Slashdot Mirror
Bad Day To Be Sony
Not only is Sony no longer selling the RootKit CDs, Arend writes "According to a USAToday article, Sony is to pull their controversial rootkit CDs from store shelves." A nice gesture, but a little late. bos writes "Sony's DRM rootkit has been found by Dan Kaminsky to have infected at least half a million networks, according to an article by Quinn Norton for Wired News. Dan has even put together some pretty pictures of the breadth of the infection." With so many people infected, it's unfortunate that wiredog writes "From The Washington Post comes the news that serious security flaws have been found in the software that Sony is distributing to users who want to remove the Sony rootkit. The article says: 'Because of the way the tool is configured ... it allows any Web page that the user subsequently visits to download, install and run any code that it likes.'" Oops. Even Microsoft is getting into the act. ares284 writes "Microsoft said it would remove controversial copy-protection software that CDs from music publisher Sony BMG install on personal computers, deeming it a security risk to PCs running on Windows."
I'm not a "boycott!!!" kind of guy. When I was younger I used to be, but no one ever stuck to it. This "error in judgement" is definitely something that I am adding to my (really small) short list of company-groups I won't buy from. I already won't buy CDs without the "CD" logo. I won't buy Sony TVs or receivers for the last 4 years because of their terrible support policies. I won't buy anything from Menard's either. And now Sony music CDs are permanently out.
How do those who are active boycotters stick to it? Do you actively pursue telling others, or is it just a "one person, one dollar, one vote" kind of life lead?
I could care less if other people want to support Sony artists or Sony products. All mercantilistic (using government to acquire wealth) corporations are bad, but that doesn't mean that every business is bad. Sony has actually been one of the least mercantilistic corporation I've tracked over the years, but their releasing of items without proper quality control is what kills them time and again.
And I believe that is the problem with this rootkit. Sony didn't test it properly. If they had tested it properly and kept it within its own little world on a customer's PC, I don't think the fallout would have been so excessive. They didn't test the product, they relied on the customers to do so. Luckily for Sony, the customers weren't happy and were vocal about it.
That is the free market at work. People unhappy about a company or a product have much more of a voice with the web being so readily available. The more the Internet allows billions of citizens to align on different issues, the more we'll see that a free market "democracy" is better than a democracy built around the use of force.
Vote with your dollars.
Go to http://cp.sonybmg.com/xcp/ or http://cp.sonybmg.com/xcp/english/form14.html
...since Sony says over 2 million disks containing the rootkit have been sold, that puts them under the gun for roughly U.S. $150 billion in damages :)
Where it asks for the Artists name type in some diatribe
Where it asks for the Album Title, type in more diatribe
Where it asks for Store Name, type in yet even more diatribe
Where it asks for email address try something that will cause them trouble such as uce@ftc.gov or some chronic antispammer advocate.
This will hopefully force Sony to make the "patch directly downloadable."
Perhaps the copyright owners could offer to settle: have Sony repay all of the people who have been extorted for money because of filesharing (double for damages), and promise to stop all such activities in the future. That would only run them about $100 million, so it would be quite a deal.
NOt to change your mind or anything, I would like to point out that at Sony's size, the different divisions have little or nothing to do with each other.
So the same people who make decisions for the music products are not the same people who make decisions at the playstation divisions .
From what I hear, there is some pretty intense inside fighting going on between the people who make mop3 players, and the music division.
The Kruger Dunning explains most post on
What a shame that Scott Adams' "Weasel Awards" for 2005 have already been awarded. There's always 2006 I suppose, but this will probably have been long since done and dusted by then... unless it's still churning though legal systems in the US and elsewhere of course.
UNIX? They're not even circumcised! Savages!
"Paging Eliot Spitzer, Paging Eliot Spitzer, Mr. Spitzer white courtesy phone..."
To me the biggest surprise in this saga is that he hasn't been all over this.
... for a political maneuver where you first propose something so outrageous that it's sure to get shot down, and then withdraw the proposal and advance something only slightly less outrageous? Like, let's say Senator Boughtandpaidfor introduces a bill requiring the death penalty for anyone who cracks a copy-protected CD, and when that gets the desired uproar, he says, "Oh, okay, let's compromise and make it fifty years in prison instead" -- and that bill passes because it's more "reasonable."
Which makes me wonder what Sony's got coming next.
The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
Seriously - if some company hires a hitman to do illegal stuff they get in trouble. Why can Sony hack my network without any repercusions.
That's a clear DMCA violation.
If DVD John gets in trouble for less, surely whomever at Microsoft decided to do this should suffer the same.
Was not the software used by Sony written by a UK limited company? Is not the commissioning and construction of such software illegal under UK law? (Computer Misuse Act 1990)
threadeds blog
Let's look at this from the stockholder's point of view, as well as the customer's. If that type of conflict of interest exists between Sony's divisions, then that is telling me that management is *not* maximising shareholder value because the music division is harming the Playstation division by reducing the utility of the Playstation console.
That tells me that the only way to increase shareholder value is to break Sony into at least two companies: the entertainment division and the electronics division. Each division will then float on its own merits without impeding the other.
In a nutshell, we can add Sony's own *shareholders* to the list of people that are getting screwed by the management. My prediction? Look for a shareholder suit against the Board of Directors within 3 years to break Sony into two companies.
Bill Clinton: Pimp we can believe in. - The Shirt!!!
These CDs have been out since mid-2004, according to Sony. Why hasn't this been noticed? Were they all bought off?
This is what really disturbs me. Not "What was Sony thinking?" -- businesses can be really stupid. Not "How could they do this?" -- businesses can be really evil. Shit happens. Get over it. Bad security happens, whatever.
However, I did have some trust (not much, but some) for the anti-malware establishment. I'm in infosec; I believe that even in the biggest and stupidest infosec company, there will be people with the hackerish instincts (i.e. lower-than-average sense of self-preservation) to blow the whistle. However, the failure of all the big anti-whatever companies to notice and/or do anything about this, with full year of lead time, demonstrates that they are incompetent at best, unethical at worst.
I don't care, personally; I use a Mac. It's not a security panacea but it's a pretty darn good line of defense. Professionally, however, I feel downright ill.
Kudos to F-Secure and Sysinternals. Where the hell were the rest of them?
What I say does not represent the views of my employers, my friends, my cats, or myself.
I used to work at Sony back in the UK. The divisions are set up semi-autonomously, the thinking being that competition is good for innovation. Problem is, anything you think of that slightly invades the 'territory' of a more politically powerful division will be denied funding or just cancelled without explanation.
Bitter? Why yes I am, thank you for asking.
I worked project support for a great team of engineers who had some amazing ideas way ahead of their time. Can they use PS2 hardware? Write DVD related software? Other video related stuff? Nope. All because of inter-division competition. (I was intentionally vague on the those project descriptions) Then there's the snobby attitude towards software; once a project I worked on was forced to use a very expensive piece of hardware to do something they were already doing in software. Quelle Suprise, Sony couldn't sell the software and eventually the project was canned.
I really can't believe Sony has survived into the 21st century.
----- Documentation is worth it just to be able to answer all your mail with 'RTFM' - Alan Cox.
Did anyone look at some of the titles they chose to infect with this thing?
Bob Brookmeyer - Bob Brookmeyer & Friends
Horace Silver - Silver?s Blue
Dexter Gordon - Manhattan Symphonie
Ahmed Jamal - The Legendary Okeh and Epic Recordings
Bob Brookmeyer???? Was Sony afraid of the cadre of L33t h4xx0r d00dz pirating their catalog of elderly jazz trombonists?
All I can say is I am in the know with regard to such matters and you are so amazingly wrong it is unbelieveable. There may be EXTREMELY isolated cases of such Machiavellian security measures, but it has been my experience that music CDs are always making it into secured areas and being played on secure machines.
This guy is NOT a troll. He is far more correct than the GP is.
Personally I buy as straight from the artist as I can.
Buy your music from allofmp3.com, then send an envelope with three or four dollars in it to the band. Join the fan club or whatever. Can there be a better way? Look at all of the benefits:
Really, the only downside is the possibility that you're supporting criminals in Russia. But the other alternatives are supporting criminals in LA, or not buying music at all. And the Russian criminals in question seem to be very fair businessmen. I was impressed to see that when they tell you you're paying two cents per MB, they in fact charge you exactly $.02 for every 1,048,576 (2^20) bytes, and they calculate it to the tenth of a penny and don't deduct it until you've successfully completed the download.
or blah, blah, blah.
It's been over ten years since i've been in that business, but i'd be seriously surprised if there were locally mountable devices, or even ports (USB, etc) on TS machines. We had no floppy drives and removable hard drives in our Secret machines, plus they were all tempest hardened, plus in lockable cabinets (those who know, know what i mean). We only had a few areas where we could even work on TS docs, much less create them from scratch. Having a CD drive (even read only) seems like something a security officer would have jumped on as a "duh" very early on in any project. If you needed a CD it would be mounted as a share to a server in the "vault" and you would be granted access to it for the time you needed it. No personal electrical devices were allowed in any way, shape, or form so no radios, CD players, etc.
I suppose if a contractor was lax this could all take place, someone could use the document blender to make margaritas, but in my experience there was no way to just pop in some disk or attach a device. I mean we didn't even have printers! They were locked up in the vault also and you had to sign for the number of pages you printed! This was just a SECRET rated facility (o.k., Secret with SAR, I'll give you that much). So be realistic. I could take CDs in all day long but they were only good as drink coasters.
It's an even worse day to be Sony, in the UK. Today's newspapers have headlines like "Sony accused of Internet rip-off" and "End to online bargains as Sony forces prices higher".
, 00.html
According to The Times, "the practice of charging different prices to Internet retailers and high street stockists -- known as dual pricing -- was started by Sony and has been followed by other manufacturers." Here's the article:
http://www.timesonline.co.uk/article/0,,2-1872549
I wonder if the backlash will be enough for all artists to do what the Flecktones did:
"Frustrated when he bought a copy-protected Dave Matthews release and couldn't copy it to his Apple iPod, Fleck insisted that Sony not release his new album with such restrictions"
.. paranoid crackpot leftover from the days of Amiga.
I would like to point out that at Sony's size, the different divisions have little or nothing to do with each other.
Irrelevant.
Not that the people working in the other divisions, who didn't make such stupid decisions, deserve to be punished, but the way to stop companies from doing crap like this is to hit them where it will hurt the top-level decisionmakers: their stock price. To do that, you have to damage their profits, and the best way to do *that* is to decrease their revenues by not buying their stuff. If Sony's stock takes a 20% drop as a result of some decisions by the entertainment division, the C-level execs will take action, and if they don't then the board of directors will, and if *they* don't, the stockholders will. If it gets nasty enough, no one in Sony will ever again dare to do something that has even the remotest possibility of bringing that sort of shitstorm down on their heads.
Not that I believe a lot of "boycott Sony" shouting and posturing on slashdot will really affect their revenues noticeably, much less their stock price. But still, the theory is sound, even if follow-through is insufficiently widespread to make any difference.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Last I checked the PS3 is going to ship with Blu-Ray which is filled with its own DRM restrictions, so essentially his "broad generalization" is fairly accurate IMO.
No sig for you!!
I just sent this comment to Amazon...
This product violates Amazon.com's policies.
"Items that infringe upon an individual's privacy. Amazon.com holds personal privacy in the highest regard. Therefore, items that infringe upon, or have potential to infringe upon, an individual's privacy are prohibited. Additionally, the sale of marketing lists (bulk e-mail lists, direct-mail marketing lists, etc.) is prohibited."
Sony'd DRM rootkit violates my privacy by "phoning home" to report on my computer's usage. These products should be banned from further sale, imediately!
:q! Oh crap, not again...
3 words
HD-DVD vs. Blue-Ray
Why else would Microsoft violate copyright law when they're already in Anti-trust hot water? Because it makes them look like friggen Angels when compared to Sony. With people boycotting sony product, and two different data formats pending, HD-DVD, from the company that doesn't put a rootkit on your PC is going to be a much more appealing bet.
Shots: A Populist Parable
I'm sure there are people who post on Slashdot who really have worked in facilities doing classified work. Hell the guy who sits across from me at work was cleard TS/SCI when he was in teh Ariforce years ago, and one of our student employees actually has active secret clearence for his internship.
However, for every person on here who legitmately knwos what they are talking about, you have someone who's just making shit up. They want to appear "in the know" and believe they really know how it is, because they heard a story somewhere or something like that. However in the retelling, they pretend like it was them, because of course it makes them seem to be more knowledgable on the topic.
I've had lots of people tell me how things work in regards to secret data, however most of the people doing the telling, I know for a fact have never worked in such a facility. So what they are saying may be based entirely on fiction.
As always, take what you hear on Slashdot with a grain of salt.
This type of tactic that was used with this virus ware is nothing new for Sony. It wasn't a simple mistake or an accident or simple bad judgment. Sony has a long history of this type of strong arm tactics in almost every branch of the company. Another example in particular is the SOE entertainment branch that runs Everquest and Everquest 2. Throughout the game of Everquest Sony placed spyware on machines in a form that captured user specifics about their computers, connections, and names, credit card information and other personal data. When confronted about this collection of information on the Everquest players they quickly turned tail and ran into the legal jungle of vague response and said it was needed to properly manage the game environment and accounts. This of course was complete garbage. It was a campaign to collect, sell and profit from this data. To this day that data collection continues according to the very EULA they force you to agree too in order to play any of the games they now operate. Not only did Sony collect data and lie about its purpose but they also actively engaged tactics to force players into huge fees to simply be able to allow the players to be able to sell the very software they had already purchased. This is just one of more then 20 easy to find examples of Sony's business model that exploits abuses and damages the public's security, welfare and privacy.
Karma: a simple way of silencing those with unpopular views regardless how correct or just that view might be.
Have they publicly acknowledged they did wrong?
Have they fired the executive who approved this idiocy?
Sony will need to do this if they ever want my business, my family's business, or my employer's business again. And this includes EVERYTHING SONY.
Why should a corporation who does this to their customers, have customers?
I'm all for MS removing the rootkit, but doesn't Sony now have grounds to go after anyone that makes a tool to remove this under the DMCA? I suppose they could waive rights to it or such... I'm kind of hoping they do so that DMCA proponents can watch in horror as the worst of all possibilities come to fruition. Perhaps we can then look at getting rid of that legislative piece of trash.
Why shoudln't the same rules applied to black hat hackers who compromise and exploit the security of systems be applied towards sony executives? They should really make an example out of these guys so that other corporations and even spyware makers won't attempt anything like this EVER AGAIN.
http://www.awwsheezy.com