More on Sony's "DRM Rootkit"

A couple of days ago we posted a story about Sony DRM installing a rootkit. Since then we have seen many more stories on the subject that I thought were worth sharing. manno gave us a link to the inquirer and salemnic sent us a page from the washington post. smallfries gave us one from PC Pro. It's nice to see this story not getting lost in the cracks since the implications are gigantic.

Comments

Hope it catches on

[Anonymous Coward]

"infected with DRM"

Love it. Great phrase. Maybe it'll catch on.

Re:Hope it catches on

[gerf]

"Infected with DRM"

Again, I must state that whenever I clean a computer with Adaware/Spybot/AVG/Panda Activescan/CWShredder/ect, I'm now going to have to ask one more thing:

"Have you bought and played any music CDs lately?"

How sad is it that doing something so legal can become associated with other computer slow-downs as spyware/malware/adware. This is what is going to irk the general public, and hopefully get people to look at DRM a bit more closely.

Simple Solution: Boycott Sony to Death

[snotclot]

Ok sure, so boycotting Sony is not realistic. Or is it...? We can really do without them. Screw their stupid DRM'ed Memorysticks, we have our SD and CompactFlash. Screw their VAIO's, we have Dell and Taiwanese laptops.. Screw their TV's, we have better ones from other brands. Screw PS3, we have XBOX2 and Nintendo Revolution. Screw PSP, we have Nintendo DS. Once they get the collective shaft, well, other companies will think twice before pulling shit like this.

Let us hope:

[Winckle]

That this sets a precedent, and that Sony don't wriggle out of this, at the very best it could point out some of the absurdities of the DMCA.

Re:Sue

[voice_of_all_reason]

Based on the grounds that it re-routes the windows instructions on how to play *all* audio CDs. If you remove the DRM by force, you lose the ability to play other music as well.

Contains LAME code?

[Sulka]

Interesting.. Some reports Finnish reader of this news in Sektori.com (in Finnish) reports Contents\GO.EXE file seems to contain parts of the LAME player. Can anyone verify this? Is Sony distributing LGPL software on the CDs?

Sony is losing it

[shanen]

I still stand by my earlier comments on this topic, but at this point it's pretty clear it isn't just a /. rumor. I used to have a lot of respect for Sony, but it's been pretty well dissipated over the years. Their decision to dump PDAs greatly saddened and annoyed me, but I've also had too many problems with their hardware to buy any more... They just couldn't handle the pressure of needing to have ever higher profits and being squeezed between their one low-margin hardware-oriented parts of the company and the high-greed software-oriented parts. Now they've completely trashed their own reputation, and I do feel morally constrained to sell my stock, too.

I guess I'll send them a sharply worded letter first, but I really don't see any way that I can do any business with a company like this. Not even as a shareholder.

Is this necessarily legal?

[hunterx11]

Even if you do agree to give Sony the rights to your first-born child in the EULA, wouldn't this violate laws in some states, such as the Consumer Protection Against Computer Spyware Act in California?

Re:Sue

[LurkerXXX]

There is no way for a normal user to remove the software. It comes with no uninstall program, nor is it listed in the windows add-remove programs.

If you can manage to find the hidden software files and do delete tehm as suggested in the EULA, you will no longer be able to access your CD drive.

Funny how no mention of those points are made in the agreement.

H.R. 2929

[spurtle15]

Has this passed? Is it applicable?

(4) inducing the user to install a computer software component onto the computer or preventing efforts to block installation of a software component;

http://thomas.loc.gov/cgi-bin/bdquery/z?d108:h.r.0 2929:

If they used racketeering laws to go after the RIAA, why not antispyware legislation against this?

Re:Sue

[dangerz]

Sadly, most people don't care anymore.

The other day, I was driving with my fiance when we got on the topic of cd's. She proceeded to tell me that there's this great cd that I need to get because the band is really good. I proceeded to tell her that I haven't purchased a cd for almost 4 years now because of my dislike for the RIAA. After explaining everything to her, she just got all flustered and said that she didn't care about all that crap. She didn't care that even though she paid for the cd, she didn't fully own. She didn't care about all the bully tactics the RIAA uses. She didn't care about any of that, she just wanted the music.

I agree with you that the majority of the people just dont care. As much as I try and inform people of all the crap the RIAA pulls, it just goes in one ear and out the other.

For now, I suppose I'll just continue on with my silent protest.

Re:Yes, this is bad

[Renraku]

People are using Sony's software to violate the ToS of World of Warcraft.

Something that they tried to HIDE on people's computers to RESTRICT them. People are now abusing it against Blizzard. Blizzard has 'just cause' to start a lawsuit.

Other affected CDs

[vmxeo]

I showed the last to one of my coworkers, who immediately started worried about a recent Switchfoot CD he played on his machine. Sure enough, not only did the CD have DRM on it, but it seems to have installed the same rootkit as the example given in the Sysinternals website. Which of course makes me wonder, how many CDs did Sony put this into?

I'm starting to think it'd be worthwhile to create a domain policy to prevent this malware from running on any of our network machines....

My Letter to Sony

[macklin01]

Hello.

I have just learned about the malware that Sony has started to add to "compact disks" (in quotes, because Sony breaks the CD standard) via poorly-written DRM software from First4Internet. It is simply unconscionable that Sony would resort to such unethical lengths to prevent the pirating of a software. In fact, criminal trespass comes to mind, given that the software differs from what is described in the EULA and non-removable.

I'm outraged at this behavior demonstrated by Sony, and I can assure you that I am no longer a Sony customer. In short, although I am a computer enthusiast/technologist who builds his own systems and enjoys gaming, and although I am a scientist who uses high-end computing resources on a daily basis, I won't be purchasing any of the following from Sony in the next few years:

1) Stereos and portable audio equipment
2) Flat screen televisions, plasma TV's, etc
3) High-end computer LCD monitors
4) Laptop computers
5) Computer CD and DVD drives
6) Sony-branded CD, DVD, and floppy disk media
7) PlayStation 2 or 3
8) PlayStation Games
9) PlayStation Portable

and needless to say,

10) Sony and BMG music.

If you break standards on DVD equipment, add Sony and Columbia TriStar movies to that list.

Thank you for making my future purchase decisions so much easier.

Sincerely,

****

Re:Maybe Sony Should Print This On Their CD's....

[Jussi K. Kojootti]

They do... This is their Minimum system requirements for content protected discs:

To listen to the music on this disc, you need a PC with the following minimum system requirements:

• One of the following operating systems: Windows 98SE, ME, 2000 SP4, XP Home or XP Pro
• Pentium II or higher with Windows 98SE, Windows ME
• Pentium III or higher with Windows 2000 SP4, Windows XP Home, Windows XP Pro
• at least 64MB RAM above recommended OS memory level
• CD-ROM/DVD-ROM disc drive
• Internet Explorer 5.0 or higher
• Microsoft DirectX 9.0 or higher with non-Windows XP systems (download)
• Logged in with Administrator rights

.. you need to be root to listen to music. Just amazing.

List of affected CDs?

[Timo_UK]

Is there a list of CDs that are affected, except the one Mark Russinovich used.

Sony in violation of DMCA?

[softcoder]

If SONY circumvents the security I have installed on MY machine with their rootkit are THEY in violation of the DMCA?