Sony DRM Installs a Rootkit?

An anonymous read writes "SysInternals.com guru Mark Russinovich has a detailed investigation of a rootkit from Sony Music. It's installed with a DRM-encumbered music CD, Van Zant's "Get Right with the Man". (Mmmm, delicious irony!) The rootkit introduces several security holes into the system that could be exploited by others, such as hiding any executable file that starts with '$sys$'. Russinovich also identifies several programming bugs in the method it uses to hook system calls, and chronicles the painful steps he had to take to 'exorcise the daemon' from his system." This house is clear.

Comments

My question:

[conJunk]

Now is that *sony's* rootkit, or a soon-to-be-former-sony-employer's rootkit?

Re:My question:

[ryanr]

If you read the article, there's a strong implication that this is a purchased commercial rootkit. Presumably, Sony very deliberately licensed and distributed it.

Mark didn't get into a lot of detail about all of the functions, but he didn't mention any backdoors or phone home functionality.

Re:My question:

[networkBoy]

Honestly, I see this as a real exposure to a lawsuit. If I accidently install this rootkit on my system, then try to remove it (seeing as it looks like a genuine security breach) and then disable my computer, thus having to bring it in for service what then?. If a malware company uses the rootkits ability to hide $sys$ prefixed files and uses that to steal my identity, costing me thousands of dollars and hundreds of hours of time to get my identity back, can I sue?

-nB

Re:My question:

[interiot]

The rootkit is by First 4 Internet. It's possible that Sony simply purchased this DRM from this outside company, not realizing that the DRM contained a rootkit.

Still, one would hope that Sony would only choose reputable suppliers, ones who wouldn't allow a virus/trojan to be distributed intentially or even through neglect.

Re:My question:

[networkBoy]

I don't understand what you mean. Do you mean that Sony did not understand that this DRM was a rootkit? or that the DRM is not a rootkit?
AFAIK this is a rootkit in more ways than one.
-nB

Re:My question:

[interiot]

there's a strong implication that this is a purchased commercial rootkit. Sony very deliberately licensed and distributed it.

It's obvious that a rootkit exists on the CD. It's quite likely that Sony purchased the DRM from First4Internet. It's not obvious that Sony asked First4Internet to include a rootkit in the product that was delivered to Sony.

Re:My question:

[eln]

And nobody at Sony bothered to vet a piece of software that was destined to be shipped with millions of CDs? It's beyond absurd that a company of Sony's size would allow a piece of software to appear on any of its products without Sony having tested the hell out of it first.

I think it's far more likely that Sony knew what this software did, and chose to distribute it anyway. This could have been a result of incompetent testers, poor communication between QA and management, overbearing management anxious to get a product out on a strict deadline, or any number of other things.

Re:My question:

[utlemming]

However, it might not protect them from a product liability suit. Simply put, if that had happened to me, I would have bought a new hard drive, reinstalled everything and then copied the data that I needed over, and then filed a product liability suit. I would claimed everything from illegal computer trespass, product liability, vandalism, and anything else that might have sounded half-way reasonable. The fact that a root-kit was installed on the computer to protect music shows that privacy now takes a second place seat to some one-else's property rights, when that person isn't even present. In this case one the music industry, if allowed to get away with it is violating privacy and property rights of another person in order to protect their property rights.

Re:My question:

[_pi-away]

It's obvious that a rootkit exists on the CD. It's quite likely that Sony purchased the DRM from First4Internet. It's not obvious that Sony asked First4Internet to include a rootkit in the product that was delivered to Sony.

This is not a rootkit hidden in a DRM product, the rootkit *IS* the DRM product. There is no way sony did not know about this.

Re:My question:

[MiKM]

Even so, isn't Sony ethically (if not legally) obligated to ensure that the DRM protection doesn't violate a user's privacy? Surely Sony and every other company that uses DRM tests the DRM to ensure it doesn't either interfere with a computer's normal operations or create a major vulnerability. While it isn't a perfect example, it would be as if Ford bought car security systems from ACME corp that had a major vulnerability. While it is ACME corp's fault that the vulnerability exists, it is Ford's responsibility to make sure that the security system WORKS and has no backdoor or unreasonable vulnerability.

Re:My question:

[slavemowgli]

You can always sue. The real question is: will you win? And even though IANAL, I'd say you have a pretty good case here; if the EULA does not even *mention* any of this, then it probably constitutes an illegal act.

Re:My question:

[John Hasler]

Besides, if Sony didn't know they were grossly negligent.

Re:My question:

[Anonymous Coward]

> It's beyond absurd that a company of Sony's size would allow a piece of software to appear on any of its products without Sony having tested the hell out of it first.

You never played Star Wars Galaxies, did you?

Re:My question:

[Anonymous Coward]

From the Cnet article about First4Internet, http://news.cnet.co.uk/digitalmusic/0,39029666,391 89658,00.htm>

First4Internet's XCP has been used previously on prerelease CDs only. Sony BMG is the first to commercially deploy XCP. First4Internet's other clients -- who include Universal Music Group, Warner Music Group and EMI -- are using XCP for prerelease material. Sony BMG expects that by the end of the year a substantial number of its US releases will employ either MediaMax or XCP.

The particular steps taken to conceal this and make it impossible for a non-professional to remove qualify clearly as a rootkit, although not perhaps as malware. The exposure of Sony customers' computers is also a concern - here's a ready-made shield for malware from whatever antivirus they might be running.

Re:My question:

[DoraLives]

Actually this is a major limited access high speed expressway to seriously fuck with Sony.

It'll go like this: Somebody out there with an axe to grind against Sony is going to lift this code intact, with no modifications, and marry it with a worm that goes around and infects peoples machines with some nasty or other that executes with a file that has a name beginning with $sys$ and cause some real trouble with it.

Net result, the infected folks are going to have a SERIOUS beef with Sony over the fact that the "invisible" file was able to install itself and run its merry course completely under the radar. All because of a piece of shit attempt by a fucked up Giant Corporation that was attempting to further line its pockets by installing some ... shall we say, hmm, unsavory code?

Ok script kiddies, you have your assignment. Now get to work!

Re:My question:

[Tet]

And nobody at Sony bothered to vet a piece of software that was destined to be shipped with millions of CDs?

How? If you've ever worked in a software engineering team, you'd know that the chances of a software tester even knowing what to look for are slim at best. They'd test that it performed as it was supposed to do ("Does it let me copy the CD? No. Looks good to me"). They won't have checked for unexpected side effects, and even had they done so, they almost certainly wouldn't have know the inner workings of Windows well enough to detect software like this. There's an argument for Sony's purchasing guys not doing sufficient due diligence before buying the product, but blaming the testers? That's just not really reasonable.

Re:My question:

[Thing 1]

I hereby offer $200 toward this goal.

Re:My question:

[Anonymous Coward]

The fact that a root-kit was installed on the computer to protect music shows that privacy now takes a second place seat to some one-else's property rights

Sony have no property rights here. "Intellectual property" is nothing more than a buzzword. Copyrights aren't property. Patents aren't property. Trademarks aren't property. They are all limited privileges granted by the government to further particular social goals.

Once you fall into the trap of thinking "intellectual property" is property, the ideas that it's Sony's choice how to manage "their property" spring naturally from it. Why do you think you hear the phrase being pushed so much? Don't help them in their goal by referring to copyright as "property rights". It's not true, it's never been true, and (hopefully) never will be true.

Re:My question:

[trime]

Is that you Jack?

Re:My question:

[idlake]

And nobody at Sony bothered to vet a piece of software that was destined to be shipped with millions of CDs?

They did--by putting it on one of their releases. Releasing a single CD just isn't a big deal to these people. And it's done by the music division, which probably has even less experience with software than the rest of the company.

It's beyond absurd that a company of Sony's size would allow a piece of software to appear on any of its products without Sony having tested the hell out of it first.

From your remark, we must conclude that you have never owned a Sony camera, laptop, or PDA.

In democratic america...

[Anonymous Coward]

corporations exploit YOU!

hrm, so much for humor. I don't find it funny at all :/

Re:In democratic america...

[conJunk]

damn... you know it's getting scary when the soviet russia joke is not only unfunny, but frightening....

i don my tinfoil hat and robe...

Re:In democratic america...

[nmb3000]

i don my tinfoil hat and robe...

Wow, a tinfoil hat and robe! When do the pants and underwear come in? :)

However when you said "hat and robe", my first thought was of Bloodninja's cyber adventures.

Re:In democratic america...

[caluml]

Or as Osama says: "I'm free - what about you?"

Re:In democratic america...

[nmb3000]

corporations exploit YOU!

Insightful indeed.

The thing is that there is more than a corporation here. The artist that chose to sign with Sony is now going to feel the repercussions of this dirty little trick Sony tried to play. Do you think that Sony really cares if they loose a few sales of this one CD because they got caught red-handed? Of course not.

These record labels are not only exploiting the consumer, but they are screwing over the artists that depend on them for advertising and distribution. Here is contact information for Van Zant. Let them know that you're pissed. Let them know you won't be buying their CD. Let them know that they were screwed by Sony. While you're at it, why not let First4Internet know that you hate them and hope they burn in Hell for writing malware like this. A few thousand emails will do wonders for these jerks.

If enough artists move away from these corporate labels it can only mean good things for the consumers. It's not impossible for this to happen, just extremely difficult.

Re:In democratic america...

[evil agent]

Yeah, screw this. I'm never buying another cd again! I hear there's this concept on the internet called "file-sharing." With this technology around, why would people risk buying these dangerous cds? That'll teach Sony.

Re:In democratic america...

[Anonymous Coward]

congrats for catching the joke, you genius you!

Re:In democratic america...

[chrysrobyn]

In democratic America... corporations exploit YOU!

I've read two relevant quotes.

"Democracy is the theory that the people know what they want and deserve to get it good and hard."

"In communism, man exploits man. In capitalism, it's the other way around."

Re:In democratic america...

[ShieldW0lf]

Both systems give freedom with the one hand and take it away with the other. The difference is only which hand is doing which.

In soviet-style communism, the means of wealth production are commonly held and commonly shared. This is freedom, it protects the individual from being compelled to act against their will via threats of deprivation. However, that freedom is taken away by their totalitarian, non-representative political system where the laws, and thus control over common resources, are subject to the whim of the leader.

In american-style democracy, the political system is (somewhat) representative and transparent, and the population (via process) gets to be involved in the lawmaking and have certain freedoms. However, that freedom is then taken away by their capitalistic economy, which is structured to consolidate control over the means of production and communication into the hands of the few, keep it there, and place the rest of society in a position where they must obey or die of starvation and exposure. Contemplate the term "artifical scarcity" for a moment.

They both suck. They're both political-economic structures based around the few maintaining control over the masses without accountability. It was inevitable that they would have to be enemies and that they would have to heavily propagandise their population towards a blind negative reaction. If people ever actually stopped to think about it, they might realize that by pairing a communal economic structure with a democratic political structure they could finally stop being slaves living in fear. Dangerous stuff if you're the Master.

as if

[scenestar]

DRM wasn't intrusive in the first place.

and now with no liability

[jeremy111]

And let me guess, it offers you an EULA and exempts Sony from any liability for damages caused by this thing?

Re:and now with no liability

[redshadow01]

RTFA, the EULA does not mention this at all...the writer of the article made a specific point with respect to this.

Re:and now with no liability

[Anonymous Coward]

Article 7. DAMAGES ARISING OUT OF YOUR ACTIONS

You shall defend and hold the SONY BMG PARTIES harmless from and against any and all liabilities, damages, costs, expenses or losses arising out of your use of the LICENSED MATERIALS, your negligent or wrongful acts, your violation of any applicable laws or regulations, and/or your breach of any provision of this EULA.

Re:and now with no liability

[FidelCatsro]

Even if the EULA were to be a valid contract (which it isn't in many places , and probably isn't in many others)
A contract can not exempt any party from an act which contravenes any current laws.
  To quote the UK Sale of goods act 2002

48A Introductory
 
    (1) This section applies if -
 
(a) the buyer deals as consumer or, in Scotland, there is a consumer contract in which the buyer is a consumer, and
 
(b) the goods do not conform to the contract of sale at the time of delivery.
 
    (2) If this section applies, the buyer has the right -
 
(a) under and in accordance with section 48B below, to require the seller to repair or replace the goods, or
 
(b) under and in accordance with section 48C below -
 
(i) to require the seller to reduce the purchase price of the goods to the buyer by an appropriate amount, or
 
(ii) to rescind the contract with regard to the goods in question.
 
    (3) For the purposes of subsection (1)(b) above goods which do not conform to the contract of sale at any time within the period of six months starting with the date on which the goods were delivered to the buyer must be taken not to have so conformed at that date.
 
    (4) Subsection (3) above does not apply if -
 
(a) it is established that the goods did so conform at that date;
 
(b) its application is incompatible with the nature of the goods or the nature of the lack of conformity.
 
    48B Repair or replacement of the goods
 
    (1) If section 48A above applies, the buyer may require the seller -
 
(a) to repair the goods, or
 
(b) to replace the goods.
 
    (2) If the buyer requires the seller to repair or replace the goods, the seller must -
 
(a) repair or, as the case may be, replace the goods within a reasonable time but without causing significant inconvenience to the buyer;
 
(b) bear any necessary costs incurred in doing so (including in particular the cost of any labour, materials or postage).
 
    (3) The buyer must not require the seller to repair or, as the case may be, replace the goods if that remedy is -
 
(a) impossible, or
 
(b) disproportionate in comparison to the other of those remedies, or
 
(c) disproportionate in comparison to an appropriate reduction in the purchase price under paragraph (a), or rescission under paragraph (b), of section 48C(1) below.
 
    (4) One remedy is disproportionate in comparison to the other if the one imposes costs on the seller which, in comparison to those imposed on him by the other, are unreasonable, taking into account -
 
(a) the value which the goods would have if they conformed to the contract of sale,
 
(b) the significance of the lack of conformity, and
 
(c) whether the other remedy could be effected without significant inconvenience to the buyer.
 
    (5) Any question as to what is a reasonable time or significant inconvenience is to be determined by reference to -
 
(a) the nature of the goods, and
 
(b) the purpose for which the goods were acquired.

Sony did not mention this at the point of sale and therefor would be liable for repair of the problem .. IANAL but this is my interpretation of this part of the act

Re:and now with no liability

[CommiePuddin]

Congratulations, you just quoted the most useless part of every EULA ever.

You can't sign away your right to sue. Ever.

At least not in my state.

Anti-spyware Bill

[AKAImBatman]

We *really* need to get a anti-spyware bill on the books. Something along the lines of, "It shall be a criminal offsense to install non-application software on any computer when the user has not been reasonably notified in advance and/or agreed to have the modifications made. This bill will be reevaluated for its effect in three years."

Anything running in the background, rootkits, and other forms of spyware (which generally rely on the user not knowing they're there) would immediately become illegal.

Re:Anti-spyware Bill

[AKAImBatman]

shall we define "non-application software"?

The bill would actually need a definition of "application software" so that anything that doesn't meet that definition would be automatically covered. e.g. "Application Software refers to a self-contained program that is installed on the consumer's computer. To be considered self-contained, it must not modify the operating system to execute any software at any time other than when the user runs the software in question."

what constituteds "agreed to"?

The courts do. Considering the difficulties they've been giving to the click-through licensers, I'm perfectly okay with that.

Re:Anti-spyware Bill

[AKAImBatman]

That's where the "reasonably notified" comes in. The courts haven't been too happy about EULAs as they are. If you try to slide things past the consumer, the courts will find that the contract was misrepresented and hold the company accountable.

Re:Anti-spyware Bill

[Cromac]

It would be interesting to see if the CDs sold in Washington are different than those sold in other states. If they are and don't contain the rootkit in Wa that would seem to show a deliberate intent to distribute it to states that don't have such laws.

Re:Anti-spyware Bill

[queenb**ch]

Problem #1 - Mr. Spyware Programmer in Nigeria where such things aren't illegal.

Problem #2 - Mr. Identity Theif in wierd 3rd world country where such things are illegal but are tactitly condoned by local authority as long as its not someone from their country

Problem #3 - Mr Corporate Lobbyist - RIAA & MPAA ring any bells????

Problem #4 - Your privacy has been dead for decades. The sad part is that people are just now starting to smell the rotting corpse.

Passing a bill here in the USA will only do what CAN-SPAM did - drive them off shore to less regulated places. What's really needed is the ability to establish peering points that co-incide with national borders. Then we can pass a law that says that if we don't like your data integrity laws, we don't pass traffic to/from you.

See if that doesn't actually accomplish what you're looking for.

2 cents,

Queen B

Re:Anti-spyware Bill

[whoever57]

Corrected version:
1. Buy spyware CD
2. Join class action lawsuit
3. Get $5 off next CD voucher
4 (valid only for lawyers): collect $$$M

Re:Anti-spyware Bill

[MightyMartian]

Alternate route:
1. Buy spyware CD
2. Join class action lawsuit
3. Congress makes installing root kits on computers by Sony legal as part of omnibus NASA Barn Building and Stamp Price Commuter Shipping and Lawn Bowling Act.
4. (valid for crooked politicians only): Profit!

RootKits coming out in bundles?

[cwtrex]

I'm downloading RootkitRevealer now. I wonder how long it is going to take for Norton and McAfee to upgrade their Rootkit detection abilities? Next years anti-virus release? The last rootkit that Norton found on a computer at work was well spread and had been out for 6 months. It still was unable to remove/fix the infection. :(

Re:RootKits coming out in bundles?

[Flower]

This was semmingly bought by Sony from a 3rd party to protect their DRM scheme. My bet is no AV company is going to try and detect it or remove it as it is a "legitimate program." What's funny (well sick funny but still funny) is I could see First4Internet trying to sue anyone for labeling their software as malware and then trying to remove it. Not like that isn't the first time that's happened.

OS's fault

[aachrisg]

Microsfot needs to make it completely impossible for any software to do something like this unless the user runs in some special maintenance mode or logs in as some special account. They can make an exception for windows updates which are signed by them.

Re:OS's fault

[redshadow01]

Yeah, that's called "Trusted Computing"...where Microsloth decides what you can and can't run...

Re:OS's fault

[LLuthor]

These kind of changes can only be made with changes to the driver model.

They can't make it impossible to do this kind of thing on 32-bit versions of Windows (without breaking A LOT of drivers and programs), but on all 64-bit Windows versions this is already impossible.

Re:OS's fault

[speeDDemon (nw)]

Trusted Computing...

I think this lil video on Trusted Computing is perfect at explaining trusted computing.

I leave it running on the computers on display in my store. Hopeing that I can educate enough people in my small section of the world about the follies they are about to embark on.

Re:OS's fault

[dtfinch]

They at least ought to turn off the seriously insecure by design autorun feature by default.

Re:OS's fault

[hal9000(jr)]

Easy, Don't run as ADMINISTRATOR. Run as a regular user!!!!!!!

Come on, man. It's 2006 already

Re:OS's fault

[werelord]

Yes, it can be the OS's fault, but don't solely blame Microsoft.. Rootkits have been around for a long while; Unix and Linux are far from exempt from this..

Re:OS's fault

[sulli]

Exactly. Also, never autorun CDs.

Re:OS's fault

[Antique Geekmeister]

No, "Trusted Computing" is not designed to prevent this. It is designed to *enforce* it. By having an appropriately signed application, required to access appropriately signed and controlled hardware such as your CD or DVD drive or appropriately encrypted files found on your CD, DVD, or downloaded files, it's designed to prevent you from accessing content in your files or on your systems without the signed license keys from the vendor.

Re:OS's fault

[slashknott]

Run as a regular user. Users group.

Then, if (when) you need to install something, or run a program that needs administrative privileges, right click it and "Run as" Administrator (or user with administrative privileges).

This is the same kind of thing as 'sudo' in linux.

You'll get a lot less shit on your system this way, still not perfect but better.

Didn't Notice?

[KidHash]

Not that this makes it better in any way, but I liked how he said

I hadn't noticed when I purchased the CD from Amazon.com that it's protected with DRM software, but if I had looked more closely at the text on the Amazon.com web page I would have known

followed by a picture of the amazon web page in question with [CONTENT/COPY-PROTECTED CD] clearly visible in massive letters.

Re:Didn't Notice?

[HTH NE1]

Amazon has been known to alter the titles of products in their catalog. However, in my experience the copy of the title in one's order history does not get revised (I make many preorders).

Mark Russinovich should check his order history for the presence of that text there to determine if it was present at the time he ordered.

Re:Didn't Notice?

[corblix]

followed by a picture of the amazon web page in question with [CONTENT/COPY-PROTECTED CD] clearly visible in massive letters.

Well ... there is "clear", and then there is "clear". The page shown is extraordinarily "busy". At the top it has four tabs with nine subtabs, five account management maybe-tabs, a drop-down menu, two separate search boxes, two "Go" buttons and an "Advanced Search" button ... and that's just the top of the page.

Meanwhile, over at the right is a big yellow button in a big blue box, and in the middle of the page is the cover image.

Do you read all the text on every web page you visit? (Hint: you don't.) I certainly don't. When I buy a product, I consider: Is this the product I want, how much will I have to pay, and how long will it take to arrive.

The real lesson we learn here is not that the author of the article was unobservant. On the contrary, he was just as observant as anyone could be expected to be. No, the real lesson is that we all need to make a mental note: When paying for music, check its DRM status. I appreciate Amazon making such info available in nice big letters in an easy to see location. However, that alone does not mean I will read it.

Re:Didn't Notice?

[lysander]

This whole thing just reads wrong. How much are you willing to bet he bought the cd just so that he could deconstruct the DRM? This seems much more likely than a windows-internals hacker just happening to notice an anomaly, dig around for it for a while, and then realize, "Oh, damn, maybe it was that cd I bought that had DRM notices all over it?"

Re:Didn't Notice?

[jsebrech]

I agree that it's easy enough to find out whether a CD is copy-protected or not most of the time. By paying attention to it I've already been able to avoid buying several copy-protected CD's.

In my experience most artists don't even know their CD is copy-protected. Like Charlotte Martin's CD On Your Shore. BMG put copy-protection on there without informing her. When she found out, she made them remove it from the second print. Had she known beforehand, it would have never gotten on there. She was pissed about it. Just informing the artist of your displeasure about the DRM can go a long way.

Is the EULA valid?

[nweaver]

Since spyware WITH a proper EULA has been held to be in violation by the FTC, and since this EULA doesn't really mention the rootkit's difficulty of removal, this might be litigatable.

Of course, Mark Russinovich did (inadvertantly) dissasemble content protected by the EULA.

Re:Is the EULA valid?

[Billly Gates]

Worse it should not be legal in the first place for such an extreme eula. Many spyware programs from 180networks already do not have an euala and just come bundled.

If we had an eula where the user agreed to be held as a slave would that be legal too? I think not.

Re:Is the EULA valid?

[MultisSanguinisFluit]

Of course, Mark Russinovich did (inadvertantly) dissasemble content protected by the EULA.

Yeah, but it's not like there was a file listing that clearly identified which files were covered under the EULA. One can argue that licensors have a duty to identify their intellectual property.

Sony has gone too far...

[chrispyman]

It's one thing to copy protect your CDs to make it difficult to rip but it's another thing to install a rootkit that is by definition difficult to remove. Who'se going to clean up this mess when a Microsoft patch or SP comes around and breaks any computer with this installed?

Thanks

[BCW2]

I am very glad to hear about this. That CD WAS on my birthday list for next week.

Sony just lost a sale, end of story.

Re:Thanks

[Flower]

Don't tell Sony. Tell the Brothers that they lost a sale. Let them know that the product they worked so hard on now has poorly written software on it that could damage your computer. And through you want their music you can't buy it and you're going to tell your friends not to risk buying this CD.

Re:Thanks

[xtracto]

If you know about other CD's, feel free to help.

The list of CD's so far are:

Note: I would had preffered to make a nice looking list, but Slashdot was spitting me " Your comment has too few characters per line (currently 36.7)." so I had to remove all the CRLF from my post. Sorry

Nothing Is Sound. Switchfoot Unwritten [ENHANCED] Natasha Bedingfield Ride Shelly Fairchild 12 Songs Neil Diamond Touch Amerie Bloom Remix Album [ENHANCED] Sarah McLachlan Kasabian Kasabian The Essential Pete Seeger [ORIGINAL RECORDING REMASTERED] Pete Seeger Jeru [ENHANCED] [ORIGINAL RECORDING REMASTERED] Gerry Mulligan imes Like These Buddy Jewell, Bob Brookmeyer & Friends [ORIGINAL RECORDING REMASTERED] Bob Brookmeyer Healthy In Paranoid Times [ENHANCED] Our Lady Peace Cautivo [DUALDISC] Chayanne The Invisible Invasion Coral, The Coral Defined Amici Forever Suspicious Activity [ENHANCED] The Bad Plus Manhattan Symphonie [ORIGINAL RECORDING REMASTERED] Dexter Gordon Phantoms Acceptance On Ne Change Pas Celine Dion Get Right with the Man Van Zant To Love Again [ENHANCED] Chris Botti Life [DUALDISC] Ricky Martin The Essential Dion [ENHANCED] [ORIGINAL RECORDING REMASTERED] Dion Faso Latido A Static Lullaby Change It All Goapele Susie Suh Susie Suh My Very Special Guests [ORIGINAL RECORDING REMASTERED] George Jones Broken Valley Life of Agony Silver's Blue [ENHANCED] [ORIGINAL RECORDING REMASTERED] Horace Silver Z [ENHANCED] My Morning Jacket

Class Action Lawsuit?

[eyebits]

Sounds like an opportunity for a class action lawsuit. Everyone who played the CD on their windows system would be eligible. ...good opportunity for a group of lawyers to get rich. (The members of the action never do.)

Re:But...

[kuzb]

Often times you're not presented with a choice. The first time you insert a CD, it will autoplay - this is when this crap makes it in. I know you can shut that feature off, but most people either don't knwo how, or won't.

This has gone too far!

[Billly Gates]

What is next? Drm that will rewrite your bios and turn your pc into an expensive doorstop for copyright violation?

As if spyware itself is miraculiously legal and now we have this? Rootkits and spyware programs that append to windows in the mbr so even a reinstall wont delete thim IS TOO FAR!

I agree with a previous poster that is should be a criminal offense the same catagory as spypainting someones house or breaking an entry. Why do we allow this crap to be legal?

Its time we wrote our elected officials and inform them about what is happening and about Sony's drm and demand civil and criminal responsibility for malware makers. I dont care if its the CEO of some company spraypainting my house vs a teenage kid. Its still illegal and Sony should be held accountable.

I was reading on cnn about the drop of ecommerce even though there is still a rise in internet usage. This is due to all the spyware/scams/malware that is infecting pc's at record rates. This is killing out economy and many companies such as Google, Amazon, and Ebay are already getting hit with their wallets over these scams.

Lets organize and make a difference. This is a slippery slope and I fear what is coming next.

Re:This has gone too far!

[burnsy]

"What is next? Drm that will rewrite your bios and turn your pc into an expensive doorstop for copyright violation?"

Yes, look for it in your next Blu-Ray Disc Player.

http://www.engadget.com/entry/1234000737057152/

"On top of that, consumers should expect punishment for tinkering with their Blu-ray players, as many have done with current DVD players, for instance to remove regional coding. The new, Internet-connected and secure players will report any "hack" and the device can be disabled remotely."

Re:This has gone too far!

[mcrbids]

Lets organize and make a difference.

OK, let's. I assume that this is a call to join a foundation, organization, or movement. What have you decided to call this organization? What's the mission statement? What are the goals of the organization? Meeting times? Rallies?

Yep, I just might be interested. Really.

If you're serious, that is - but I don't think you are. See, if you were, you'd have to stretch yourself outside of your current "comfort zone", which currently includes your computer, and quite possibly your mother's basement, but not much else.

But, if you WERE serious, and you REALLY DID put out enough effort to register a domain name, make a website, put together some business cards, talk to REAL LIVE PEOPLE (instead of your laptop) at real, live events, you'd find out very quickly what real, live people think. You'd grow immensely, as a result. Your skills at working with people, and your earning power would be forever improved, and your understanding of your true role in society would be much, much firmer.

You would forever be a bigger, better person.

I dare you to put together an organization of at least 100 members towards your cause. In order to be a "member", they have to have contributed at least $10 in CASH towards your cause's war chest. (And, I know you can do it, because I did)

Re:This has gone too far!

[frogstar_robot]

Remember recently one of our esteemed elected officials (in the USA that is) who wanted the ability to physically remotely destroy the pc of someone infringing on copywrighted material? I don't want to name the name because I'm not sure which one it was. The whackjob in question is Orrin Hatch.

Re:This has gone too far!

[loraksus]

This might be a slightly odd response, but I think part of the reason is that in a situation such as a computer crime, there really isn't any possibility of the victim going apeshit (or doing something in retaliation) on the perpetrator if caught.
During sentencing (and really, during the entire judicial process - the police probably won't respond in the first place if you call 911 and say "those darn kids are crossing my lawn", even if they do, the prosecutor probably won't try them for tresspassing) maybe the actual crime itself is irrelevant, but what is taken into consideration is how the crime is perceived by the majority of people and what the majority believes is appropriate punishment.
Right now, most people feel that rootkits, malware, etc aren't really an issue - be it lack of education or whatever. If that changed (perhaps this could be spun as a "corporate espionage which aids terrorists" type of thing ;), I think viewpoints would change and the punishments would get harsher and maybe someone in the justice system would actually take the issue seriously.

Like unto a virus

[Shadow Wrought]

Man, Sony'll do anything to make sure your system has their Cell in it.

TIme to...

[heinousjay]

Turn off autorun.

Re:Hmm

[redshadow01]

To make matters worse, not only is everything hidden, but you can't just delete the files and reg keys or you'll cripple your system...the author of the article is a developer and he spend a lot of time just getting rid of the damned thing...I know I couldn't do it

What part of protected == rootkit?

[Anonymous Coward]

There's a slight difference between a copy restricted CD and an "install a rootkit on your computer" CD, though...

Re:What is it exactly?

[RingDev]

Being a root kit just means that the program works at the OS level, USUALLY in such a way that the end user will not notice it, nor will virus detectors flag it. It changes something about "Windows" as opposed to adding something to it. (over simplified)

The arbitrary code in this case is installed when you hit 'OK'.

-Rick

Re:What is it exactly?

[abscondment]

You're confusing the terms "rootkit" and "trojan"/"backdoor".

A trojan in its strictest sense tricks a user into executing one set of code when they think they're executing another. A backdoor simply allows remote execution of arbitrary code.

A rootkit is usually the set of tools that an attacker deploys on a compromised system. "rootkits" in the terms of this article are programs that trick your kernel into doing things it shouldn't do. This could include a trojan or a backdoor, but not necessarily.

Sony's program is a rootkit because it runs without authorization from the CD and alters the Windows API in order to disguise itself. As far as the article indicates, it doesn't include the ability for Sony to execute code on your machine. It's still dirty and sinister, if you ask me. It also allows any other malicious attackers to conceal anything they plant on your machine - simply by prefixing any file name with $sys$ - that's not cool!

What if you refuse the EULA?

[BeBoxer]

I know you can disable auto-run and such to get around this type of crap. But what happens if you just 'disagree' or whatever on the EULA? I assume that Sony will then not install the rootkit and you can rip the CD with whatever tool you normally use? Or does Sony install the rootkit anyway, setting themselves up for criminal prosecution? Does anybody have a copy of this thing to try and answer that question?

It just seems kind of silly to have DRM which is totally dependant on the user to request it be installed. Or can refusing an EULA be considered a violation of the DMCA?

Re:Hmm

[networkBoy]

"the author of the article is a developer and he spend a lot of time just getting rid of the damned thing...I know I couldn't do it"

But thanks to his hard work, now we can! I for one love this guy.
Now I have another reason to dump Windows, this rootkit won't run on Linux or Mac.
-nB

This is as good as...

[elgee]

Getting a cockroach with my just purchased pizza.

Re:This is as good as...

[Reziac]

More like getting a tapeworm with your pizza, which you don't realise you have until it's already firmly attached to your gut.

Great corporate thinking

[sikandril]

This is exactly the same mentality that brought us the memory stick and the mp3 walkman who could not play mp3's, only ATRAC. Incidentally, Sony profits are down 46% this quarter. I can only add that this is another nail in the coffin of a company once known for its innovation, high standards and uncanny understanding of the consumer's mind. They better hope the Ps3 saves their collective asses

EULA's do not trump the law

[LM741N]

You can't enter into a contract which violates the law. Thus a "contract killing" is not a valid contract.

Here is what a kid had to say...

[cyclocommuter]

...after he tried to rip another Sony produced CD "Healthy in Paranoid Times" by the Our Lady Peace:

Disappointing, to say the least..., October 14, 2005

A Kid's Review (Amazon.com)

I tried copying this CD, not knowing that it was protected. So, I ripped it to my hard-drive and burned it. But, when I inserted the burned copy into my computer, the screen froze for a while, and an installer icon appeared on the taskbar in the bottom right. It installed somthing - and now I cannot burn anything, with any program. I've even tried using a different, external CD burner. A disk error comes up during burning, even if I am not not burning audio CDs. This was not a fluke. I've talked to other people this has happened to. Avoid anything with "copy protection." Sony might as well burn viruses onto the CDs they distribute.

Re:But...

[WWWWolf]

Yes, some people DO install the stuff that comes with their CD's, because sometimes that "crap" gives them the ability to rip so many licensed copies of the song to share with friends.

After being presented with a sell-your-babies-to-the-almighty-record-label EULA, and before shoving awfully encoded WMA format files down their throats.

Hint #1: There's no "copy protection" on CDs. For most parts, it's misshapen multi-session CDs. cdrdao read-cd --session 1 ... Hint #2: If you're encoding the files to MP3, Vorbis or, good heavens, WMA, digital rips are wayyyy overrated and plain old CD player, analog RCA-to-RCA cable and an audio recorder app can do really wonders. =)

It's immoral to buy RIAA music

[Jason1729]

I used to buy a lot of CDs but stopped around the time of the napster lawsuit. I would probably still be buying 2-3 discs/month if I didn't consider it immoral to buy CDs.

Re:It's immoral to buy RIAA music

[lavaface]

I hope you are just talking about RIAA discs, because there's a ton of stuff being produced by small, independent artists that could use your support.

Awesome

[suwain_2]

On this CD's product page, there are several negative reviews on account of spyware. My favorite puts into plain English why this is bad: "I am very unhappy, since I now listen to all of my music using my IPod."

I think this is the way to fight DRM. When we complain about DRM rights, we're fighting a crusade on principle, and few people really get what's wrong. When you say, "This CD that I paid for can't be transferred to my iPod," people will see that it's outrageous. When people see that it's installing spyware on your computer, they'll flip. Cheers to whoever's left this feedback.

Re:Awesome

[Fo0eY]

everyone should visit amazon and mod up those informative links as "helpful"
seems strange that most of those kinds of reviews are currently all being modded down

Van Zant

[mOdQuArK!]

Has "Van Zant" or their agent made any comment on how they feel about what Sony is doing to their audience in their names? (Would they even understand what Sony has done?)

*phew*

[Alan]

I'm glad I get my music off of p2p networks and don't have to worry about trojans and rootkits and that evil hacker stuff!

Re:*phew*

[owlstead]

This is funny? I've got 4 official DVD's that won't run on my player, and 3 or 4 CD's that don't play in my computer. If *they* are not going to play fair with me, I sure as hell will return the favour. I bought an offical DVD, and all I got was a cheap skate menu and 10 minutes worth of adverts and warnings. Bleh.

Re:*phew*

[Anonymous Coward]

you know what's funny, i've downloaded gigs and gigs of pirated stuff off irc over the last decade, and i can't recall getting ONE virus/rootkit/spyware program that came with what i downloaded.

i trust the pirate groups more than i trust the companies.

Re:Could be . . .

[crimethinker]

Actually, I think the guy violated the DMCA by circumventing the copyright protection technology.

Because I think the DMCA is a ridiculously bad piece of law, I would like to see Mark prosecuted for violating it, so that people can see just how bad it is.

-paul

Re:Rootkit? No evidence of that.

[WWWWolf]

I think the article provided enough evidence as is. Yes, it is "DRM shovelware", which is an offense in itself. Yes, it's hard to uninstall, which is bad. But it's also trying to hide itself, which is really nasty, and it hides stuff indiscriminately, which is worse.

It is a rootkit, because it messes with the OS to hide specific files. It is a dangerous rootkit, because it hides all files that start with some prefix, not just the specific files used by the DRM mechanism - this could be potentially used to hide more mischief from the same source.

Re:What is it exactly?

[sakusha]

You obviously didn't read the article very closely. Sony patched the CD/DVD drivers, Sony's code runs every time you access the drive. He didn't disassemble the entire driver so there is no clear indication that it doesn't contain security problems (whether by incompetence like a buffer overflow, or a deliberate backdoor) that would allow arbitrary code to run. There is no way to audit the code for security, it is probably illegal under the DMCA to disassemble and fully analyze DRM code in sufficient detail for a full code audit
THAT is the biggest problem with these windoze DRM hacks. You can secure your system with all the technology at your disposal, but it means nothing when you are tricked into running a rootkit disguised as DRM. Then you have to trust the DRM vendor did not make any mistakes that expose you to further security risks.

People like to gripe about Apple's DRM, but at least they know better than to pull crap like this.

Not very good DRM

[oboreruhito]

It's worth noting that the DRM in question, which prevents a CD from being ripped into an iPod-compatible format, can be circumvented by the following step:

1.) Insert CD into a Macintosh

(And yes, little Timmy, Linux/BSD/FreeDOS/whatever)

Sony is protected by the DMCA

[dmoen]

I see this as a real exposure to a lawsuit. If I accidently install this rootkit on my system, then try to remove it...

If you do this, then you are deliberately disabling a copy protection system, which is illegal under the DMCA. So Sony can sue you.

[Note: this varies with your jurisdiction. No DMCA in Canada, yet.]

Doug Moen.

Re:Sony is protected by the DMCA

[hazem]

Doug, I think you're wrong.

I can disable a copy protection system on my own computer - specifically removing it. They didn't have permission to put it there, and I think it would be a tough case to prosecute me for repairing my own computer. My computer is not Sony's medium to do with as they please - it's MINE - I paid for it, and I licensed the software.

Now, removing the protection from their media - or extracing the content and freeing it from the DRM, yes, that's circumvention, and probably prosecutable under the DMCA.

But my computer is MINE and they don't have the right to secretly fuck with it.

Re:Sony is protected by the DMCA

[kubevubin]

Assuming that the installation of this rootkit is entirely automated with no user prompts, I don't see how Sony could put together any sort of defense. I mean, the simple fact of the matter is that their lack of responsibility caused damage to consumer property.
You know, between this, that defective camera component fiasco, and cutting an assload of jobs, I'd hafta say that Sony isn't doing so well. Heh. I can't wait to see how the PlayStation 3 launch turns out.

Re:Sony is protected by the DMCA

[Andrew Tanenbaum]

They don't put it there. You do. They just packaged it for you. If you didn't want to give them permission to run arbitrary executables on your computer, then WHY DID YOU RUN THEIR EXECUTABLE??

Re:Sony is protected by the DMCA

[indigoid]

indeed. for the purpose of deciding who is running something, is autorun.inf "us" or "them" ?

Re:Sony is protected by the DMCA

[MikkoApo]

Autorunning executables from cds' autorun.inf is the default action in some of Microsoft's OSes.

Re:Sony is protected by the DMCA

[br0ck]

Suing them IS trying to remove it, so suing them invokes the DMCA.

Re:Sony is protected by the DMCA

[shadowkin]

I really think it would depend on whether or not the CD had a EULA printed in the booklet. If it did, then technically you would consent to its install.

But then that brings up EULAs and is a horse of a whole different color.

Re:Sony is protected by the DMCA

[shibashaba]

Consumer puts a cd into their computer with the intention of playing the cd. The cd takes advantage of a feature in Windows and installs software in the background without your knowledge. No court would find Sony not liable for damagaes caused because the user didn't disable autorun. It's the same as an email viruses, just because the user never turned off macros doesn't let the person who runs the virus off the hook.

This isn't the first time Sony's had this idea. Years ago they asked someone to write a virus to subliminally provide marketing to people. This motivated the person they asked to write a book called Coercion.

Re:Sony is protected by the DMCA

[Fnkmaster]

I call BS on this. When you put what you think is an audio CD in your CD ROM drive and click on the drive icon, you don't expect to be giving permission to anybody to install a rootkit.

Furthermore, your argument is simply insane, even if applied to software CDs. Do I give permission to any software vendor to install anything they want when I run the installer executable? Do I give them permission to wipe my hard drive? Install malicious, intentionally uninstallable programs? Monitor my activities when not using their software?

Even the most ardent proponent of EULAs couldn't make the claim that you give such permissions by default. Unless they specifically ask, they don't have permission to do anything that isn't specifically part of the product as a reasonable person would perceive it to be.

Re:Sony is protected by the DMCA

[Braedley]

It's an autorun. If you aren't fully forewarned (like I was for another of Sony's CDs), you have no choice but to install the software. Also, although it's hear-say, there are some specifics about the software that isn't mentioned in the EULA (which, for once, I did read (well, at least some of it)). And if I'm not mistaken, there is some DRM software installed before you even agree to the EULA, just so that if you don't agree, you can't go back and do it properly.

Re:Sony is protected by the DMCA

[mrBoB]

Unfortunately, this is only something that could be dealt with at a trial. Whose rights are more valuable, the content provider, or the paying customer? A person has a reasonable expectation of privacy and security on his or her home computer. Any attempt to circumvent this privacy or security should be construed as trespass. On the flipside, recording artists and the companies that represent them have an expectation that their work is compensated, and that "legal" means to protect their interests be respected. I'm not arguing for the DMCA here, however it _IS_ law. By removing the Sony-installed malware, Mark has broken the law. But so is trespass illegal, so tell me, which is a greater abomination?

      I'd vote for trespass, but I also don't have any content to sell. Mark, how's the adminpak selling? I hope you've got some good DRM on your CD's if you're any indication of the talent that's out there...

Re:Sony is protected by the DMCA

[stonedonkey]

Even the most ardent proponent of EULAs couldn't make the claim that you give such permissions by default. Unless they specifically ask, they don't have permission to do anything that isn't specifically part of the product as a reasonable person would perceive it to be.

And the EULA doesn't mention this rootkit or anything like it, from what I've read. In my opinion, I have the right to create a secure environment for my data, and the rootkit subverts that. Since the EULA doesn't mention it, I'm free to remove unauthorized the unauthorized code.

Bad Sony! No biscuit!

Re:Sony is protected by the DMCA

[Suddenly_Dead]

An EULA in the booklet? Do you have to read and click agree on the booklet before you can use the CD? A contract like that isn't going to hold up if one party doesn't agree to it in the first place, or may not even have knowledge of its existance.

When I buy a CD, I shouldn't have to expect it to install a rootkit, and have to check the included materials to see if it does; it's Sony's responsibility to tell me they're messing with my software, and ask for consent...

Re:Sony is protected by the DMCA

[Dark_Lord_Prime]

Unless the EULA also has a line (or lines) about "You hereby authorize us to install this malware on your system, thereby exempting us from any and all future lawsuits resulting from such", then it doesn't absolve or excuse them from installing the software without your knowledge.

As for removing it being a breach of DMCA, the DMCA makes it illegal to disable or circumvent the DRM measures for the purpose of copying the content, doesn't it? If you simply remove the unwanted software, you are not "disabling or circumventing," because it will be reinstalled every time you attempt to use that CD in your system. The only thing that would make removing it completely illegal is--as someone else mentioned--copying the CD and removing the rootkit from it, thereby allowing you to use the CD without
(re)installing the malware with it.

Re:Sony is protected by the DMCA

[Dark_Lord_Prime]

In that situation, you have their permission to do it, which would, one would assume, negate any protection they might have (or had) under DMCA, right?

Re:Sony is protected by the DMCA

[Anonymous Brave Guy]

They'd better hope it's them, because if it's us, then it's not circumventing their copy protection scheme to hold down shift while I load the CD, is it?

On the other hand, if it's them and they install software on my PC without my permission in the UK, my lawyer would like to talk to them about the Computer Misuse Act.

Oh dear. This sounds like a lose-lose proposition for Sony. That's really, y'know, too bad and all. :-)

Re:Sony is protected by the DMCA

[laughingcoyote]

I'm not sure what jurisdiction -you're- in, but the last I checked anywhere, those general "not our fault" clauses don't mean a thing against something done intentionally. If you are with full awareness doing something malicious, that is a totally different animal then accidentally releasing bugged software, and "not our fault" won't even begin to protect them.

Re:Sony is protected by the DMCA

[arminw]

....When you put what you think is an audio CD in your CD ROM drive and click on the drive icon,....

On a Mac, when you put an audio CD in the drive, iTunes opens and you get music. If there were some Mac version of a rootkit installer malware on a DRM-ed CD you would get a window asking for a password, but ONLY after clicking on the installer's icon. There is absolutely NO way to install such crap on a Mac by simply clicking on the CD disk icon or merely putting a CD in the drive. Only after giving the admin password would such garbage be able to install. Around here, none of the users know the admin password. I would fault the insecure Windows OS for a) autorunning the software on a CD and b) for allowing users write access to the deepest system internals without the slightest warning or notice. If Windows were more secure, such dastardly exploits would be a lot harder, although not impossible, since stupid users that know the admin password would likely type it in. Still for a commercial company to stoop to such tactics is abominable and probably skirts the edges of the law.

Re:Sony is protected by the DMCA

[zcat_NZ]

Note that Sony don't tell you how to get a GOOD mp3 copy (rip the CDDA tracks using cdex)

They tell you to burn a CD in media player which I expect would taken from the protected WMA files, then use media player to convert it to MP3 which introduces even more quality loss. Not to mention that Windows Media's MP3 encoder is really, really shitty (Intentionally so, because they want to make WMA look good in comparison)

The only reason Sony published this advice is the hope that people will find their advice first, and are less likely to stumble on _better_ advice such as using cdex..

Re:Sony is protected by the DMCA

[plilja]

Actually, many folks misread this section of the DMCA. The DMCA allows an individual to circumvent copy protection for thier own use through the "fair use" provision.

What it prohibits is the disemination of knowlege and tools on how to circumvent copy protection.

Anyone is free to do anything they want to rid themselves of any copy protection on media they own...as long as they keep the knowlege of it entirely to themselves. (There are some exceptions for encryption research and, to a lesser extent security research, as well)

Re:Sony is protected by the DMCA

[Shelled]

Considering the intent of Copyright was a limited short-term monopoly on commercial distribution for the promotoion of Art and Science in society, and not the 'ownership' monster those distributors have created, that's an easy one to answer. In a sane society that is, out here in corporate lobby land it's anyone's guess. I do however find it ironic that a foriegn multinational appears to be protected by law from repurcussion for in effect hacking American computers to 'save the artists.' How far we've traveled.

Re:Sony is protected by the DMCA

[spagetti_code]

I dont think this is right.

He didn't remove the DRM for access to songs.

He removed the DRM from his computer (effectively
a manual uninstall). They did imply in the document that he was allowed to uninstall it.

Re:Sony is protected by the DMCA

[Bastian]

I'm not convinced that removing the rootkit from your computer would be a violation of the DMCA. However, I only read it once, and that was several years ago, and the damn thing is longer and more tangential than a Tolkien book, so I'm not about to go supporting my claims.

The basis of my argument would be that, if you are just taking the rootkit off, it wouldn't be a circumvention of the copy protection, because the rootkit would be reinstalled as soon as the CD is inserted again. Of course, this means that you couldn't remove the rootkit and then someohow prevent it being installed again - you'd have to get rid of the CD.

I think the much hairier question is, is putting one of these Sony DRM-encumbered CDs in a Macintosh a violation of the DMCA?

Re:Sony is protected by the DMCA

[kd5ujz]

Does anyone have a copy of the ULA? I would assume it mentions something about this software, but since no one ( or almost no one) reads the damn thing, sony can mention it, and not worry about people resisting the install.

Re:Sony is protected by the DMCA

[gstoddart]

They don't put it there. You do. They just packaged it for you. If you didn't want to give them permission to run arbitrary executables on your computer, then WHY DID YOU RUN THEIR EXECUTABLE??

See, the problem with this is you did not give them permission. You didn't even run their executable. It happened without your expectation, knowledge, or consent.

You popped in what you thought was a nice little audio CD. Because Microsoft has been configured to run the software on these CDs by default, you end up running it -- that's not permission. When you put in an audio CD, you expect to hear, well, music. Not to have something installed on your computer which compromises its security.

You can't say that someone accepted terms of use when Microsoft, acting in conjunction with these companies, decided that what needs to happen is that any CD with executable code on it needs to be executed blindly and without user confirmation.

For the vast majority of users, playing a CD in their computer is shockingly like playing a CD in their CD player. It is neither a tacit nor an explicit agreement to run any and all software they may have installed on it.

It is a complete mis-representation to claim that you gave permission for them to do anything they wanted to do with it. If I open my door to a solicitor, that doesn't give them the right to enter my home and do anything they damned well please.

This absurbd notion that what is, in effect, trojan software has been accepted by the user simply because they decided to play an audio CD in their computer is complete and utter tripe. And saying that you "should have known better" is a complete cop-out -- we already know that the vast majority of computer users simply lack the knowledge to prevent this sort of thing. Especially when the OS manufacturer has decided a priori for you that is what will happen.

Now, if they put in big honking letters on the CD case that if you play this CD on a Windows machine, software will be installed on your machine, your argument might have merit. But the simple fact that it is NOT spelled out in big font, means that, for all intents and purposes, this is a trojan.

Imagine extending this totally absurd argument to credit cards -- 'by handing your credit card to the waiter to pay your bill, you tacitly agree to paying for the staff trip to Aruba'; Oh, didn't know? How dare you? It's a bullshit argument in either case, because you imply consent where, clearly, none was given.

In either case, you show me where the user has actually agreed to anything, and your point might be valid. Otherwise, it's after-the-fact rationalization based on the absurd notion that the user knew what would happen.

Now, I realize as I'm writing this that your ID lists you as Andrew Tanenbaum -- so I'm forced to conclude one of two things -- 1) It's a popular, but misleading name on Slashdot, or 2) the Great Andrew Tanenbaum has absolutely no clue about what is reasonable for a company to do to the end-users machines. In either case, I'm not impressed. If 2), then you're just a standard Slashdot schmoe, and I expect nothing more, but you're still misinformed. If it truly is 1), then I've lost a great deal of respect for you -- because a professor of this stuff should know better, because you bloody well get paid to be informed about this stuff. Asserting that you somehow gave permission somewhere in that process is utter crap! An agreement I was never shown is null-and-void.

Cheers

Re:Sony is protected by the DMCA

[Alsee]

I don't know why this idea keeps cropping up, and particularly why it got modded to 5. The DMCA most certainly does NOT permit circumvention for Fair Use purposes.

US Law Title 17 section 1201:
Circumvention of copyright protection systems
(a) Violations Regarding Circumvention of Technological Measures.--
(1) (A) No person shall circumvent a technological measure that effectively controls access to a work protected under this title.

The act of circumvention itself is indeed criminalized by the DMCA.

Note that the DMCA also says:
(c) Other Rights, Etc., Not Affected.--(1) Nothing in this section shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use, under this title.

That sounds pretty good, right? Except it's pure bullshit, law literally written by lawyers employed by the publishing industry. It means absolutely ZERO. It says it protects/preserves Fair Use defenses to Copyright Infringment. However CIRCUMVENTION CRIME is not copyright infringment. Circumvention crime has absolutely nothing to do with copyright infringment. There is no Fair Use defence to cricumvention crime. So what that section really says is that a NONEXISTANT defence is not affected. It sure sounded nice though, didn't it?

-

Re:Sony is protected by the DMCA

[Decker-Mage]

For reference, Mark posted the full EULA. Yep, it does have the exclusion but what is even more interesting is the line much earlier. "Once installed, the SOFTWARE will reside on YOUR COMPUTER until removed or deleted." Which is interesting since they went out of their way to insure that you can't uninstall or delete it unless you are a fellow practioner in the Mark Russinovich school of black-belt system administration.

Re:Sony is protected by the DMCA

[coats]

I'll wager you a Coke against a Pepsi that Mark Russinovich's computer was password-protected. Sony deliberately and surreptitiously evaded that password protection to invade and change settings on Mark's computer. Tell me why he should not sue SONY for DMCA violation!

Re:Sony is protected by the DMCA

[Decker-Mage]

This is one time it pays to RTFA as Russ provides you with the details you need to kill the sucker dead without killing your system. Also read the comments as there is some advice their about how to take ownership of the keys that are registered to LOCAL SYSTEM.

Re:Sony is protected by the DMCA

[ObsessiveMathsFreak]

Do I give permission to any software vendor to install anything they want when I run the installer executable?

Pretty much yeah. And according to most EULAs, they can also come to your house, steal everything there, burn what's left, kill your family, poision your cat and still be well within their rights.

If you want an example of what companies can and will do with EULA carte blanc, just read up on the whole Blizzard WoW spyware controversy that Slashdot simply refuses to report on. I guess CmdrTaco is working hard for that custom name!

Re:Sony is protected by the DMCA

[Kjella]

There is no Fair Use defence to cricumvention crime. So what that section really says is that a NONEXISTANT defence is not affected. It sure sounded nice though, didn't it?

In short, what it says is that you can be found guilty of circumvention and not guilty of copyright infringement. It's the paragraph which gives the safe (DRM) far more protection than the contents (copyrighted work). The crime is no longer "copying the contents" it's "breaking into the safe". Here you also see that fair use is not a right - it's an affirmative defense. Technically fair use isn't dead, it still allows for news commentary and other non-copying fair uses. But they gutted 99% of it.

Kjella

Re:Sony is protected by the DMCA

[Sylver Dragon]

Actually, the this fun part is from section 3:
Upon the expiration or termination of this EULA, you shall immediately remove all of the LICENSED MATERIALS from your personal computer system and delete or destroy them, along with any related documentation (and any copies thereof) that you may have received or otherwise may possess

So, pretty much what they want me to do is, if I decide to terminate the agreement I have to re-format my system.

Simple solution

[van der Rohe]

Work hard to make sure that CDs using intrusive and possibly illegal DRM are the ones MOST ACTIVELY distributed via P2P.

This should be done not because "information wants to be free", but rather because businesses who engage in these sorts of practices should be made to fail financially.

When the labels have their annual shareholders luncheon and are forced to show the fancy Powerpoint presentation entitled "Effectiveness of DRM Solutions at Limiting Piracy", the graphs should be embarrassingly skewed in the wrong direction.

The only thing that works is money. So make sure they, and the band, see none.

"The band?! Surely you can't be serious?! They're probably just innocent victims." Bullshit. No one forced them to sign away their souls like whores. It doesn't take a rocket scientist to know that Sony and all others of their kind are customer hostile. Take your music elsewhere. Because that's what I'm doing with my money. And if you're only in it for the money, then you don't get to have any.

Re:Simple solution

[qeveren]

What, you think they'll actually use real data in those Powerpoint presentations to the shareholders? What a strange fantasy world you live in. ;)

See this movie to see why AV is now outdated

[svallarian]

The problem with rootkits is that once you've been infected, there's no way to clean the infection without booting to another OS.

For a great movie showing the author of hacker defender defeating most all of the current rootkit-defeating programs see the following link:
http://www.hxdef.org/download/brilliant.php

Re:See this movie to see why AV is now outdated

[bhtooefr]

And I'm going to follow a link mentioning rootkits that's in the comments on a Slashdot article.

Especially considering I *AM* running Windows.

Yeah, sure.

(If it *IS* safe, though, sorry...)

Answer: This is truly evil

[shanen]

So should I sell all of my Sony stock, or buy more?

Seriously speaking, this shows two things. One is yet another demonstration of the fundamental evil of Microsoft's "security" model. Even if you weren't running as root/Administrator (and everyone does, don't they?), then the "reputable" installation from the "reputable" company would just ask you to elevate your privileges.

The other thing is that power is always abused. If not now and by Sony, then tomorrow by some other "reputable" company. (Or put on your tin hat and say "Yesterday by the NSA.")

I hope they track this story, and if it is not another misguided /. rumor, I certainly hope that Sony repudiates the technique and the software. Soon.

Then they should apologize.

Then sack the person responsible.

Then sack the person responsible for not sacking the responsible person earlier.

[Infinite loop warning.]

Re:Answer: This is truly evil

[ezzzD55J]

So should I sell all of my Sony stock, or buy more?

Offtopic, but..
If you think a stock will move but don't know in which direction, buy get and put options at the current price. They'll be in the money after any significant stock movement. Called a Long Straddle.

Re:Answer: This is truly evil

[penix1]

"As always the weakest link in security is usually the interface between the chair and the keyboard."

This goes for *nix just as much as any other OS. Microsoft just makes it easier and more lethal. I help loads of people making the "switch" and their biggest beef until recently was that it didn't have autorun. What happened recently? You guessed it! Most distors instituted automount/autorun.

As to this topic, any program that is NOT specifically run by the user is by default not agreed to. Just ask the spyware folk who just recently lost a case (can't recall where but it was covered by /.)

The US Congress / Courts are so busy protecting the rights of corporations they have completely forgotten the rights of people. It is a sad commentary on the times we live in.

B.

Re:Answer: This is truly evil

[Grym]

So should I sell all of my Sony stock, or buy more?

It was only after I wrote a scathing response that I realized that you were joking. And yet, for that I think I can be forgiven because I can't help but think that some people, upon hearing about this, were asking themselves just that question.

Sometimes the acerbity of feeling like the only sane man left in an insane world rushes over me when I see how people treat and speak of the stock market. It's not some game to be played. It's not some magical money generator without cause or consequence. And just in case anyone had forgotten, we always have moral obligations to one another--even in situations of diffused responsibility (yes, this includes investing).

But more importantly:
What ever happened about being proud of how you got your money and where you spent it?
What ever happened to doing the right thing--even if it didn't maximize our individual profits?
What ever happened to our dignity?

-Grym

Re:FTA

[ScytheBlade1]

This guy is without a doubt, one of the most knowledgable about the internals of ANY Microsoft OS. He (and his company) have written more top-notch, high grade software than any other company out there (for purposes of exploring just what is on your computer, remote administration, and "peeking under the hood").

On top of that, a majority of their tools are completly free, light, and do the job WELL.

They have tools made to defragment your registry hives, to actually execute a process as another user (don't mention "runas", their stuff takes it to another level), monitor the registry hives for changes, and this disturbingly well-done root kit revealer.

Sysinternals is god when it comes to actually looking at what is wrong with a MS OS, and there's no way around it.

Re:But...

[lord_rob the only on]

This is an audio CD but It's not a CD-audio though, this is just a CD-ROM with DRM'ed audio data on it. This means if I've understood correctly that you cannot even play this CD in your hifi, only on your computer, and only if it's running Windows.

And i also don't understand, to quote you, "Why anyone would purchase a CD under those terms to begin with ?". A possible reason is "by mistake". People aren't careful enough and then buy those copy protected "audio-CDs", then later complain the CD doesn't play correctly on their car CD player, if it plays at all.

I have also been tricked into buying copy protected CDs, not much but still too much. Now when I consider buying a CD, I'm very careful not to buy that crap. If everybody does the same, majors will see immediately the impact of DRM on their sales and stop using it. It has worked for me. I was buying every releases of "Solid Sounds", a belgian techno compilation. I stopped buying thoses CD when they introduced a copy protection mechaninsm. I suppose I wasn't the only one to do that because later they stopped protecting their CDs.

I know, I'm going slightly off-topic here but this kind of attitude from big companies that earn way too much money really disgusts me.

Britain's Computer Misuse Act...

[jd]

...could probably be used in this way, for this software. The program was unquestionably not authorized by the user, as it is not declared in the EULA. As there is no apparent (yet) "Phone Home" capability, it would not violate the Data Protection Act. It might violate tresspass/break-and-entry laws, as the only reason the hacker of Prince Philip's e-mail account escaped conviction was that a transient tool was not considered a lockpick. This is a permanent tool that permits repeated intrusion, so I would guess the courts would be more sympathetic to the argument that it was breaking and entering. IANAL, but most people in computing in Britain have covered the DPA and CMA to some degree, because these are things IT people need to be careful of. It is possible - though unlikely - that the EU could also prosecute Sony over this, as it may infringe on privacy and computer protection laws in Europe. It's very doubtful the EU would take such action - they barely took any action against Microsoft for anything it did - but if Sony or other companies agravate the situation enough, there ARE elections in Italy coming up and the ruling elite there could do with someone to victimize.

America - well, there's no privacy in the US of A. The trade in personal information is open and widespread. There is an excellent chance that if anyone tried to prosecute Sony over privacy infringements that it would be laughed out of court. You can't protect what you don't have. Posession is 9/10ths of the law, and Americans posess very little - much as they often like to believe otherwise.

Sony actually has a much stronger case. Reverse-engineering their DRM scheme is in direct violation of both the letter AND the spirit of the DMCA, which is explicitly intended to prohibit exactly this kind of research (ie: the study of the spyware) and this kind of result (ie: the removal of it, afterwards). Depending on who Sony licensed the rootkit from, there is a possibility it might also violate aspects of the PATRIOT act. (If the rootkit is also used by any law enforcement groups, then this study could compromise wiretapping provisions in the act.)

Re:Britain's Computer Misuse Act...

[Tony Hoyle]

The computer misuse act makes the unauthorised alteration of computer data a criminal offence... that's the whole anti-hacking bit that has been used to prosecute a few teenagers (and scare a few thousand others).

Since I did *not* authorize Sony to install a rootkit (authorisation to play a CD won't stretch that far) they have broken the law, and should be prosecuted.

Luckily we have corporate legal liability in this country too...

Re:Britain's Computer Misuse Act...

[irw]

the Computer Misuse Act 1990 has three charges:

1. unauthorised access
2. unauthorised access with intent to commit or facilitate commission of further offences [my emphasis]
3. unauthorised modification

therefore, if the rootkit opens back doors, or makes it possible to hide programs, charge #2 applies.

This house is...

[m0nstr42]

... CLEAN.

If it's a commercial rootkit

[doodlelogic]

do they do a mac or linux version?

Incentivising Piracy

[SpecBear]

My refrain to the copyright holders: The people being hurt by this DRM software are people who have already communicated their intent to do the right thing by purchasing the CD. Sony has just guaranteed that a lot of people will never make that mistake again.

Welcome to a Brave New World: People who pay for their music get viruses, while people who download it at no cost from illegal sources get clean MP3s that they can freely copy and use on whatever devices they own.

Windows Vista is a start towards this

[Solr_Flare]

I don't know the full details as I'm not beta testing Vista, but I do know that Vista has some protections like this in it. This is in large part why MS talks about Vista being much more "secure" than past windows releases. A good example of this is is device drivers. As started in this article(a Q&A with the head of ATI's driver team):

http://hardwarefanatics.com/modules.php?name=News& file=article&sid=6

"Vista requires a brand new driver model. It is actually called WDDM (Windows Vista Device Driver Model). Whereas before, device drivers were something called kernel mode based, they are now user mode based. This means that drivers do not directly talk to the operating system and have the ability to crash it. The end result will be greatly improved stability for devices on Vista. The amount of work to support the new driver model is tremendous. It is basically a re-write of the entire driver. However, we are very much ahead of the game, and feel good that we will have the best Vista support when it is actually released (and even sooner with our beta drops)."

Re:It is NOT a rootkit

[rpdillon]

As I said above, any software that patches the kernel's system service table to redirect system calls to trojan software without permission while hiding (and making itself impossible for your average user to remove) is a rootkit. It only makes it worse that it *never stops running* and *starts up even in safe mode*. These are all hallmarks of a rootkit. Just because it doesn't send spam and all your passwords/credit card numbers to a server in Russia doesn't mean it isn't a rootkit.

Labels simply don't get it.

[iSeal]

What's supposed to be the logic behind this move? Curb piracy?

And its in that respect that record companies simply don't get it. First of all, they're completely punishing their fans for purchasing their product. After all, how do these CD protections benefit the consumer in any way? The only thing that results is more nuissance for that consumer - thanks to Sony's protection, they aren't able to put the music they bought on an MP3 player for instance. They aren't able to put the MP3s on their computer so that they can listen it from there.

Do they not realise that people use their computers for music these days? Nearly every student I know has some kind of MP3 jukebox set on their machines, where they shift songs between their entire music collection. The companies have been operating on a basis that their products should not be compatible with computers at all, going so far as deceivingly installing these virus-like programs. They think that that will reduce piracy. Fact is: it hasn't, nor will it ever.

As the old addage goes: where there's a will, there's a way. And I've yet to see a CD where its contents could not be ripped. So this does not curb piracy in any way - meanwhile, it makes the CDs less appealing to the fans. Why spend $20 on a product that only half-works? A product that behaves like a computer worm and installs a rootkit?

Piracy doesn't exist because people can do with their CDs as they see fit. It exists because people are getting fooked around by the record industries left, right, and center. Infecting PCs with worms, preventing people to listen to music they legitimately purchased, are hardly steps forward to make the CD format more appealing.

The record labels simply do not get it.

Required removal?

[whoever57]

From the EULA:

Upon the expiration or termination of this EULA, you shall immediately remove all of the LICENSED MATERIALS from your personal computer system and delete or destroy them, along with any related documentation (and any copies thereof) that you may have received or otherwise may possess.

So now Sony has you in the unenviable position of not being able to uninstall the software that you agreed already to uninstall.....

Re:Wouldn't happen if you dont run MainstreamOS.

[spaceyhackerlady]

Want to stop this nonsense from happening in the future? Actually run a non-mainstream OS. That shouldn't be hard for most of the visitors of this website, shouldn't it?

Indeed. I've actually been a little disappointed with the DRM on CDs. When I put them in my Linux boxes they just play. I can rip to MP3 until the cows come home. No problem.

I actually wanted one to fail so I could see how it was failing and maybe do something about it. Contribute something to the community, ya know.

...laura, not a U.S. resident, not covered by the DMCA

Re:What is it exactly?

[John Hasler]

There is no way to audit the code for security, it is probably illegal under the DMCA to disassemble and fully analyze DRM code in sufficient detail for a full code audit

You really ought to actually read the DMCA some time. There is a specific exemption for this sort of thing.

Re:What is it exactly?

[sakusha]

Yes, I've read the DMCA. The specific clause about security testing is rather vague. It allows security testing, but only up to a point of "infringement" (whatever that means). This hasn't been tested in court AFAIK but even prominent security researchers are afraid of it. The way I read it (IANAL) is that you can security test it up to the point where you disassemble it enough to discover how to break the DRM, and ANY code audit that could find security holes would cross that line.

iTunes Australia and Japan

[Anonymous Coward]

Sony still hasn't agreed to come on board with iTunes, which I find damn annoying. Everytime I search for an artist and don't find them (considering they're a big artist), I go and search for that artists publisher.. and what do ya know, always sony.

I'm really starting to hate that company. This BS "DRM" is just the icing on the cake. Sure, iTunes has DRM, but it's quite benign (5 computers, unlimited ipods, unlimited burns per song, 7 burns per album).

They're too big, and have their hands in too many pots. Time for Sony artists to take a stand and go with somebody else (quite difficult, considering the ass-raping contracts they probably had to sign). Essentially, Sony are denying their artists a source of income to satisfy the needs of their consumer electronics department. I'd be pissed.

the big guys take punches like candy...

[DigitalEntropy]

... the little guys are more likely to crumble. Why not target the source of this crap? I did. Though, admittedly I'm sure SONY keeps their wallets fat enough to ignore us. See below:

===

Mail-To: info@xcp-aurora.com, info@first4internet.co.uk

Subject: attn: Mathew, Tony, Peter, Nick; re: Extreme displeasure with your XCP product.

To Whom it may concern:

I would like to address the outstanding issue regarding the software your company licensed to SONY BMG here in the United States. This software proposes to be a harmless DRM solution for the corporate customer as a method of protection against malicious users. However, what your software critically FAILS at is conscientiously protecting the end user against exploits of your poorly, shit-house written utilities.
Personally, I'm glad that your nasty parlour tricks were recently exposed by SysInternals.com (http://www.sysinternals.com/blog/2005/10/sony-roo tkits-and-digital-rights.html) for the disreputable practices they are, and for identifying "First 4 Internet" (sounds like a shoddy store-front operation for a bunch of Black Hat rejects) as the company directly responsible for the most vile intrusion my system has ever received. And the fact that your ill-conceived product leaves my system open to additional intrusions of this nature is unforgivable.
May whatever sink-hole from whence you rose quickly swallow you back. You have no right to voilate my computer's integrity. You have no right to scan the contents of my computer. You may have the right to hide in the darkness of Windows' subsystem like cowards, but that does not mean you won't be seen. You have no right to abuse the trust garnered by SONY from the citizens it regularly calls customers (or, perhaps more appropriately, "guinea pigs"). I hope the light of truth sends you roaches scurrying.

With the wretched taste of bile at the back of my throat,

[my name]
[my email addy]

===

Personally, I purchased "The Dead 60s" latest album, and sure enough it had the exact same copy-protection crap as described on sysinternals.com. That article sure shed some light on the behavioral difference in my system since I got that CD (significantly slower start up and execution times on a 1.2 GHz, and constant 5 - 10% CPU usage with almost nothing running). Fuck them. Fuck them right in the ear.

It was stated before, and I'll reinforce it: This kind of DRM ADVOCATES piracy. You are safer without DRM. I intend to zap my Windows machine and go to Debian (as I've been considering, but now have good reason for security purposes), and return this CD by mail to SONY BMG in a thousand tiny pieces, but not before I copy it and distribute out of sheer spite.

Re:the big guys take punches like candy...

[Technician]

return this CD by mail to SONY BMG in a thousand tiny pieces, but not before I copy it and distribute out of sheer spite.

Never admit that publicly. DMCA, RIAA, Evidence, I hope you weren't serious. These are not nice guys to deal with.

If you admit it, do it from a public terminal as an AC.

Re:the big guys take punches like candy...

[DigitalEntropy]

Good point, and in that case I rescind my offer to copy and distribute. The thousand pieces thing is still happening.

Sony is flirting with trouble...

[TiggertheMad]

They don't put it there. You do. They just packaged it for you. If you didn't want to give them permission to run arbitrary executables on your computer, then WHY DID YOU RUN THEIR EXECUTABLE??

IANAL, however, I believe that contracts that are made in bad faith, or with the intent to decieve a particpant are not binding. If this is the case, I think that I wouldn't be hard to argue in a court that you have no obligation to keep Sony's rootkit (by deffinition an illicit and deceptive tool) on your computer. Moreover, you might also be entitled to damages resulting from said 'bad faith' agreement.

Even if my assessment isn't quite correct, it seems to me that it is probably fuzzy enough of a point to invite litigation. If I were a multimillion(billion?) dollar company I wouldn't be the one to test the legal water on something like this.

Re:It is NOT a rootkit

[qeveren]

It indescriminately hides any file beginning with "$sys$". Not just its own files. Any file. Now tell me this isn't a rootkit.

You just helped with my PSP/PS3 decision

[Bodhammer]

Sony, you have gone too far...

No PSP for Christmas!

No PS3 next year!

So you protected a $15 CD by killing ~$700 of hardware purchases plus whatever games I would have purchased.

No wonder your stock sucks and your revenues are down!

Your DRM works, I'm exercising my right not to purchase your products any more!

Re:You just helped with my PSP/PS3 decision

[tciny]

>> Sony, you have gone too far...
>> No PSP for Christmas!
>> No PS3 next year!

Firstly: Sony DADC and Sony Computer Entertainment have barely anything to do with each other apart from the similarity in the name; so that alone is just rediculous.
Apart from that: Do you really think Microsoft is any better than Sony in this respect? Both the PS3 and the XBox360 will rely heavily on their internet connection, meaning that both companies will spy on you just as badly as Valve is doing with PC gamers right now.

Well, well, well...

[RoffleTheWaffle]

Cat's out of the bag now. Congratulations, Sony. You fucked up big time.

I'd like to take this opportunity to dissect the article in question here, to point out just how positively obscene this is. There are a few key points I'd like to highlight that I feel we should all take into consideration.

It would appear that Sony has deliberately begun shipping rootkits with its DRM protected CDs. According to the article - and this is a pretty good definition, by the way - "Rootkits are cloaking technologies that hide files, Registry keys, and other system objects from diagnostic and security software, and they are usually employed by malware attempting to keep their implementation hidden." In a nutshell, this means that the program shipped with the CD in question here - and possibly other Sony CDs - is designed to hide itself and other programs from view. In other words, once installed, it will allow Sony and any other interested party familiar with this particular rootkit to operate programs on a compromised system without the user knowing it.

Let's take a step back here to consider the implications of this. Sony is distributing a rootkit, but what does this have to do with DRM? Well, if you really think about it, it has everything to do with DRM. A DRM program that cannot be seen or easily accessed can operate secretly, monitoring and manipulating the system behind the user's back. Any future DRM software Sony distributes could infiltrate a computer secretly, and burrow deep into the system files of said computer.

According to the article, the rootkit was produced by First 4 Internet. Upon investigating the company itself and the products and services it offers, the author dredged up this lovely little nugget of joy: "... However, the fact that the company sells a technology called XCP made me think that maybe the files I'd found were part of some content protection scheme. I Googled the company name and came across this article, confirming the fact that they have deals with several record companies, including Sony, to implement Digital Rights Management (DRM) software for CDs." That right there should be proof enough that this is no accident, and anything but legitimate DRM. Not only does having a rootkit handy make the DRM difficult to thwart, but also allows it to operate secretly.

Now, you'd think that you could just remove this software, right? Wrong. Dead wrong, as a matter of fact. The author of the article had a hell of a time removing the rootkit, actually, and not only that, at any given time, it was consuming between one and two percent of the CPU's power - a small 'penalty' for even having it. (And any programs it's hiding would also have to leech off the CPU and RAM as well.) As he attempted to remove this shit, he discovered even more about the software: "As I was deleting the driver Registry keys under HKLM\System\CurrentControlSet\Services I noted that they were either configured as boot-start drivers or members of groups listed by name in the HKLM\System\CurrentControlSet\SafeBoot subkeys, which means that they load even in Safe Mode, making system recovery extremely difficult if any of them have a bug that prevents the system from booting." Suddenly, this is more than a performance issue. This software could theoretically disable a system should it break or be manipulated by the software it's hiding. It would appear, however, it is possible to remove, but only after eviscerating a handful of driver files, registry entries and keys, and other lovely goodies from your system. The rootkit and the DRM attached to it do not have an uninstaller, and unless you take the same steps the author took to remove this flaming pile of garbage from your system... Well, he puts it pretty well:

"The entire experience was frustrating and irritating. Not only had Sony put software on my system that uses techniques commonly used by malware to mask its presence, the software is poorly written and provides no means for uninstall. Worse, most users that stumble across the cloaked files wit

Re:Alternative OS users

[Tony Hoyle]

What we *can* do is write a detector (only takes one of use) and hopefully a remover. Distribute it widely. Make it plain where this malware came from too... the non-technical will soon understand that playing a Sony CD will break their computer - that's all the knowledge they need.

this is illegal under Minnesota law

[swschrad]

it's a 5/$5000 penalty, class C felony, to knowingly distribute harmful software to a PC in Minnesota. 1992 law, I believe it was. demonstrating this is a rootkit is prima facie evidence that this would be harmful software.

somebody with means should get a case opened....

Re:this is illegal under Minnesota law

[Reziac]

If it's a felony, file charges with your local district attorney, and let the DA's office take it from there (you may be called as a witness, but you don't have to defend yourself or hire a lawyer, tho doing so might not hurt). Criminal prosecutions aren't like a civil suits, where you have to finance the operation yourself. In criminal cases, your tax dollars have already funded it, and the other guy is on the defensive by default.

Interesting thought: what if, propelled by enough such prosecutions, DRM alone became grounds for "reasonable suspicion of criminal activity"??

Legal Precedent in other forms

[istartedi]

If I kill you to prevent you from killing me, killing you is self defense and not a crime. Seems reasonable that if I kill Sony's process to prevent it from stealing my ID that it's self defense and not a crime. The DMCA is one of those laws that is so out of whack, nevermind the US Constitution. It probably violates Brittish common law, the Magna Carta, and if you look hard enough it probably violates the code of Hammurabai and the social order of primitive hunter-gatherer cultures too.

Damn, I thought I was first

[muzzy]

I thought I was ahead of time, when I implemented a rootkit DRM just a few days ago. My rootkit is a part of my project, trying to show how malware and DRM systems can get really close to each others, and both get protected by law. Under EU Copyright Directive, it's going to be illegal to remove this rootkit.

You can read about my copyright projects here:
http://muzzy.net/files/copyright_projects_en.txt

Wait wait WAIT

[Pichu0102]

Norton actually REMOVES viruses?!
The sounds like something the National Enquirer would do a story on. "Norton Actually Removes Viruses instead of just showing you you're infected!"

Not on my portion of the Internet

[xixax]

And just how is such a device going to reach the Internet?

iptables -A INPUT --mac-source XX:XX:XX:XX:XX: -j DROP

And they can hardly send in the storm troopers based on this sort of evidence, "Midunno, the house got hit by lightning, maybe that screwed it up? I can't show you the device, it was broken so I threw it out".

That would also make for a nasty payload for a Windows virus. Not only does your DVD player get turned into a paperweight, the victim might also get raided by the DRM police.

Xix.

Re:Not on my portion of the Internet

[Kjella]

And just how is such a device going to reach the Internet?

Good question. Because without Internet access to renew its keys it will simply stop working. Welcome to the DRM future.

Re:Not on my portion of the Internet

[xtracto]

Just a little thought.

I am sure that "call home" approach of the Blue Ray players will not be a problem.

I remember wonce I downloaded a crack for a program which protection mechanism consisted in a key validation. To validate the key the program sent it to the company servers.

I thought the crack was really awesome as it simulated the actual company server and you only had to tell the program you where using a "proxy" to connect to internet and point it to 127.0.0.1:XXXX. While running the crack program.

When the program tried to connect to the server to validate your key, the crack program responded saying the key was valid.

Once I did some cracks for some programs (just for education), never released anything. But I learned the different "levels" of cracks, being this crack one of the finest and cleanest one.

I am sure, after the Blu-Disk or HD-DVD PC drives come into the market, those kind of hacks will become available. It is just a mather of time.

If you think that encryption could stop this approach I am sure not, it is just a matter of "brute forcing" the keys in the messages that go through the localhost connection.

Neat uh?

The feedback I sent to Sony

[keraneuology]

Dear Sony Regarding the rootkit you are attempting to install on the computers of customers who purchase Van Zant's "Get Right with the Man": my relationship with you is over. I will never again purchase -any- CD from Sony Music. Period. Your intentional introduction of security holes and your undisclosed modification of the operating system is simply unacceptable and uncalled for. Your application of excessive, intrusive and unreasonable DRM has ensured that I will -never- purchase any work with the Sony logo. The number of pirated copies this prevents me from downloading or sharing? Zero - I don't pirate. I don't give people copies of my music. The number of future dollars your DRM (which is sure to be broken within weeks anyway) has cost your company? Beyond calculation: my life expectancy has me sticking around - NOT buying Sony music, by the way - for decades to come. Was this worth the trade? If you want my business then I demand nothing short of full public disclosure, an appology, and the very public firing of the executive who gave the green light to this horrible, horrible concept. Please note that I intend to share this letter with others. With luck they too will refuse to purchase Sony music in the future.

Hmm...

[TX297]

So the RIAA pitched to us last year that illegal music downloads were poorer-quality and that pirates faced "lots and lots" of viruses to wade through.

But now the legitimate users are getting rootkits installed while the pirates can download a DRM-free version of the album? I'd rather take the chance on an illegal download than put something in my computer that I know will install a rootkit on my system.

If Sony's DRM ever gets popular enough (and I hope to god it won't) then what's to stop virus makers using the cloaking abilities of a rootkit ALREADY INSTALLED for nefarious puposes? Sony is bound by their EULA not to collect information, although that EULA mentions nothing of removing the software. Hell, they could even claim under the "reverse engineering" clause of the DMCA that removing it requires disassembly and then sue you.

I really hope this goes to court and Sony gets handed their ass on a platter. Otherwise this will be a real blow to privacy and (even though corporations/government don't care about it any more), fair use.

Stay away from this Sony crap.

What a bunch of losers

[cdrguru]

Let's review here: someone has found a publicly distributed driver that when properly installed on Windows hides files and folders. It may have some additional and yet unknown functionality and may be coupled with a driver which, under the right circumstances, disables access to a CD drive.

Sony is distributing this as part of some larger, possibly effective DRM system for music CDs.

What I see here is an endless amount of whining about how awful this is. You are overlooking the potential of this. The key here is that this is now out in the wild and can be exploited. The contest should be to come up with creative (and possibly destructive) things to do with these drivers when packaged with other software.

The result of this should be interesting. I think the responsiblity for all of this rests with Sony and First 4 Internet, but I would really like to see something creative done with this, such as an ActiveX control that disables the CD drive of anyone who visits a web site. The point is to make as much use of this as possible. Sony has provided the tool, it is now up to everyone to make as much use of this as possible.

Re:What a bunch of losers

[RoffleTheWaffle]

You are an evil, evil man.

You're also hitting the nail right on the head.

This -is- out in the wild. This -is- on other CDs and is almost certainly embedded in other products. It's hard to say how long Sony has been doing this, or how many systems have been compromised by this rootkit, but one thing is certain: they did a horrible job of making sure other programs stay out of it, and chances are the damage is already very widespread.

According to the article, any process prefixed with $Sys$ will be hidden. This is so easy to exploit it's not even funny. The author of the article went out of his way to figure out what the rootkit was, where it came from, and how to get rid of it, but what else does this rootkit do besides hide files? Are there other complimentary or supplimentary programs available that already exploit this rootkit not listed in the article? This should be investigated heavily. Once we all figure out the full potential of this rootkit, we'll know the extent of the damage done, and what can be done with this software on machines that have already been compromised.

Hackers will have a field day with this one. It's just too bad that Sony and F41 likely won't be held accountable if their DRM software makes it possible for a highly destructive virus to take advantage of several thousand - if not more - compromised systems here in the U.S. (And worldwide, that number will only grow, of course.)

Props for stating what should be the obvious. The real reason this should be considered 'awful' is because it can blow your machine wide open to attack, over everything else that's horribly wrong with this.

Most likely...

[CupBeEmpty]

I think it's far more likely that Sony knew what this software did, and chose to distribute it anyway. This could have been a result of incompetent testers, poor communication between QA and management, overbearing management anxious to get a product out on a strict deadline, or any number of other things.

It is most likely that this is actually an elaborate ploy to ruin the lives of Van Zant fans by die hard Lynrd Skynrd fans.

Copiable?

[mattr]

This seems to be the copy protection mentioned here where they say Sony BMG will email you instructions on how to defeat the protection if you complain. Also in a comment on that page:

I wrote BMG and asked for the instructions, here's what they said: To get around the DRM you have to install their software so you can access the pre-ripped WMA files they've "generously" provided on the disc. Then you hafta burn the WMA files to yet another CD in order to re-rip them into iTunes.

TFA says drm software required for playing, someone else suggests it can be played through iTunes.

Is this CD playable without the drm software after using cdparanoia or some other tool? SonyBMG is now added to my list of labels not to buy due to copy protection, which previously included ToshibaEMI and Avex Trax for their (cdparanoia breakable) copy protection. In fact I don't buy CDs any more, I just keep a copy of cdparanoia around because sometimes people give me CDs as presents and often they seem to have some kind of copy garbling, erm protection.

Re:Exactly...

[mikiN]

Anything which uses technical means of copy protection is not a CD.

Not true. There is exactly one type of copy protection allowed by the Red Book standard (in fact all implementations have to adhere to its technical specification, whether they enforce it or not), and it is a variant of SCMS.

Basically, SCMS defines whether a source is copy-restricted or not, as well as whether it is an original or a copy. The idea is that anyone can make at most one copy of a copy-restricted original, but not a copy of a copy-restricted copy. See also here.

A distinction was made between consumer-grade (stand-alone) CD copiers (which should always obey SCMS) and professional CD-writers (which were not required to obey SCMS). Strangely, CD-writers attached to computers were treated the same way as professional units (presumably to allow users to copy-restrict their own work).

This strange treatment of computer-attached CD-recorders, combined with most recording software ignoring SCMS altogether in case of direct CD-to-CD copying seems to me the root cause of the current problems with non-conforming copy-protected CD's.

It is an interesting question whether either or both parties are violating the DMCA. I think that either CD-reader/CD-recorder manufacturers should have disallowed ripping of audio-CD's altogether, or they should have output a DRM-ed data format which can only be written to audio-CD's again by software compliant with SCMS.

Microsoft's reaction to this?

[alouts]

Isn't this something that Microsoft should have issues with? Sony isn't just installing its own software, they're overwriting part of the operating system, and in a sloppy manner such that it will prevent Microsoft from releasing patches to those drivers/services...

Although I'm sure they'd be noncommital in their official response, I'd love to hear what they think internally about this kind of thing. If "security" really is their #1 corporate focus as they've been so eager to tell us, this should have them screaming at the top of their lungs.

The chances of us slackers motivating our corporate-owned legislators to smack Sony is comically low, but if we could get a second big player in there on our behalf, there's a real chance to get this awful idea blackholed like it should be.

Anyone have any high-up connections within the Empire?

this would be some great TV...

[foQ]

I wonder what would happen if somebody brought a small claims court case based on this...

[waves fingers in front of face Wayne's World style]

Judge Judy: So I understand that this man's company facak'ded up your computer? And it cost you 600 meshugena dollars to get it fixed?
Random Dude: Yes, your honor. I bought some lame ass CD that Sony price gouged me for (they have DJs to pay off you know) and when I put it into the CD drive on my Sony laptop, the drive stopped working and the computer didn't function properly. I went to my local Sony authorized dealer to have my computer serviced, but they weren't able to fix it. Since they said it was a software issue and not covered under the warranty, they charged me $200 (they have call centers to outsource you know). So then I was going to reload Windows XP, but my Sony laptop didn't come with the original CD (they have Politicians to bribe you know). So that set me back $400 for a new copy.
JJ: That is unconscionable. What is your side of the story?
Howard Stringer (CEO of Sony): He forgot to mention that we sued his kid brother for having music on the computer.
JJ: You, sir, are below slime. I find for the Plaintiff.

Or if it was on Texas Justice:
Larry Joe Doherty: Hey boy! I hear this guy cost you some mucho dinero 'cause of your computer or something?
[same as above, but with a different end]
LJD: Give that boy his $600! Now come sit in this chair and put this hat on!

The same scenario on Judge Joe Brown:
Joe Brown: I'm from the streets, but I've never heard of this scam. Tell me how it went down.
[yadda yadda from above]
[the judge sticks a shiv in the CEO and then hands the wallet to Random Dude]
JB: Case dismissed.

And on Night Court:
Harold T. Stone: $50 and time served...and Dan will fuck your wife and sister while Bull pulls out your arms and beats you with them.
[the judge disappears in a puff of smoke]

This is GREAT!

[thetaco82]

So you're telling me that if I prepend a file name with "$sys$" it will be nearly undetectable? Finally! An easy and effective way to hide my pr0n. I can't wait to buy this CD

Why does the OP gloss over Windows?

[Burz]

I don't like seeing these summaries and being left to think that my OS X and Linux systems could be compromised, then having to scour the linked article just to be sure.

This is becoming a common occurance on Slashdot: Articles about viruses and other Windows exploits are posted with no hint as to their platform-specific nature. "Systems" are attacked. Is it so difficult to write "Windows systems"?? And then of course, when vulnerabilities of non-MS stuff like Linux are reported, the platform in question is Big News. So on top of vagueness WRT Windows, I get bias. Its like reading the front page of ZDnet.

Please just mention the friggin platform, thank you.

_WHAT_ EULA?!?!

[mrchaotica]

It's SUPPOSED to be a fucking AUDIO CD!!

just to play devil's advocate here for a sec...

[smash]

Whilst I don't like what sony has done here in the slightest, those calling for them to be sued, etc are missing a cruicial (IMHO) piece of information.

I am under *NO DOUBT* whatsoever that Sony will simply point the finger at first4internet, and simply say "We simply contracted them to provide a content protection scheme - we are unaware of the implementation" (or words to that effect). Given that the tech has been sold to several other record companies, I'm pretty sure that's close to the mark as to what actually happened, too.

So, it's first4internet who will take the heat in a criminal case, not Sony, no doubt.

Sony is evil and all, but I don't think it was Sony who was responsible for the way it works...

smash.

No, it's not DRM or a rootkit

[GoatSucker]

This is NGTCB. The submitted obviously hasn't been keeping up with Newspeak. Don't worry, I've already reported them to Minitrue.

Not on Amazon UK

[Martin Spamer]

There is no warning on the Amazon UK site for this CD.

Any rootkit would be clear violation of sections 2 and 3 of the Computer Missuse Act. This Act comes from EU treaty obligations so substantially similar legislation exists throughout Europe. The territorial scope of this Act only requires one of the parties to the offense to be in the UK. So buying this from Amazon UK should cover you even if you dont live in the UK.

Re:This is excellent news!

[Adnans]

So you choose the Master who made all this evil possible? Excellent choice!

-adnans

Added value?

[winchester]

Once again, we see a total lack of understanding on the side of content creators. Instead of providing us with added value, the provide us with hard to remove malware that will cost us, honest customers who bought an actual cd, cpu and memory resources, not to mention possible back doors into our home computers.

In a world where a computer more and more becomes a tool for content creation and is used more and more as a media hub, unfortunately most of the time based on an operating system known for its insecure architecture, this is a very worrying trend.

We see the same thing happening with content creation software. Dongles, challenge-response systems, it is made harder and harder for legitimate users to use the software, while the odd cracker is very capable of evading whatever copy protection or DRM scheme might exist in the software.

Now I am a firm believer that it is quite okay to pay for quality. I am also a firm believer that I should (and I do) pay for the software I use for my content creation (photoshop for my digital darkroom needs, pro tools for my music making needs). But why the hell should I, as a legitimate customer, pay for insane copy protection mechanisms? They do not add value for me, instead they take value away, in terms of storage, CPU cycles and memory.

Why Sony WILL Get Sued!

[ZOverLord]

Here is my 2 Cents on what is so Dangerous that Sony should be sued for it!

When Sony Installed this Root kit according to mark's Sysinternals Blog - http://www.sysinternals.com/blog/

I quote:

I studied the driver's initialization function, confirmed that it patches several functions via the system call table and saw that its cloaking code hides any file, directory, Registry key or process whose name begins with "$sys$".

To verify that I made a copy of Notepad.exe named $sys$notepad.exe and it disappeared from view.

This means that ANYONE who has this ("Sony Root Kit") installed ("And not looking for Root Kits 24/7, The person that found it, Mark, did not even know it was there, and would have not found it had he not been testing the latest version of RootkitRevealer") CANNOT view ANY file, directory, Registry key or process whose name begins with "$sys$" in Windows Explorer or the registry, or process viewer and actually files and directories may not be seen from the command prompt as well, in some cases, I quote from Mark's Blog:

I therefore checked to see if I could examine the files within the hidden directory by opening a command prompt and changing into the hidden directory. Sure enough, I was able to enter and access MOST of the hidden files

From the Sony EULA, the ONLY reference to any software being installed http://www.sysinternals.com/blog/sony-eula.htm I quote:

As soon as you have agreed to be bound by the terms and conditions of the EULA, this CD will automatically install a small proprietary software program (the "SOFTWARE") onto YOUR COMPUTER. The SOFTWARE is intended to protect the audio files embodied on the CD, and it may also facilitate your use of the DIGITAL CONTENT. Once installed, the SOFTWARE will reside on YOUR COMPUTER until removed or deleted. However, the SOFTWARE will not be used at any time to collect any personal information from you, whether stored on YOUR COMPUTER or otherwise

Hmmm, well they just created a BACK-DOOR for anyone who has this root kit of theirs to get ("Personal Information").

Sony even made sure the Root Kit would Load in Safe Mode as well, I quote from Mark's Blog:

As I was deleting the driver Registry keys under HKLM\System\CurrentControlSet\Services I noted that they were either configured as boot-start drivers or members of groups listed by name in the HKLM\System\CurrentControlSet\Control\SafeBoot subkeys, which means that they load even in Safe Mode, making system recovery extremely difficult if any of them have a bug that prevents the system from booting.

For all Practical purposes Sony has disabled ALL protection from Viri, Spyware, Trojans and Root Kits on the computers that installed their Root Kit IF that Malware uses a $sys$ cloak! for the vast majority of Microsoft Windows computer users.

So IF/WHEN someone creates OTHER Root kits, Viri, Trojans, Spyware that uses this $sys$ cloaking ("Installed Courtesy of Sony") and ANY damage is done to a system because of it, who is responsible for said damage?

Any comments?