at his work.

This was the biggest mistake of my life; I needed to reinstall fully; patches did not work anymore, my cd-rom didn't work anymore and I couldn't start my invoicing on my PC.

My complaint to BMG was never answered back; my post on the official beastie boy website was never answered back; so much for "customer satisfaction"...

I felt rather screwed by the ones that sell/sends corrupted audio cd's into this world...

*irony*

[bmgz]

It's a kinda ironic how nobody ever uses irony in the right context...

Re:*irony*

[RoffleTheWaffle]

I'm suddenly reminded of Futurama.

"How deliciously ironic!"

"That's not ironic! That's just mean!"

DMCA probably doesn't not apply

[Sloppy]

If you do this, then you are deliberately disabling a copy protection system, which is illegal under the DMCA.

"disabling a copy protection system" is just shorthand for what DMCA really says, and if you take it too literally, you can be misled.

There is no way that optional software, which only MS Windows users are even capable of installing, can possibly be a "technological measure that effectively limits access" to the CD, assuming that the CD can also be played in audio CD players, read with cdparanoia, etc. The "technological measure" is one that wouldn't even be encountered in many people's daily use of the product, whether they are attempting to "bypass" it or not.

OTOH, if it's really just a CD-ROM that only contains files which are only playable with Microsoft's player (i.e. it will not work in any redbook audio CD player), then maybe Sony has a DMCA case. But I haven't heard of anything like that existing on the market (yet).

Why does the OP gloss over Windows?

[Burz]

I don't like seeing these summaries and being left to think that my OS X and Linux systems could be compromised, then having to scour the linked article just to be sure.

This is becoming a common occurance on Slashdot: Articles about viruses and other Windows exploits are posted with no hint as to their platform-specific nature. "Systems" are attacked. Is it so difficult to write "Windows systems"?? And then of course, when vulnerabilities of non-MS stuff like Linux are reported, the platform in question is Big News. So on top of vagueness WRT Windows, I get bias. Its like reading the front page of ZDnet.

Please just mention the friggin platform, thank you.

Re:Why does the OP gloss over Windows?

[mrchaotica]

Well, you see, if they did that, then the sheeple might start to get the idea that there are alternatives to Windows that are actually better. And we can't have them thinking that, because otherwise how could we exploit them? (And by "we", I mean the entire software industry, entertainment industry, (possibly) US or foreign government, and crackers and phishers.)

Trespass

[Sloppy]

A person has a reasonable expectation of privacy and security on his or her home computer. Any attempt to circumvent this privacy or security should be construed as trespass. .. By removing the Sony-installed malware, Mark has broken the law. But so is trespass illegal, so tell me, which is a greater abomination?

Most people don't like it, but I have to fall into "blame the victim mode" here. What Sony did, was not trespass. It is 100% impossible for a passive piece of media (a CD) to trespass on a computer. The computer, working as the user's agent, actively loaded and executed code from the CD.

The user ran the malware; it didn't run itself.

What people need to understand, is that if you use Microsoft's desktop shell, then clicking on an icon is pretty much the same thing as downloading and executing software from someone's website. Don't do it!

A person does not have a reasonable expectation of privacy on their computer, if that person's habits are to routinely invite strangers to run software on their computer with no restrictions. Saying they have a reasonable expectation of privacy, is like saying a person who has unprotected anal sex with three strangers per day, has a reasonable expectation of not getting AIDS.

What you do, matters! I think it is very inaccurate to call what Sony did "trespass," and it only encourages users to continue irresponsible behavior.

Re:Trespass

[Invidious]

Unfortunately, you're wrong.

It is indeed possible for a passive piece of software to commit tresspass. By not informing the user of the full range of capabilities of the program, particularly those that the user would not expect from the nature of the software, you're running a trojan, not a legitimate piece of software. (Don't give me crap about how a user should 'expect' to be screwed in this circumstance; it doesn't work that way.) A rootkit like this essentially is akin to a person asking you over to their house for a while, and, while they're there, they take your keys and make copies. Then you tell them you want them to leave and never come by again, but they don't give you back the keys -- or tell you that they were made. This is certainly conspiracy to commit tresspass. Oh, and furthermore, if you try and change your locks, the plumbing in your house stops working. Whoops!

Sthe program be so poorly designed (or maliciously designed) as to interfere with the functioning of the computer, -particularly- when the user decides to (quite legally) cease to be bound by the licensing agreement (by removing the software necessary to access the content,) then you're committing a crime against chattel -- essentially a kind of vandalism.

IANAL

Re:Trespass

[ultranova]

Most people don't like it, but I have to fall into "blame the victim mode" here. What Sony did, was not trespass. It is 100% impossible for a passive piece of media (a CD) to trespass on a computer. The computer, working as the user's agent, actively loaded and executed code from the CD.

Most people don't like it, but I have to fall into "blame the victim mode" here. What the guy who just shot your brains to the wall did wasn't a murder. It is 100% impossible for a few grams of lead to kill you. The molecules of your own head, working as parts of you, actively moved away from the lead atoms.

Re:Trespass

[Johnny5000]

Most people don't like it, but I have to fall into "blame the victim mode" here. What Sony did, was not trespass. It is 100% impossible for a passive piece of media (a CD) to trespass on a computer. The computer, working as the user's agent, actively loaded and executed code from the CD.

So that explains why it's perfectly legal and justified to trick someone into loading a virus onto their computer, because if they're too stupid to know not to run it, they deserve what they get?

What we're talking about here essentially boils down to a Trojan horse program. No one expects the CD to install a rootkit when they put the CD into their computer.

Do you think the creators of a massively destructive virus would get let off the hook because they displayed a EULA that says "Whatever happens to your computer is not our fault" without mentioning the specific threat they intentionally created?

Re:Trespass

[Sloppy]

What the guy who just shot your brains to the wall did wasn't a murder.

But your analogy, intended to stretch my point to absurdity, is actually correct, except for what you left out. You failed to mention that the guy who pulled the trigger (chose to execute the foreign code) is the same person who got their brains blown out (bore the consequences of executing foreign code). It really wasn't murder, it was suicide.

You also failed to mention that gun was actually labelled "may cause harm to target" (the CD was explicitly said to have hostile intent against its users, therefore whatever foreign code it contained, could be assumed to do something bad). It wasn't accidental suicide, it was either deliberate, or at best, due to extreme recklessness/carelessness (e.g. someone pointed a gun at their own head and pulled the trigger, thinking it wasn't loaded -- oops).

When it comes to deliberate suicide, hell yes I blame the "victim."

Re:Trespass

[ultranova]

But your analogy, intended to stretch my point to absurdity, is actually correct, except for what you left out. You failed to mention that the guy who pulled the trigger (chose to execute the foreign code) is the same person who got their brains blown out (bore the consequences of executing foreign code). It really wasn't murder, it was suicide.

To continue these analogies, you didn't know it was a gun. It looked like a CD, but in reality blew up when you tried to play it, and propelled a piece of plastic through your head. But the CD case contained a warning that that would happen, hidden in a long text and worded very vaguely, so obviously it's your own fault for not realizing that you must be on your guard against explosive CDs.

You also failed to mention that gun was actually labelled "may cause harm to target" (the CD was explicitly said to have hostile intent against its users, therefore whatever foreign code it contained, could be assumed to do something bad).

Because it is perfectly reasonable to expect that when one buys a CD, the first thing one does is search any warnings that the CD might install malware when played. Is that really reasonable ?

DRM *always* implies compromised security

[Sloppy]

There's a slight difference between a copy restricted CD and an "install a rootkit on your computer" CD, though...

No, there isn't. You're so close to enlightenment.. can you taste it?

There is no possible way to implement DRM, other than to compromise the computer and make it behave in a way that is contrary to the interests of its owner.

If the computer has only one master (the owner), then DRM is impossible. What Sony has done, is persuade their media customers to give their computers to Sony, in exchange for music. IMHO, that's a bad trade, but what can I say, sometimes I don't understand other people's decisions.

This is excellent news!

[Tim C]

I was considering buying a console, and had been somewhat torn between an XBox360 or a PS3. Thanks for making my choice for me, Sony!

Re:This is excellent news!

[Adnans]

So you choose the Master who made all this evil possible? Excellent choice!

-adnans

"doesn't not"

[Sloppy]

Yeah, yeah. Ok, everybody, go ahead and don't not have a little laugh at my expense.

_WHAT_ EULA?!?!

[mrchaotica]

It's SUPPOSED to be a fucking AUDIO CD!!

Re:_WHAT_ EULA?!?!

[Pope]

Couldn't agree more; however, the Amazon page lists right after the title "[CONTENT/COPY-PROTECTED CD]", or if you buy in the store, there will be a Copy Protected sticker/warning on it as well. Someone technologically informed, like the blog writer in question, should friggin' well know to have Autorun disabled on any Windows system he runs. The general public would not necessarily have that knowledge, but they should damn well be made aware of it.

EMI Group DRM

[RonMcMahon]

After reading the article, the controls / restrictions on recording and playback sound very similar to the restrictions on my recently purchased ColdPlay X&Y CD and my Paul McCartney (Chaos and Creation in the Backyard) CD. I've not tried to play these CDs on my PC, nor have I tried to rip them to MP3 yet... I wonder if anyone would know if these EMI discs use the same *cough* wonderful DRM *cough* scheme as the Sony Disc from the article?

My CD collection exceeds 1000 titles - I've no need to steal ANY music...but I'd be happy to pay a $1.00 'tax' per future CD purchases to cover the loss of revenue from people who steal music - IF that will eliminate all this DRM crap. (hopeless dreamer, I know)

Write to Van Zant Bro

[Anonymous Coward]

It will go through their managment of course which means the artists themselves may never know.
Management:
Vector Management
Ken Levitan and Ross Schilling
P.O. Box 120479
Nashville, TN 37212
Phone: 615-269-6600
Fax: 615-269-6002

Looks like lots of people blogging about it now.

[Anonymous Coward]

Lots of people are already blogging about this - some referring to slashdot, some to the actual article. Looks like this may be the next 5 day wonder - but will something make people change things??????

http://www.chatvenue.com/thoughts/2005/11/01/drm-a s-malware/

http://blog.wfmu.org/freeform/2005/11/sony_cds_cau ght.html

http://www.cubicgarden.com/blojsom/blog/cubicgarde n/culture/2005/10/31/Make-no-mistake-the-new-battl e-lines-have-been-drawn-rootkits-and-all.html

And many more!

DRM Yea well

[Anonymous Coward]

Sems like it's time to completely STOP purchasing Sony provided / inspired products ok so it will mean missing out on some nice bits ect but if people dont act and act soon companies like Sony and the USA will get to thinking they own the world when they are only tiny bit players at most .

Not anon coward just cant be having all this logging in crap all the time

Pete Nikolic

Ugh.

[StarKruzr]

I'm a HUGE Idlewild fan - I paid upwards of 26 American dollars for an Idlewild t-shirt to have it shipped here from the UK. Your bit of news is extremely saddening to me.

Naturally, it's their label and not their fault, but still...

Speaking of "criminal offenses..."

[mrchaotica]

...you can report Sony's illegal acts here!

RIAA ARE SHITBRAINED RETARDS, THE END.

[Anonymous Coward]

I stopped buying music over a year ago. RIAA members are fucktards with zero morals, and this simply proves it. This is the solid nail in the coffin. I will NEVER, EVER buy another product from an RIAA member again. Not before, during or after hell freezes over and Satan's gonads break away.

RIAA execs should be sterilzed and sent to a desert island to rot to preserve the integrity of the gene pool.

I think it's possible...

[failrate]

I think it's possible that Our Lady Peace just suck so hard that the kid's computer had some kind of stroke.

thank you!

[Anonymous Coward]

thank your for the insightfull article.
i as just wondering if it is possible for
this "rootkit" to be installed even if you
don't open the official CD as administrator.
i hope not and i hope vista won't allow it
either, but i think ms will be going the
other way. it prolly makes sense to have a
OS not allowing administrator delete registry
keys, though i can't see why. maybe vista will
have some more "local system extras" for DRM
companies ... i downloaded that pstools
instantly, 'cause there's nothin on my paid
XP pro that allows me to get rid of those
"cd filter" reg. entries ...

just to play devil's advocate here for a sec...

[smash]

Whilst I don't like what sony has done here in the slightest, those calling for them to be sued, etc are missing a cruicial (IMHO) piece of information.

I am under *NO DOUBT* whatsoever that Sony will simply point the finger at first4internet, and simply say "We simply contracted them to provide a content protection scheme - we are unaware of the implementation" (or words to that effect). Given that the tech has been sold to several other record companies, I'm pretty sure that's close to the mark as to what actually happened, too.

So, it's first4internet who will take the heat in a criminal case, not Sony, no doubt.

Sony is evil and all, but I don't think it was Sony who was responsible for the way it works...

smash.

Re:just to play devil's advocate here for a sec...

[pe1chl]

Maybe in your country, but not here...
Merely buying some technology from another company does not mean you are no longer responsible for your product.

Re:just to play devil's advocate here for a sec...

[TheHawke]

The key word here is CONSPIRACY. Sony contracted this bunch to create the DRM package. SO this means that both Sony and first4internet are conspirators in a crime and both knowingly and willingly agreed to proceed on this route.

Odds are that Sony will sell out and finger first4internet on this so the little guy will get the hammer, but this little guy should have known better than to take on a job like this.

My gawd the Attorney General will have a field day with this.

Re:just to play devil's advocate here for a sec...

[swordgeek]

Sony can point fingers all they want. Who signed the contract? What were the terms? If what first4internet did is (a) within the terms of the contract they entered with Sony, and (b) subject to prosecution, then Sony will be on the hook as well--as they should be.

You can't hire a hitman and say "well I didn't know how he was going to stop the guy!"

Ideal Bittorrent client

[andrewla]

It would be sweet if that file "$sys$bittorrent_client.exe" was under the radar and sharing the same music that it was suppost to be protecting. Sony would have a SERIOUS beef with... themself. Infected people might not care less.

You know you're running Windows...

[Anti-Trend]

...When an audio CD roots your box. Never fear though, Vista comes pre-rooted with DRM goodness!

Most malware is actively run by users

[Arru]

Most people don't like it, but I have to fall into "blame the victim mode" here. What Sony did, was not trespass. It is 100% impossible for a passive piece of media (a CD) to trespass on a computer. The computer, working as the user's agent, actively loaded and executed code from the CD.

You know this means that toolbar and mail attachment malware isn't malware either? They are run by the user by double-clicking attachments or visiting a web page (inserting a CD).

Re:Most malware is actively run by users

[Sloppy]

You know this means that toolbar and mail attachment malware isn't malware either?

I'm not saying it isn't malware. I'm saying that that the malware doesn't just run itself. It is always run by the user telling his computer, "please run this untrusted code without a sandbox, giving it full access to not only my personal files, but also give it write access to the very operating system itself."

They are run by the user by double-clicking attachments or visiting a web page (inserting a CD).

No, opening an email attachment, visiting a web page, or inserting removable media, doesn't normally have the slightest potential for running any foreign code. What you are describing are simply bugs in a tiny handful of applications (mainly [Internet] Explorer and Outlook). If going to a web page can execute malware, your problem isn't with that particular piece malware or the people who wrote it. Your problem is with the web browser.

All we have to do, is track down what company or companies wrote this "Explorer" and "Outlook" program, and stop using their dangerous products. Who knows, it might be someone who already has a reputation for writing software that is extremely dangerous for non-expert users. But I'm just speculating on that. ;-)

Re:Most malware is actively run by users

[Arru]

All we have to do, is track down what company or companies wrote this "Explorer" and "Outlook" program, and stop using their dangerous products. Who knows, it might be someone who already has a reputation for writing software that is extremely dangerous for non-expert users. But I'm just speculating on that. ;-)

I agree, I just wish Joe WinUser would realize this too :-)

No, it's not DRM or a rootkit

[GoatSucker]

This is NGTCB. The submitted obviously hasn't been keeping up with Newspeak. Don't worry, I've already reported them to Minitrue.

So much for that...

[Anonymous Coward]

Sony ditches DRM CDs

That's funny...

About CD and prevention

[Anonymous Coward]

Dont ever under any conditions buy a CD from an artist that has signed with Sony!

Now if you happen to use Microsoft Windows and happen to have a one of these CD's by Sony and want to use then I think maybe it would work to disable the autoload-feature in Windows that autoload and runs autorun.info on the CD's when they inserted to the drive.

You can prevent autorun.inf from being run if you hold down your CTRL button while you put your CD into the computer.

Not on Amazon UK

[Martin Spamer]

There is no warning on the Amazon UK site for this CD.

Any rootkit would be clear violation of sections 2 and 3 of the Computer Missuse Act. This Act comes from EU treaty obligations so substantially similar legislation exists throughout Europe. The territorial scope of this Act only requires one of the parties to the offense to be in the UK. So buying this from Amazon UK should cover you even if you dont live in the UK.

yes!

[oPless]

Here in the UK they (sony's execs) should be able to get jailed for this under the Computer Misuse Act, hell didn't we just jail/convict some poor guy for accessing a website with ../../.. (cos he wanted to check that the site/cause he just donated to hadn't been compromised)

Oh wait, induhviduals get jailed, corporations get fined a miniscule fraction of their revenue.

Silly me.

Not really (redux)...

[msauve]

"it's normal Red Book audio on the first session, and a second data session that only computers see.... it is also know to contain a bad/malformed Table of Contents...this malformed TOC is what makes it "not a CD" in Philips eyes."

You seem confused - which is it? A CD or not?

If the TOC isn't valid, it doesn't meet the spec, and isn't a CD. If it meets the CD specs, then a PC won't have any problem reading it without the software.

Re:Not really (redux)...

[Otto]

There's no confusion.

My point was that it's not a CD, but this is not because it "uses technical means of copy protection" but because it falls outside the spec.

A normal Blue Book CD with software on the data session that prevents ripping would be a CD and would also be using "technical means of copy protection".

Why not stop buying all DRM CDs?

[PdeOliveira]

I think the answer to this outrageous abuse is simple: stop buying all DRM CDs, beginning with Van Zant's "Get Right with the Man". If the artist feels he is being harmed by Sony's use of DRM, they will force the use of standard CDs. [ ]s, Pedro RJ/Brazil

Re: Sony's Trespass

[bit01]

I think it is very inaccurate to call what Sony did "trespass,"

No, the person clicking on the icon has a reasonable expectation that all they're doing is playing music, not triggering the deliberate compromise of the basic integrity of their system with a root kit.

Of course the marketing parasites will try to wriggle out of admitting this with the usual marketing spin and lies.

---

Marketing talk is not just cheap, it has negative value. Free speech can be compromised just as much by too much noise as too little signal.

It makes me so mad...

[Ashley J. Williams]

...I have nothing of value to add to the conversation, but I want to share how mad this makes me! Grrr! I'm steaming!

Re:My question: Electricity Consumption

[Anonymous Coward]

It adds about 2% CPU as it idles. Multiply by 200 million - phew, thats a lot of energy/oil imports in hard currency. Now that 2% is more is said computer does not go into sleep mode. Sony promotes greenhouse gasses.

Then we have laptop battery life down 2%, and the battery pack is also depreciated faster, and the hard disk power will add up too.

Scandalous inefficiency, and recklessness. The soultion, consumer recall and damages. It is costing its victims money.

F-secure's page about the rootkit

[TuomasK]

F-secure's page about the XCP DRM Software: http://europe.f-secure.com/v-descs/xcp_drm.shtml

Added value?

[winchester]

Once again, we see a total lack of understanding on the side of content creators. Instead of providing us with added value, the provide us with hard to remove malware that will cost us, honest customers who bought an actual cd, cpu and memory resources, not to mention possible back doors into our home computers.

In a world where a computer more and more becomes a tool for content creation and is used more and more as a media hub, unfortunately most of the time based on an operating system known for its insecure architecture, this is a very worrying trend.

We see the same thing happening with content creation software. Dongles, challenge-response systems, it is made harder and harder for legitimate users to use the software, while the odd cracker is very capable of evading whatever copy protection or DRM scheme might exist in the software.

Now I am a firm believer that it is quite okay to pay for quality. I am also a firm believer that I should (and I do) pay for the software I use for my content creation (photoshop for my digital darkroom needs, pro tools for my music making needs). But why the hell should I, as a legitimate customer, pay for insane copy protection mechanisms? They do not add value for me, instead they take value away, in terms of storage, CPU cycles and memory.

Three Words: Class Action Lawsuit

[indytx]

This is crazy, and some interprising IP lawyer who's tired of doing billable hour work is going to be all over this.

Re: I will not pay to be f****d!

[buanzo]

At least, not by sony!

Now really, who wants to buy a cd that will render your system unusable, and your privacy invisible?

Not me.

Thank god I do not use windows or drm-based hardware :)

there my friends you have

[suezz]

exhibit one for the GPL - this is why linux has not penetrated the desktop. because of vendors, companies pulling crap like this.

man - I am so glad I do not have windows in my life. Just because of this crap.

the riaa and mpaa are going to go broke if they continue to do this crap - the sheeple will follow only so long and then revolt.

so knock it off you knuckle heads. you are telling people are guilty that are legititmately buying your product of stealing.

how insulting is that?

New from Sony...

[Anonymous Coward]

My First RootKit!

Re:If you want to install any software on Windows

[wheany]

So run the setup as Administrator. Either right-click on the icon and select "Run as..." or use the command line and use the command "runas."

Re:Alternative OS users

[ladybugfi]

F-secure's BlackLight detects it, although they advise against using the removal tools to get rid of it - it might disable the access to that drive letter. http://www.f-secure.com/weblog/

Dont employ these criminals

[Anonymous Coward]

Just for the permanant public record, Tony Miles, Ceri Coburn, Peter Worrall,
Nick Drew and Mathew Gilliat-Smith are the criminals behind this outrage.
Under no circumstances should you employ these blackhat computer criminals.

Family Tech Support Just Got A Whole Lot Worse

[ObsessiveMathsFreak]

OK. So I, and many other Slashdotters, are usually roped into tech support for family and friends. Just why I thought I was getting some way on top of things with SP2, firefox and AV, this comes along.

So after all my hard work, my little cousins just go out, buy one Sony CD and WHAM! All my efforts gone to pot as the worlds biggest backdoor is slapped straight onto the system. It's not like you can tell teenagers NOT to buy CDs. And really I shouldn't have to.

Gods what if they put this stuff on the CDs the Adults buy!? .....

It's going to be a llllooonnng christmas season.....

My Sony rootkit won't work

[Lost Penguin]

It's not Linux compatable; sigh....

Cumulative Effect Question

[zogger]

Would this result in multiple instances of the DRM rootkit beng installed if multiple CDs with the same software were run by the user? Or after the first one would it just see it is already there? Just wondering if eventually, if it is cumulative, if the machine would just bog down into 100% CPU usage and become non functional.

Register has picked up the story

[VENONA]

See:
Removing Sony's CD 'rootkit' kills Windows
http://www.theregister.co.uk/2005/11/01/sony_rootk it_drm/

The lean toward calling it exceptionaly bad DRM, rather than a rootkit. Fair enough. It doesn't contain anything that maintains a cracker's ability to reenter a system, which is part of most people's definition of a rootkit.

But its good to see that they've picked up. Other media outlets often seem to follow what's seen on el Reg.

More serious than that

[CarpetShark]

It's a bit more serious than how your computer might get screwed up if you try to undo this. If a staff member innocently tries to play music in their bank, and this introduces security holes that could be used to hack into the bank's systems, then the legal implications are probably quite staggering.

You're missing the point [late post mod up]

[gerf]

Now, after I run Adaware, Spybot, CWS Shredder, Panda Activescan, AVG, and other spyware/AV/ect products on someone's computer, I'm going to have to ask them one more question.

Have you bought any music CDs lately?

And when I tell them that buying legal music and playing it on their computer can slow it down... People are going to be completely upset and thinking "WTF."

XCP-1 and XCP-2, by Fast4Internet

[Zellis]

Here's an article mentioning the XCP technology written from a shamelessly pro-DRM point of view. Very little technical detail given (unsurprising given it's a puff piece), but still interesting to see what's currently being done (the XCP-1 watermarking technology) and what business would like to see done (RFID-tagged CDs and players which only play CDs that are correctly tagged).

You really want to fight? Here's how!

[Just Some Guy]

I think this is the way to fight DRM.

No. If you really want to fight clearly illegal activities like this, then sue Sony in small claims court and name the store you bought the CD from as a co-defendant.

Sony probably won't care if they lose a customer or two. They will definitely care if they lose a few retailers because of the fear of exposure to litigation.

We're always complaining about how broken our legal system is, right? Well, maybe their tactics work in both directions. Remember, the GPL is a clever hack on copyright law. Perhaps we need to start hacking other legal constructs as well.

Why isn't criminal action being taken?

[hkb]

1.) It's a rootkit
2.) It deliberately hides itself from the customer
3.) They deliberately deceive the customer by hiding certain processes with names such as "Plug And Play Device Manager".

Why aren't people going to jail/being heavily fined for this? Wtf?

Re:Why isn't criminal action being taken?

[Anonymous Coward]

Not only that, the actual software will damage the Windows operating system. The software will:

1) install itself without permission.

2) temper with Windows' system files containing the API, case certain system calls to behave unexpectedly; may case any program to crash, including parts of Windows itself.

3) temper with Windows' drivers for CD/DVD drives; cause CD and DVD writers to permanently fail.

4) prevent repair of the damaged system files.

5) prevent certain software updates from Microsoft, including critical security updates.

6) Allow processes and files to hide on your computer.

7) Run stuff...

This is PROPERTY DAMAGE WITH INTENT. It is a criminal offence.

Re:Meh

[Anonymous Coward]

Can't say I agree that windows _users_ are ignorant...

But what kind of system allows this shit to take place in the first place? Seriously!

What does it do when it finds pirated software???

[randyflood]

OK, so it has this service that sits around eating up all your CPU monitoring all your running programs, checking their names and file sizes and looking for something... What is it looking for? Illegally copied software perhaps? What is it going to do when it finds it? If that is not what it is looking for, then what is the point of collecting all that information? Where is that information logged? In the oct.sys file perhaps (since it seems to be growing in size in the two pictures in the article and have an updated time stamp)And if it is not going to use it for the purpose of reporting "pirated" software, then is it just logging it locally somewhere so that if you had a lot of copyright infringement going on then they would have some kind of log of your activities? Or, is there also a way for them to trigger a report somehow?

This can be prevented...

[Jason_R0]

Using the right software on Windows, you can prevent unwanted registry modification. In this case my own software called RegDefend ( Free version available ) would have alerted you to Sony trying to install the driver in the registry, and also if the user has set it up, to be alerted if the cdrom filters changed at all.

This doesn't change the fact that the Sony software might not "work" without the "rootkit" it wanted to apply to the system, but at least you would have known about it with something like RegDefend installed. In this particular case, Mark would have known that the CD software was installing a driver and wouldn't have needed to check with a rootkit detector several days/weeks after it was installed. Installing linux and hoping it isn't targetted in the future by companies/malware is basically security through obscurity which nearly always involves the most cleanup if something bad happens.

Re:This can be prevented...

[Anonymous Coward]

Nice one, an industrial strength bandaid that is better than the alternative of just being infected

The comment about linux is hardly insightful and shows a strong windows background, but is probably true for people that don't understand linux (or unix in all its variants)

Re:This can be prevented...

[Jason_R0]

If by "industrial strength" you are implying it is resource heavy, you are mistaken. Unlike a lot of other security developers, I *use* my software everyday and the ultimate aim and focus is to make sure I cannot notice the impact my software has on the system.

I like Linux and some of my systems are running it 24/7, I was only replying to comments about "turning to linux" for security, when this same thing (rootkitting) occurs there too. It just isn't quite as prolific. Regardless of OS, you are vulnerable to being "tricked" into installing software. In this particular case, Mark thought he was just installing software to play/burn his music CD, but it installed other items aswell.

It doesn't matter if you are running on Linux or Windows, if a "privileged" application is being installed and there is no "are you sure you want this" with regards to important system events, then you are vulnerable to being attacked in this manner. In the current situation, if you *WANTED* to play this particular CD on your system, and it needed to be installed from an ADMIN/ROOT account then you are stuck in the position of either NOT installing it at all, or allowing it to do ANYTHING it wants in admin/root. RegDefend bridges this particular gap on Windows, without slowing your system. :)

Re:This can be prevented...

[Anonymous Coward]

I used industrial strength because your software has been implemented as kernel hooks rather than usermode hooking. As anyone with more than a passing familiarity with windows security knows it isn't that hard to remove usermode hooks. In spite of this quite a few products still do it and don't like being taken to task about it, quite a few of them use a 3rd party library to do it for them.

In the same way Mark given his obvious skill levels was very remiss when performing day to day activities as an Administrator under windows (as was observed earlier)

Most developers make the mistake of logging in and running as Administrators during their development cycles and this often leads to software that doesn't work particularly well (or at all) when running as a restricted user

Re:This can be prevented...

[Jason_R0]

I agree that most developers don't seem able to handle the restricted user/admin user scenarios. Ideally software should use the minimum amount of "privileges" it needs.

The issue still exists in all operating systems however that it seems there are basically two modes of operation "restricted" and "privileged". If you want to install something which is "privileged" you log into the admin account, do what is needed and that is the end of it. How does the admin really know what has just happened in regards to the privileged software and what it has done to the system? Microsoft barely alert on anything, Linux and its variants are the same.

Privileged software can rip the guts out of an operating system, yet the only protection offered by a lot of people seems to be "don't run in administrator/root mode". So if someone followed these suggestions, they now can't install/run certain software because its privileged? There is a big gap there for either Microsoft or 3rd party developers like myself to fill. If I install something privileged as an admin, I want to know what *important* things it has changed, regardless of my trust level for the program.

Re:This can be prevented...

[Scarletdown]

In the current situation, if you *WANTED* to play this particular CD on your system, and it needed to be installed from an ADMIN/ROOT account then you are stuck in the position of either NOT installing it at all, or allowing it to do ANYTHING it wants in admin/root.

There is a third option.

Put your original CD in a safe place, then fire up gtk-gnutella and download the CD in a format that is not DRM encumbered.

Re:This can be prevented...

[Jason_R0]

It would sort of be funny watching the RIAA send a letter to that user, wouldn't it. :) RIAA says your guilty until proven otherwise.

Stop buying Sony

[Aceticon]

And i mean everything and anything from Sony, not only CDs.

It all boils down to:
- Do you trust this company?

I haven't trusted them for the past 4 years so i haven't bought NOTHING AT ALL from Sony. I actively boycot all their products.

Vote with your wallets people, all you have to do is resist the temptation to go all "uuuuh shinny!" whenever Sony puts out some new gadget.

Re:Stop buying Sony

[http101]

That's a fantastic idea, but the problem is that there are more companies out there tied to Sony! What about BMG? Should we officially cease any future purchases from them? One of the biggest problems in America is that everyone is owned by someone and they still operate under their original name. If we started as Compaq, were bought out by HP, why the hell are we still "Compaq"???

As for Sony devices, I've had nothing but problems and disappointed every time. My DVD drive refuses to read certain CDs and DVDs, my MicroVault fried in my shirt pocket during transport from work to home, and my 5.1MP digital camera with a Carl Zeiss lens still takes blurred pictures despite being in full daylight and ISO-400 mode. It's not like I'm taking pictures of the sun or anything... closing the shutter actually means, "CLOSING THE SHUTTER".

What about allofmp3.com

[Anonymous Coward]

I hear that http://www.allofmp3.com/ is licensed to sell music via the internet - so no DRM CD's
That would give you a digital license if I understand it correctly so it would be good for the iPod

Someone that understands cross border laws in the different countries would be better qualified to comment I am sure

Wait. -- people are still buying music CDs?

[slcdb]

That's so twentieth century. I've long ago said "goodbye" to the small round silvery discs, and said "hello" to iTMS.

Re:Wait. -- people are still buying music CDs?

[swordgeek]

That's nice for you. "Unfortunately," my home stereo is quite incapable of playing downloaded music in a lossy compression format. Nor are my eyes very good at reading electronic liner notes away from the computer.

Oh yes, and then there's the 70% of my music collection that isn't available online, legally or not.

Digital downloads shouldn't necessarily _replace_ CDs. They exist seperately, and serve different niches.

Answer: This is truly evil

[Anonymous Coward]

How is this a flaw w/ Microsoft's security model?

Wouldn't they just ask you to su if the rootkit was trying to install in a Linux or OSX environment? Exact same "flaw" as Windows XP.

Corporate criminality

[Anonymous Coward]

Just more evidence that it is STRONGLY inadvisable to ever buy CDs from corporate criminals.
They only use the money they take from you to attack their own customers, and develop software that will trash your machine.
If I find such a virus on my machine, I will definitely be charging the full cost of cleanup to the record company, plus I will be charging them for the downtime and time wasted.
Virus writing of this type is a serious Criminal Offence in my country. Hopefully, Sony executives will be charged under computer crime legislation, and get a nice prison term like any other offender would for such an offence.

Buy from allofmp3.com

[superbam]

No DRM. Whatever format you want. http://www.allofmp3.com/

Sent to EFF...

[Anonymous Coward]

The following was jusst sent to the EFF.

There's a lot of out there tin-foil hat stuff that get's thrown around due to things like the DMCA that is just not that important to Joe Consumer. This has real potential to fusk people up NOW for doing nothing more than being the docile consumer that society wants them to be.

I'm not an activist, but this is getting out of hand, and I want to do something about this.

I'm sure you've seen all the stories on this popping up everywhere. Here's a good example:

http://www.sysinternals.com/blog/2005/10/sony-root kits-and-digital-rights.html

I find it hard to believe that with all the laws being passed that punish individuals for doing this exact same thing, that they can't also be applied to corporations like Sony.

This needs to be stopped, and punished severely, sooner than later so it gets stopped ASAP.

What can I do?

Writing Sony ain't gonna do anything. Ditto congress.

Mainstream media is ignoring this issue, yet it does, or will very soon if it keeps going, affect everyone that's a good little consumer.

I want this stamped out before I have to restore my Mom's PC after she tried to play her latest Keith Urban CD or whatever.

What can I do? Do you have a list of Law Firms I can contact to sue Sony for this? There are very real and potential damages that can be easily demonstrated. Very soon someone is going to write a virus/trojan that takes advantage of systems compromised by this "DRM". Why do we need to wait until someone's life is ruined by identity theft caused by these actions before we act?

So, what can I do?!

Re: I will not pay to be f****d!

[DeputySpade]

Thank God I do not buy music anymore.

Sony Music USA feedback addresses

[Anonymous Coward]

While waiting for a lawsuit to be organized, leave your feedback at
http://www.sonymusic.com/about/feedback.cgi

or email
SonyMusicOnline@sonymusic.com

*MOD PARENT UP*

[zooblethorpe]

C'mon folks, fire up your editors and compilers and have some fun!

Posting to CMT BB

[Anonymous Coward]

I just created a CMT acct and posted the following. We will see what happens.

Tapeworm

Van Zant CD installs spyware on your computer

If you put the Van Zant CD "Get Right with the Man" into your computer it will install harmful software that you cannot remove. It does not ask if you want to install this software, called a Rootkit, which allows Sony to do things to your computer. This is called spyware and it should be illegal... Here is more information http://www.theregister.co.uk/2005/11/01/sony_rootk it_drm/ and http://www.sysinternals.com/blog/2005/10/sony-root kits-and-digital-rights.html The man that wrote the second article is a Windows genius and he was not able to fix his computer after this evil Sony software installed itself WITHOUT HIS PERMISSION. Please let the artists who are creating the music we want to buy that this is an unacceptable practice. I buy music. I don't want any software that breaks my computer on the same cd as music. Do you?

Its gonna a be a No CD Christmas this year.

[Anonymous Coward]

There's a song in that somewhere...

Hear Here!

[Anonymous Coward]

Aye, that's the rub!
In the U.S., the Constitution (Article 1, Section 8) says that authors and inventors are granted the exclusive right to their works *by Congress* to promote further creative and scientific activity! The Constitiution does not acknowledge that an idea or story can be owned; it can only be used. It is beneficial for the society and culture to encourage that creativity by protecting it, but the products of that creativity belong to no one.

Why Sony WILL Get Sued!

[ZOverLord]

Here is my 2 Cents on what is so Dangerous that Sony should be sued for it!

When Sony Installed this Root kit according to mark's Sysinternals Blog - http://www.sysinternals.com/blog/

I quote:

I studied the driver's initialization function, confirmed that it patches several functions via the system call table and saw that its cloaking code hides any file, directory, Registry key or process whose name begins with "$sys$".

To verify that I made a copy of Notepad.exe named $sys$notepad.exe and it disappeared from view.

This means that ANYONE who has this ("Sony Root Kit") installed ("And not looking for Root Kits 24/7, The person that found it, Mark, did not even know it was there, and would have not found it had he not been testing the latest version of RootkitRevealer") CANNOT view ANY file, directory, Registry key or process whose name begins with "$sys$" in Windows Explorer or the registry, or process viewer and actually files and directories may not be seen from the command prompt as well, in some cases, I quote from Mark's Blog:

I therefore checked to see if I could examine the files within the hidden directory by opening a command prompt and changing into the hidden directory. Sure enough, I was able to enter and access MOST of the hidden files

From the Sony EULA, the ONLY reference to any software being installed http://www.sysinternals.com/blog/sony-eula.htm I quote:

As soon as you have agreed to be bound by the terms and conditions of the EULA, this CD will automatically install a small proprietary software program (the "SOFTWARE") onto YOUR COMPUTER. The SOFTWARE is intended to protect the audio files embodied on the CD, and it may also facilitate your use of the DIGITAL CONTENT. Once installed, the SOFTWARE will reside on YOUR COMPUTER until removed or deleted. However, the SOFTWARE will not be used at any time to collect any personal information from you, whether stored on YOUR COMPUTER or otherwise

Hmmm, well they just created a BACK-DOOR for anyone who has this root kit of theirs to get ("Personal Information").

Sony even made sure the Root Kit would Load in Safe Mode as well, I quote from Mark's Blog:

As I was deleting the driver Registry keys under HKLM\System\CurrentControlSet\Services I noted that they were either configured as boot-start drivers or members of groups listed by name in the HKLM\System\CurrentControlSet\Control\SafeBoot subkeys, which means that they load even in Safe Mode, making system recovery extremely difficult if any of them have a bug that prevents the system from booting.

For all Practical purposes Sony has disabled ALL protection from Viri, Spyware, Trojans and Root Kits on the computers that installed their Root Kit IF that Malware uses a $sys$ cloak! for the vast majority of Microsoft Windows computer users.

So IF/WHEN someone creates OTHER Root kits, Viri, Trojans, Spyware that uses this $sys$ cloaking ("Installed Courtesy of Sony") and ANY damage is done to a system because of it, who is responsible for said damage?

Any comments?

Not The Brightest Light On The Christmas Tree

[ZOverLord]

From xcp-aurora.com ("The Alleged creator of this ROCK-SOLID protection methodology")

http://www.xcp-aurora.com/xcp1.aspx

Quote:

"XCP1 - Burn Protect

XCP1 pre release technology is designed to provide copy protection onto compact disc recordable media (CDR). Its methodology is an encapsulation process that wraps around the audio content controlling device access. This technique enables the information contained on the disc to be protected without being altered or affecting sound quality. The control program provided as part of the disc management system does not install any programs that alter your access to the content. XCP is deployed through Aurora Software and provides two options for CDR protection."

End Of Quote.

I think it WRAPS around any prior functional protection method the vast majority HAD to protect their Windows Based computer ("Lets Not Forget NETWORK, if you happened to have installed this stuff on a system that's logged on with FULL Network Privileges")

True, the control program does not ALTER your access to the content, it just allows potential World-Wide access to any content on your Network it is installed on and makes WEP look like Quad-WPA encryption when compared to the holes this opens.

Quote From xcp-aurora.com

"XCP1

XCP1 is designed for CD Audio and PC & MAC playability. Levels of protection are very high and recipients of XCP1 copy protected CDs will find it difficult to digitally rip or burn the Red Book content of the CD."

End Of Quote.

Yes however it appears that it was just made much easier to FTP the entire contents of any and all system and possibly Network Media device(s) this stuff has been installed on.

All comments in this post made by ZOverLord are strictly the opinion of ZOverLord and do not reflect the opinions of any other person or entity including the site it was posted on.

Re:Alternative OS users

[Anonymous Coward]

No, under DCMA it's illegal to make programs which circumvents copy protection. It's even illegal to write a article how to do it.

What a bunch of assholes!

[Anonymous Coward]

OK, now Sony's illegaly infecting my computer? As far as I'm concerned, all "contracts", "agreements" between them and their customers are now null and void. They've given up their right to be treated with any respect whatsoever, and are merely criminals. Until the corporation atones for this with an extreme display of regret and humility, not to mention reparations, there's only one sensible course of action: Steal every God-damned thing you can from Sony.

That's not the DMCA

[BobPaul]

If you do this, then you are deliberately disabling a copy protection system, which is illegal under the DMCA. So Sony can sue you

You can disable copy-protection to your hearts content, Doug. What you can't do is circumvent it.

If I don't have a copy-protected CD in the drive, their copy protection rootkit/driver isn't doing anything. I can remove it with no legal reprecussions. It will just install itself the next time I put the CD in the drive.

Now, if I try to rip the songs by cirucmventing the DRM rootkit/driver, then yes, that's a violation of the DMCA.

Nevermind the fact that if you complain to sony that you can't play your DRM'd CDs on your iPod that they'll TELL you how to circumvent the copy protection.. but I suppose then you're doing it with their conscent.

Re:If you want to install any software on Windows

[danpsmith]

The state of the world is sad when the purpose of running as a regular user isn't to prevent the out of control user from running amuck, but to prevent the corporate software slime from taking control of our computers without asking

One more reason NOT to by music

[ps3udonym]

Well this just gives us a ligitimate reason NOT to buy music in this format. If you wish to support the artist, go to the concert, buy a t-shirt. If you want to listen to the music, just download it. Obviously companies like SONY don't want our business that baddly.

Re:If you want to install any software on Windows

[wheany]

Well, it it pretty much the same thing. The software (Corporate or otherwise) just automates the running-amuck.

California Residents

[Anonymous Coward]

We would be interested in speaking to any California residents that have experienced this problem before the EULA was changed. We have looked at many DRM cases and Sony went too far with this particular scheme. You can contact us at gw@classcounsel.com or at http://www.classcounsel.com/

use linux

[Anonymous Coward]

no windows-rootkits there.
oh and no drm protected songs as well

Re:If you want to install any software on Windows

[danpsmith]

The point remains, however, that the setting of user-privileges shouldn't have anything to do in particular with your machine's security. Everyone's saying Sony is the big bad wolf in this, which they are, but the fact remains that the OS should alert you before allowing certain actions to take place without your consent or knowledge. Everyone should be able to run as an administrator on their own computer. They are the administrator, it's their computer. I just think the sting is that much worse knowing first of all, which we pretty much already knew that our OS is that easily compromised without our knowledge, and secondly that this type of backdoor operation is coming from a more reputable source than in the past. I'd expect this from some third rate software development company that's developing some weird version of gnutella, but to get it from a Sony music CD is just all that more frightening. Overall, however, the OS should prevent stuff like this from happening (and yes, from default). You shouldn't have to tinker around in settings for hours in order to figure out how to make your OS not behave like a retarded schoolchild being lured into a van for candy. Just another reason not to buy stuff, IMO.

Re:Sony customer base is crumbling constantly

[Komodowaran]

Now, I realize as I'm writing this that your ID lists you as Andrew Tanenbaum -- so I'm forced to conclude one of two things (...)

Obviously, this Schmock of a slashdotter has adopted a name which is not his own. If I were you I would have a look at his slashdot *number* first. It shows us someone who has joined /. only recently. Well, surely NOT the prof.

BTW, if Andy Tanenbaum The Great had wanted to comment on this SONY disaster, he would have published his opinion directly under his own name on his own hp.

Greetz,
Waran

Ethnic stereotypes R funnee

[Darth23]

Not really

Re: Sony's Trespass

[Sloppy]

the person clicking on the icon has a reasonable expectation that all they're doing is playing music, not triggering the deliberate compromise of the basic integrity of their system with a root kit.

Expectation?!

I have been talking about running untrusted code in general, but especially if we look at this particular example, there's even more to say about "expectation." This particular CD is known to be copy-protected. I don't know if it says so on the packaging, but it's pretty blatant on the Amazon page.

How else, other than compromising the integrity of the reader, can copy protection possibly be implemented? The user knows that normally, he can read a CD and do anything with the data. What does he think is going to happen if he runs code from a CD that is labelled as protected? Please, give any possible example of what the executable code even might do, other than act in a hostile manner. Copy protection either does something bad, or it fails to work.

In general, a person has a reasonable expectation that clicking a CD is a safe thing to do. Windows users, however, are special. Windows users have a reasonable expectation that clicking on a CD, will not just play a CD, but also may execute foreign code, which is a behavior that always comes with risk.

CD buyers, in general may have a reasonable expectation that commercial CDs do not contain dangerous code (I think that's naive, but I'll give the benefit of the doubt here), so it is irrelevant whether or not they execute whatever code may be there. Buyers of copy-protected CDs, have a reasonable expectation that whatever code is on that CD, is intended to compromise the capabilities of whatever device executes it and work against the user's interest. (Working against the user's interest is what copy protection is about. That's the whole point of copy protection.)

Ergo, Windows users that buy copy-protected CDs, have a reasonable expectation that clicking on a copy-protected CD will execute hostile code that was written with the intent to work against the user's interest.

I guess we can argue about to what degree that hostile intent should be manifest, but the user knew that something bad was going to happen.

Workstations in Corporate America and abroad...

[Anonymous Coward]

So, I'm a corporate grunt. I deal with scripting installs for a large corporation that has, like all the others, a strict policy on what is installed on their workstations. We typically make our installs silent so that the end user is not interrupted. If software resides on the workstation that doesn't come from one of our scripted installs then it was never certified to be on the companies computer and it must be removed. Users have been known to bring in audio cd's to listen to while working. This seems to be a problem. A big one. Now we have software that employees can bring in, unknowingly install, or possibly knowingly install, and dramtically increase the potential breach of confidential information and the acts of insider trading. It is my duty to keep software off our systems such as this and the best way I can think of doing this is opening a ticket with Microsoft and demanding a security patch that does not allow this software to install on our company computers. Lets not forget, there is more than just the home users that are effected. Your bank, your insurance company, your doctors office, etc. And come on, writing code that automates processes is getting easier and easier every day on the effected OS. Its my job, and 10 years from now I'll probably loose it to inmates. Lets not leave doors open like this for people to abuse.

Sign the Online Petition against Sony!

[urisil]

Probably the best way to show that not all the consumers are as stupid as Sony hopes that we are is to vote with our pockets. Boycott them until they offer a suitable solution to this mess, apologize to the consumers whos computers may have been damaged and change their strategy all together. I have started a petition which I hope will make its rounds. You are all welcome to sign it and send it on to everyone you know. http://www.petitiononline.com/sonydrm/