Slashdot Mirror


Sony Music CD's Contain Mac DRM Software Too

brjndr writes "A MacInTouch poster has found that certain Sony CD's also contain a smaller extra partition for 'enhanced' content. Running one of the applications found within this partition installs kernel extensions containing DRM software by SunnComm. In Sony's defense you're told what is being installed within a EULA which pops up when the program is loaded. Thankfully we all read our EULAs completely."

36 of 399 comments (clear)

  1. Think different... by Space+cowboy · · Score: 5, Interesting

    [See my journal entry for my previous comments on this]

    To summarise: it's impossible to protect against truly clueless users without severely inconveniencing everyone else, but Mac OS X at least lets you know something dodgy is going on (a request for administration rights, just to play a CD, say what ? No *other* CD's needed that!) I guess it helps to have gorms, though...

    THM: It's a difference in attitude. It *does* make a difference.

    Simon

    --
    Physicists get Hadrons!
    1. Re:Think different... by Space+cowboy · · Score: 4, Insightful

      Maybe there ought to be a question when you set up your mac - "rate yourself on a scale of 1-10 on how good you are with computers, and we'll adjust the system alerts accordingly"...

      I'm not *so* sure about the after-a-while thing though - I'm struggling to remember any time I had to type in the sysadmin password when I wasn't installing software. If I equate that action with installing stuff, and all I've done is put a CD in to play the damn thing, I'd be pretty curious as to why... Maybe that's just cynical old me, though...

      Simon

      --
      Physicists get Hadrons!
    2. Re:Think different... by npietraniec · · Score: 5, Informative

      If you use a mac, you'll find that you type in your password far less than you might think you would. I don't do it that often, I don't think I'm that desensitized... I don't do it that often on my linux boxes either. My roommate however tried to set up a non-admin account on his windows computer and found it impossible to get any work done without changing over to admin all the time... Worse yet, things would fail mysteriously without any inidication of what the problem was "why can't I delete my documents on my external harddrive?!?!" He was just complaining about that today.

    3. Re:Think different... by SnowZero · · Score: 4, Insightful

      Maybe there ought to be a question when you set up your mac - "rate yourself on a scale of 1-10 on how good you are with computers, and we'll adjust the system alerts accordingly"...

      You'd have to make it more of a quiz. After all, there's a lot of people that think they know everything but who really don't have a clue (Go to your local computer shop if you don't believe me). It could be pretty funny:

      (1) what does RAM stand for?
      (2) what is 0xF?
      ...

    4. Re:Think different... by ryanr · · Score: 4, Insightful

      I'm struggling to remember any time I had to type in the sysadmin password when I wasn't installing software.

      That's the problem. Clueless mac user is probably expecting to be installing software about then. The CD told them they need a player to see the dancing pigs, for example.

    5. Re:Think different... by ReformedExCon · · Score: 5, Funny

      2) is obviously a fat little squirrel. I like to draw squirrels a little thinner: 1xf

      --
      Jesus saved me from my past. He can save you as well.
    6. Re:Think different... by josephdrivein · · Score: 5, Insightful

      "rate yourself on a scale of 1-10 on how good you are with computers, and we'll adjust the system alerts accordingly"...

      Think what a hell would become the customer support: everytime something happens the system may respond to the user in 10 different ways.

      And if a user logs into another mac (at Internet café, library, university etc..), she well have to know if it's configured for dummies or super-geeks or whatever. I may even add that as she gets used to her mac she will want to try to step to the next level, but the user has to learn again how the system behaves.
      And so on.

      It has been proposed more than once, but I doubt it will be ever implemented, as it is a usability nightmare.

    7. Re:Think different... by tm2b · · Score: 4, Informative

      No, it doesn't.

      You are not often challenged for your password in Mac OS X. The default installation location is /Applications, which is mode 775 (meaning users can create items in the directory, but not alter files owned by someone else, including root). Most installs you simply drag an item into the Applications folder.

      If something's asking you for your password and isn't (a) your security manager wanting to fetch your keychain for a website, or (b) something that should be installing drivers, be very worried and don't type your password until you understand exactly what it's doing. My mother has to type her password so infrequently on Mac OS X that she can never remember what it is.

      Even Microsoft Office is a drag-and-drop-to-install application (as well as being a drag), ferchrisakes.

      (and mods, please mod parent down for using Andrew Tanenbaum's name).

      --
      "It is our blasphemy which has made us great, and will sustain us, and which the gods secretly admire in us." - Zelazny
    8. Re:Think different... by Jezza · · Score: 4, Interesting

      This is very true - very little Windows software can cope like this, now Windows Vista (aka Longhorn) will work like this by default, so I expect LOTS of software to fail for this reason alone. Hopefully once everything get updated for Vista we can run our XP boxes in this mode too (which will be much better.

      Someone was saying that you get so used to typing your admin password on OS X that you just do it as a reflex - that hasn't been my experience. This simple change represents a great improvement over Windows XP.

      In the case of the Sony DRM I think it quite likely that Mac OS X users will find the request for their admin password "odd" - and hopefully a significant number would refuse to give it.

      Of course some will as we all tend to trust "big names", maybe that's the real lesson here - Sony can be as evil/stupid as anyone else. And if you can't trust Sony, who can you trust?

    9. Re:Think different... by @madeus · · Score: 5, Insightful

      That's the problem. Clueless mac user is probably expecting to be installing software about then. The CD told them they need a player to see the dancing pigs, for example.

      You don't need to authenticate to install applications on Mac OS X. Installing applications - like Microsoft Office - involves just dragging the application (or the folder it's in) from the CD into the Applications folder on your hard disk. Even things like Real One Player and Windows Media Player work this way.

      When you do actually get a dialog, Mac OS X also tells you what permissions are being requested on the password dialog (e.g. full admin access, or just permission to modify a specific system setting, etc) as well as which application is requesting the permission. In reality, most of the time people see a dialog in Mac OS X which requires authentication, it's because of an interaction with the OS itself (such as changing a system setting) that the user has just performed.

      If a users sees an Application (including plugins) requesting this sort of permission that should really ring alarm bells. Only things like new drivers (e.g. for that new camera you just bought) should be asking for things like that.

      It's fair to say here is room for some improvement in the dialog in that it should better reflect this (perhaps rasing a more severe looking alert when it's anything other than the OS or bundled Application requesting any sort of privileged access, which explains something along the lines of the previous sentence).

      On the subject, it could do with some means of forgery protection (things like an embedded image in the window have been suggested) so that you can better trust it's an authentic authentication dialog. If your paranoid.

      Technically Windows allows for roughly this sort of behaviour too (that is, you should never need admin permissions to install a regular application) but the large number of badly written installers - combined with the lack of a K.I.S.S. approach in the OS - seem to have conspired to make admin level access madatory for even the most mundane tasks.

      I bet if vendors (and I include both Apple and Microsoft in that) implimented privilage dialogs that were scary and intimidating enough to users (perhaps with a default action of 'deny') 3rd party application developers wouldn't ask for them unless they really needed those permissions.

    10. Re:Think different... by rcs1000 · · Score: 4, Insightful

      So: let me get this straight, you modded the grand parent down. Then you posted a comment. Which automatically removes the moderation.

      Are you feeling OK today? Would you like someone else to help you to moderate?

      (Not me, of course, as by posting I prevent myself from moderating...)

      --
      --- My dad's political betting
  2. Well one clear warning sign... by radicalskeptic · · Score: 4, Insightful

    According to the comments on the linked page, you have to type in your name/password after agreeing to the EULA. This is really non-standard and hopefully will set off alarms in people's heads when they wonder why they have to do that (OS X doesn't ask for your password often). But something tells me most users will just go ahead and give the app free reign anyway. Not that I blame them, you'd expect to be able to trust Sony, a freaking huge "legitimate" corporation for Pete's sake.

    --
    WARNING: If accidentally read, induce vomiting.
  3. bondage by heatdeath · · Score: 4, Funny

    Man, actually buying online music is starting to look more and more like S&M. I can hardly wait 'till they come out with CDs that come with shackles that have to be worn while listening to the CD.

    --
    I'm sorry. The number you have reached is imaginary. Please rotate your phone 90 degrees and try again.
    1. Re:bondage by Mistshadow2k4 · · Score: 5, Funny

      Hey! Even we aren't that cruel. Bondage is fun, this crap isn't. Leave us kinksters out of this, please.

      --
      I dream of a better world... one in which chickens can cross roads without their motives being questioned.
  4. Re:Why yes, I give my admin password out on reques by RzUpAnmsCwrds · · Score: 4, Insightful

    Why yes, I give my admin password out on request!

    You would be amazed at what most users will do for music, porn, wallpapers, or screensavers.

    Mac OS isn't immune to this kind of crapola - at least not for the average user.

  5. Jesus by KingVance · · Score: 4, Insightful

    Boy it seems like sony is just running around pissing everybody off...

    Well, I for one pledge to no longer purchase any sony products. Nor will I buy online music from sony, purchase any games, or watch any sony movies until they stop being overbearing assholes with their stuff.

  6. Illustrates why... by rsborg · · Score: 5, Insightful
    the basic OSX security of "Administrator == sudo rights" as opposed to the Windows approach of "Administrator == anything goes" really does make a difference. In the windows portion, Sony just ignores the user and installs all sorts of crap (using autorun)... but on the Mac side, they have to play nice, or the user will not be "convinced" to enter their password to install the software.

    Who knows how evil the DRM is, once the install is made, but jeebus... talk about an issue of trust (just for the installer)!

    --
    Make sure everyone's vote counts: Verified Voting
  7. Even more thankfully by Have+Blue · · Score: 4, Informative

    Autorun is turned off by default on Macs, and there's never a good reason to turn it on. There's no way this could interfere with the usual insert/launch iTunes/click Rip method most people use.

    1. Re:Even more thankfully by eobanb · · Score: 4, Informative

      Actually, there IS no autorun on Mac OS X.

      --

      Take off every sig. For great justice.

  8. At least this means one good thing... by fitchmicah · · Score: 5, Interesting

    This is a sign that Mac OS X has a large enough userbase for Sony to worry about Mac users stealing music.

  9. Re:Why yes, I give my admin password out on reques by MichaelSmith · · Score: 5, Funny
    should throw up *some* sort of red flag

    A client of mine once got an email instructing telling her that a virus had been installed on her system. She was to immediately locate a file (I think it was COMMAND.COM) and delete it, which would remove the hazard.

    She forwarded it on to me (just in case I needed it, you see) and then sent me a second email because the person who sent her the message had trashed their system, and she thought I was about to do same.

    When it comes to stupidity among users, I will believe anything

  10. Re:Make a fortune by gcatullus · · Score: 4, Interesting

    Reasonable, yes, but legally workable not really, at least according to Sony. The sony eula says you must destroy any and all fair use copies of the music you possess, if you are no longer in possession of the actual cd. What a concept, your car gets robbed, you get cds stolen and then SONY makes you delete any copies you may have. I'd love to see it in court.

  11. Throwing out the baby with the bath water by Anonymous Coward · · Score: 4, Insightful

    So, in effect, your computer is at less risk if you download Sony published music from peer to peer networks than if you try to play your Sony CD on your computer. Where's the value proposition?

  12. Re:Admin Privileges by Bananatree3 · · Score: 5, Insightful
    YOU may not even consider such an idea, but not everyone is so tech-savvy. Think of all the Joe users out there...

    Joe user: What's this I see? I have to enter my password to play a music CD? Oh no biggy, its just a music CD. What harm could it do?

    That is my concern. The average user sees it comes from Sony, a "trustable" company, and doesn't give it a second thought. A very lethal combo
  13. Re:daft... by dorkygeek · · Score: 5, Insightful
    Joe Desktop doesn't care and simply installs whatever malware is needed to listen to the cd.

    --
    Windows is like decaf - it tastes like the real thing, but it won't get you through the day.
  14. autorun by minus_273 · · Score: 4, Informative

    the summary fails to mention that OSX has no autorun. There is no way it can install something behind your back like windows does.

    --
    The war with islam is a war on the beast
    The war on terror is a war for peace
  15. McCarthyism doesn't sound so bad now... by Anonymous Coward · · Score: 5, Interesting

    Why not find the names of the individual programmers who coded these rootkits, and make sure they're unable to ever get a job ever again? It was perfectly reasonable to keep Communist sympathizers out of Hollywood and government when Senator McCarthy went on his crusade -- why not keep DRM sympathizers out of the programming industry? Treat them like shit, refuse to hire them anywhere, and make them unable to ever afford food and shelter ever again without humiliating welfare subsidies.

    Of course, criminals will always hire criminals; a thief will always have a chance at getting hired by the Mafia, so I don't expect this will completely work. Computer companies that have overgrown beyond their event horizon of personal responsibility such as Sony and Microsoft will always be a haven for crooks and guttersnipes. But every responsible company still around should outright refuse to hire anyone who's ever knowingly developed anything related to DRM; conduct background checks on every potential employee's employment history and slam the door in the face of any DRM sympathizer looking for a job.

  16. Linux port? by SnowZero · · Score: 4, Funny

    When can we expect Linux support? I'd like to think that Linux is big enough now to demand proper support from Sony, just like Windows and OSX.

  17. Re:Oh thank God... by tm2b · · Score: 4, Interesting

    Ummm..."Ha ha, it doesn't affect us!" At least, none of us who don't type in the administrator password without understanding why we're doing it.

    Ha ha, only serious. Seriously, this isn't an "any computer" issue. This is an issue with the only "modern" OS that have been specifically engineered to run arbitrary binaries with privileges without challenging the user. It's isn't a matter of Mac OS X or Linux (or VMS or Solaris or SunOS or VM/CMS) being better, it's a matter of Windows being worse .

    This isn't even a matter of Windows' original design, as Dave Cutler's original security model was solid and included a good separation of privileges away from the desktop user, drawing on the last half a century of computing experience. This is a matter of Microsoft Management specifically and intentionally deciding to screw you. They will say it was necessary to make a desktop OS usable by novices - Mac OS X does give the lie to such horseshit (and that is the only place Mac OS X specifically figures in this topic).

    Yes, Sony deserves a lot of the blame. But Microsoft deserves just as much. You can start to "fight this stupidity" by not using Windows.

    --
    "It is our blasphemy which has made us great, and will sustain us, and which the gods secretly admire in us." - Zelazny
  18. Re:Oh thank God... by dreamer-of-rules · · Score: 4, Informative

    Because of OS X default security, even when running as the administrator, you still need to click to run the program, then type in your password. Deceptive, but not really secretive or automatic, thanks to the default Mac security.

    In Windows, you just insert the CD. Maybe into someone else's system when their back is turned. Windows OS trusts external content much more than the user sitting at the desk. "Do me", it says.

    Unfortunately, people are still stupid enough to follow these ludicrous steps. Remember the teddy bear "virus" in Windows? Consisted only of an email, the instructions to delete a standard Windows exe file, and a directive to resend the email to all of your friends.

    PS. Join us... you know you want to. ;)

    --
    Everyone is entitled to his own opinions, but not his own facts.
  19. Sony just lost ~5000 euros by Ripper · · Score: 5, Interesting

    I just renewed my living-room home-entertainment system for almost 5000 euros. The two finalists were a all Sony set vs. Panasonic + Harman Kardon + Infinity. Guess which finalist got my money after reading up on the Sony DRM scheme... Yep, I'm a happy Panasonic+HK+Infinty owner. Added a One-for-All remote and the functionality is pretty much the same as using a complete set from the same vendor.

    And this was definitely the last time I even consider Sony. Forget the new Playstation, if I have to choose from the two bad options M$ vs. Sony my money goes to M$ in this case.

    As big a fan as I am of the Van Zant brothers, I just can't think of buying the album after all this. Luckily it was available without DRM somewhere else. It's a shame for the artists though, they didn't get thei $0.50 or whatever they make per sold CD.

    I know my 5000 doesn't bankrupt Sony but if more of us start voting with our wallets maybe they will realize they can't keep on shafting customers every chance they get.

  20. At first, it seemed like a bad idea... by bennomatic · · Score: 5, Interesting
    ...but maybe Apple's right on the money with their "tamper-resistant software." Forget about hackers and pirates; I don't want $ony taking over my machine.

    It may sound paranoid, but once they start messing with the kernel, you really don't know what they're going to do...

    --
    The CB App. What's your 20?
  21. Re:Memories... by cvdwl · · Score: 5, Interesting
    My original //e had some lame-ass program to "meet the machine", it had routines to deal with typists who cheated by using l's for ones s and o's for zeros...
    Cheated, hell! My first ... TYPEWRITER (yes, mechanical, yes, really, no power cord... no "correction paper", either) ... didn't have a "1" or "0" key, it expected you to use l and O. I remember being confused by this the very first time I tried to type on it.

    I'd really like to get my hands on one of those now. I sort of miss slapping it upside the carriage every time you were finishing a line. And a typo at the end of a page REALLY hurt.

    --
    ... grumble, grumble, grumble, mutter, mutter, Millenium... Hand... Shrimp, I tol' 'em, I tol' 'em.
  22. Re:That's the last Sony CD I ever buy by SnprBoB86 · · Score: 4, Interesting

    Citibank (I think) has a credit card mask generator. You can generate a credit card number for use online and then you tell the credit card company the spending and number of transations limits. You get a safe, one time use credit card number.

    --
    http://brandonbloom.name
  23. As result of this Sony rootkit fiasco... by bluelarva · · Score: 5, Interesting

    Well.. Let see... I will NOT be buying the following:

    1. Sony music CD's
    2. Sony HD TV
    3. Sony Playstation 3 and games
    4. Sony Bluray DVD player
    5. Sony Ericson phones
    6. Sony VAIO laptop
    7. Sony DVD burner
    8. Sony digital camera
    9. Sony video recorder

    The only way Sony will regain my trust is if they were to:

    1. publically admit that what they did was wrong
    2. put a link on sony.com to a page explaining what exactly happened and provide software to uninstall the rootkit
    3. recall all CD's on the shelf containing rootkit DRM
    4. offer replacement CD's to all customers

  24. Affected Titles by bitkari · · Score: 4, Funny

    Trey Anastasio, Shine (Columbia)
    Celine Dion, On ne Change Pas (Epic)
    Neil Diamond, 12 Songs (Columbia)
    Our Lady Peace, Healthy in Paranoid Times (Columbia)
    Chris Botti, To Love Again (Columbia)
    Van Zant, Get Right with the Man (Columbia)
    Switchfoot, Nothing is Sound (Columbia)
    The Coral, The Invisible Invasion (Columbia)
    Acceptance, Phantoms (Columbia)
    Susie Suh, Susie Suh (Epic)
    Amerie, Touch (Columbia)
    Life of Agony, Broken Valley (Epic)
    Horace Silver Quintet, Silver's Blue (Epic Legacy)
    Gerry Mulligan, Jeru (Columbia Legacy)
    Dexter Gordon, Manhattan Symphonie (Columbia Legacy)
    The Bad Plus, Suspicious Activity (Columbia)
    The Dead 60s, The Dead 60s (Epic)
    Dion, The Essential Dion (Columbia Legacy)
    Natasha Bedingfield, Unwritten (Epic)
    Ricky Martin, Life (Columbia)

    from the eff

    Perhaps this DRM is your punishment for listening to Ricky Martin and Celine Dion?