Slashdot Mirror
DVD Jon's Code In Sony Rootkit?
An anonymous reader writes "With some help from Sabre Security, Sebastian Porst and Matti Nikki have identified some stolen GPL'd code in Sony's rootkit. Ironically the code in question seems to be VLC's demux/mp4/drms.c -- the de-DRMS code which circumvents Apple's DRM, written by 'DVD' Jon Lech Johansen and Sam Hocevar."
This is GPL'd code, not LGPL'd, right?
Anyway, DVD John can actually sue Sony for all *revenue* that Sony made from the sale of the CDs, if I'm not mistaken (not just profits). That would grab them where it hurts!
"I have never let my schooling interfere with my education." - Mark Twain
I said right off the bat, that the Sony DRM package would be full of other's code. Seems to me that Sony hired some blackhats to get the job done for them. Violating the GPL is definitely the least of their worries, but just another strike against what is becoming an increasingly corrupt music giant.
Read the only personal Runyon page out there.
Sony ought to be in some severely deep shit here. Of course they're a corporation, so they're mostly above the law, but we should still be able to get something to stick.
Real Daleks don't climb stairs - they level the building.
This story get's weirder by the minute.
Though it wouldn't happen in a million years, I'd like to think this will bring Sony to it's knees. It won't, but someone can dream.
Not that I had anything against Sony in the first place, but since this crap they threw out there and expected everyone to just "take it", they need to be slapped and slapped often.
They haven't even apologized yet. At least I haven't seen it. Though just saying "sorry" doesn't cut it anymore as thousands of computers are now vulnerable in the world due to their greed.
"Leo Fender was in a 'state of grace' when he designed the Stratocaster." -- Paul Reed Smith
Not quite true -- Sony is "distributing" the software as defined by the GPL. Moreover, the work was preformed by First4Internet as agents of Sony. These both seem to indicate they are liable. On the DMCA side, they are "trafficking" in an anti-circumvention device (assuming the software does actually activate the codepath in question).
That's completely retarded. The people responsible for the PS3 most likely have absolutely nothing to do with any of this. You might as well boycott all companies based in Japan since Sony is based in Japan. Or better yet, boycott all companies everywhere since buying anything could potentially improve the economy, which would help out Sony.
3.(1) A person is guilty of an offence if
(a) he does any act which causes an unauthorised modification of the contents of any computer; and
(b) at the time when he does the act he has the requisite intent and the requisite knowledge.
(2) For the purposes of subsection (1)(b) above the requisite intent is an intent to cause a modification of the contents of any computer and by so doing
(a) to impair the operation of any computer;
(b) to prevent or hinder access to any program or data held in any computer; or
(c) to impair the operation of any such program or the reliability of any such data.
I think First4Internet's little toy is designed to prevent or hinder access to programs and data held in a computer, don't you? And I really doubt that their click-through EULA constitutes authorisation to do so; it was fraudulently claimed that the Software was necessary to play the music, which was a plain lie as is shown by every Linux and Apple machine that plays it just fine without the rootkit installed.
I might add that even though these discs are not available in the UK, the Computer Misuse Act still holds.
Anyone know if we could possibly get Inspector Knacker to take a look at these felonious fellows?
Real Daleks don't climb stairs - they level the building.
If I were Jon, I'd see this as a simple question of aquiring legal immunity. When Sony (a member of RIAA) knows that they're going to face a multi-million dollar lawsuit the very minute the RIAA trespasses onto him again, they'll make sure that it won't happen. Jon can live forever happily in the knowledge that he can code whatever the hell pleases him, and Sony gets to walk away (somewhat) unblemished.
It's as if the First4Internet purposely created the most vile collection of stolen snippets and sold it to Sony. How much did they get paid for this poison pill? They may have done it on purpose. Is it malice or incompetence?
laughing my ass off. I am sitting at work reading this and busting out in laughter. Granted, I can't explain this idiocy to near anybody at work and it's a totally 'nerd' joke, but you know what... it's DAMN funny!
The price is always right if someone else is paying.
So I looked through the links and while one of the discoverers made it quite clear that the LAME code is not being used as data (never refereced). However, it was unclear to me if that was true for the DVD Jon code.
I mean the DVD john code seems like exactly the sort of thing one might want to search for on someone's computer to stop pirating. If indeed it is used only to identify the code it may be covered under fair use. It's an interesting legal question that I vaguely remember came up in virus/worm/spyware cases. Namely can a malware writter use some kind of simple code modification method to foul up simple hashes and then insist his copyright prevents anti-virus manufacturers from including large enough parts of the malware code to accurately detect it.
It might not be pleasent but if it's fair for the good guys to use code under fair use for detection then the bad guys get to do it as well.
Which reminds me I don't even remember the legal status of this DVD Jon code in the US. Is it illegal under the DMCA? Does this deny it copyright protection or a different measure.
If you liked this thought maybe you would find my blog nice too:
Does anybody know if Sony pre-installs this rootkit in the computers they sell? I thought their laptops were good products, and normally would be among my choices if I were to get a new one (slight possibility I may want to get a Windows laptop), but this whole rootkit thing changes that. If they so blatantly forced it onto people's computers through music CDs, even trying to on Macs, then I don't imagine they would have any qualms about forcing it onto their computer buyers as well.
I assume that some grey, suited MBA type didn't put this code in. A geek did.
The grey suited MBA paid for it to be done and the geek did what he was paid to do. And obviously Sony BMG marketing would have to approve as it is a change in their product. Legal would have been involved to license the code. Upper management would either have to put their heads in the sand or approve it.
I don't know what world your from but geeks don't have a rats ass of influence with senior management. If a brain dead CSO looked at this he might have said it may be in violation of section 1030 of the Computer Fraud and Abuse Act, targeted paying customers and may contain copyright violations.
Conspiracy to subvert users who buy their product is likely. But this story is so ironically cute and humorous it will go down in the business journals like coke classic and the like. Sony will wait 6 months and when sales are down come out with DRM free classic CDs.
Does that meen Best Buy and Wal*Mart (and local music stores, not that I even know where those are) are (L)GPL violators too? They distributed the CDs...
I thought that was roughly the case, thanks for confirming it. Sorry about saying it was just Jon's and forgetting about the rest of the team, too.
So, quite apart from the fact they've stolen your code, the question now is:
Why does Sony's DRM include code to break Apple's DRM? Are they just scanning for evidence that your code is running, staticly built the library because they were stealing some other aspect of your program, or do they actually want to decrypt Apple files?
This story just gets stranger.
"I Know You Are But What Am I?"
Robertson might be interested in bankrolling Jon in any litigation against Sony.
Don't you think they're celebrating now that using audio CD's in PC's is a security risk? I'm suprised they haven't done this sooner. Pretty soon, we'll be asking for Trusted Computing because because it will protect us from oursel^h^h^h^h^h^h the security risks inherent in unsafe CD playing....
Welsh DRM technology is a hit in the US
Um, yeah, the determined audio pirates that leave AutoRun turned on on their CD-ROM drives.
Oy.
hooked up funny
IANAL, but: I've often had to have vendors go through a code review when implementing custom applications in our network. You would think that Sony would require the same thing when putting software like this on millions of CDs. If they did have a policy they should be liable. If they didn't then they are morons for accepting software at face value that goes on their most important product.
WARNING: WE HAVE NOT CONDUCTED A FELONY-CONVICTION SEARCH OR FBI SEARCH ON THIS INDIVIDUAL.
The problem is that you *are* responsible for copyright infringement on code that you receive. It's the same thing as with stolen goods.
... IANAL, but this is what the law says.
To draw a more potent example (because it's known that the code in this case is active, and not possibly "just a fingerprint"), it is entirely plausible that Geico would be liable for the programs they received from MXS. And they're just a customer using the stoftware! They're not even involved in the development. Another example is that every linux user would potentially be liable if Linux were to be found to contain code that SCO owns the copyright for. (Thus, the reason for indemnification, etc)
Basically, the issue here would be that Sony did not take due dilligence to ensure that the code provided to them were unencumbered. And you better believe that F4I will attempt to show that they *did* notify Sony of any encumberances, at which point Sony would be screwed, and F4I would be fine, because they complied with the (L)GPL, and Sony failed to redistribute properly.
Ignorance has never been an excuse of receiving stolen goods, or receiving infringing copyrighted material.
In this case, Sony would be working much like a fence. They would take the directly stolen code (and thus not at fault for the actual theft) and then they would peddle it out (accessory, plus some more extra stuff, like selling stolen goods.) So if anything, Sony is at least equally guilty of any infringement that F4I did on their behalf.
I am unamerican, and proud of it!
M$ was more public about what their rootkit does. They tell you it phones home etc.
Sony installs theirs without telling you and then if you try to uninstall it, it roots you even worse