Slashdot Mirror
Sony Warned Weeks Ahead of Rootkit Flap
pdschmid writes "Business Week has an article describing how Sony BMG had been warned by F-Secure on Oct. 4 about the dangers of their rootkit protection, but failed to do anything until Oct. 31 when computer-systems expert Mark Russinovich revealed the rootkit in his blog." From the article: "Sony BMG officials insist that they acted as quickly as they could, and that they expected to be able to go public and offer a software patch at the same time. However, Russinovich posted his blog item first, forcing Sony BMG to scramble to contain the crisis. It recalled millions of CDs recorded by 52 artists, including Van Zant, Celine Dion, and Neil Diamond. Plus, it offered exchanges to customers."
So Sony was lying its collective arse off when saying it reacted as quickly as it could? This is news how?
Scramble? To contain the crisis?
They almost never admitted what they had done, and continually denied the dangers posed by this rootkit.
They only started the recall after people pointed out repeatedly that their "uninstaller" didn't, and recieved criticism from the government.
"as quickly as they could" my ass.
Of course, they could have been smarter and never released it to begin with.
I think this is great evidence that early public disclosure is very important. At the minimum, the affected users can start using workarounds (turn off insecure systems) until fixes are available.
So Sony was lying its collective arse off when saying it reacted as quickly as it could?
That they were lying is one possible explanation. Looking on the bright side, another possibility is that they're just incompetent.
I'm a big tall mofo.
If this is true, then sony just lost them court cases we've been hearing about. Having been told about it and not issued a product recall at the earliest opportunity (i.e. within a day or two) means that they were intentionally subverting people's computers.
The only defence available to them was that they didn't realise this was happening. They've just lost that.
When the Sony rootkit case first hit the news, I considered F-Secure to be quite good for an anti-virus company because they were reasonably quick adding the rootkit to their signature file.
They've just lost that credit for me. They knew for a month and were sitting on it! That is not acceptable. There should have been no warning to Sony, just a public statement from F-Secure at the beginning of October about the rootkit.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
In this case, "as quickly as they could" seems to really mean "as slowly as they could get away with."
How long is it going to be before these companies realize that attacking their customers and treating them like criminals really is NOT a good way to do business? Microsoft's "product activation", Sony's rootkit, etc. ad naseum do essentially nothing to stop real hackers from copying software, music, etc., as much as they want, so the only thing they really accomplish is hurting the legitimate customers.
These lousy business practices are reflected in their (lack of) sales too. I don't mean to say a boycott of Sony would necessarily be a bad thing, but for those who haven't looked, take a look at Sony's stock prices -- boycott or no, they're not exactly burning up the charts right now.
Now, Sony (etc.) will undoubtedly point to Napster and such as the reason they're not doing as well recently. I don't think that's the case. I think what's happened is that Sony is now concentrating more on forcing customers to pay than they are on producing things customers want. As is visible in their stock price, that simply leads to oblivion, not prosperity.
--
The universe is a figment of its own imagination.
The universe is a figment of its own imagination.
It doesn't take that many weeks to recall CD's and tell resellers to take them off of their shelves.
They're telling the truth, in part: they reacted as fast as they could to the bad press. But not to the real issue - the flawed software.
akad0nric0
This sentence no verb.
I don't think this was a security hole so much as breaking and entering. I realize the players are different here but didn't Kevin Mitnick spend years in jail for stuff like this? I guess when a corporation hacks a consumer it's OK.
http://www.rootstrikers.org/
It's always a lot easier to bust a corporation when there is evidence that they knew they were doing something wrong. Haven't you seen Erin Brockovitch? :D
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Until there are devastating consequences for any company that dies this, it just doesn't matter. 90% of the their customers don't even know about this, and the ones that do, don't fully understand it. This can only change once the average consumer is educated on the issue and there are successful lawsuits that punish companies like Sony. Sony knows that this will blow over in a few months and most people will forget about it (except Slashdot readers of course). People will just continue to buy cds like they always have.
gasmonso http://religiousfreaks.com/This has already been said by Bruce Schneier, but...
F-Secure warned Sony about the dangers on October 4th, yet still failed to protect any of it's users in a timely manner.
Be proactive.
Watch out for yourself.
The only way to get a corporation to look out for your best interests is to convince it (remind it?) that your interests are their interests (happy customers!).
Make your interests clear by voting with your wallet. Is there a company out there that tries to fix security holes before the customer knows about them? If so, buy your products from them.
As I wrote that last bit, it occurred to me: perhaps leaving the security-hole-finding business up to the customer base is good business sense because it works and is cheaper than hiring your own security-hole-finders. I guess that brings us back to the proactive list.
In short, I agree totally with your post.
I cried real tears when Li Mu Bai died.
Buy a sony Walkman and it won't play anything but a Sony CD?
Sony's way ahead of you. Buy a sony Walkman "MP3" player and it won't play anything but propriatery ATRAC files. It won't even play MP3s, hence the quotation marks on MP3 above.
Bruce Schneier has covered this already, but I would like to know why F-Secure didn't contact, say, everyone else when they found out that Sony was installing a rootkit on people's machines. I would like to know why nobody else on the long list of companies that get paid protection money to keep this sort of thing from happening saw fit to inform the world about this, instead of having it appear on some guy's weblog. It's not like that little cabal isn't paid what amounts to protection money specifically so that this kind of thing doesn't happen.
Mike Hoye
And I am sure a judge would call bullshit on this and in fact hold them responsible for the malware that they created, should this ever come up in court. After all, a program doesn't write itself, and the programmer(s) should have been aware of the nature of the code they were creating.
Just because something is in a EULA does not always make it legally binding, such as... (fill in the usual outlandish hypothetical EULA terms that get posted as examples here.)
This space unintentionally left blank.
""Most people, I think, do not even know what a Rootkit is, so why should they care about it?"
You can just hear the urgency can't you...
I may be in the minority of /. readers: I don't really know the story of Mitnik. But if GP is accurate, he spent time in jail. You can't put a corporation in jail. $100,000 is a slap on the wrist; probably any fine that will be assessed is a slap on the wrist and probably is just a drop in the bucket of all the money that Sony will spend on legal matters in any given year. But if you fine a corporation enough to actually hurt it, a lot of innocent people lose jobs. So what's the solution to this?
The actual people that did the hacking were working for this "First4Internet" company. Anyone that designed, wrote or approved a part of the software deemed to be inappropriate could face jail time. There were people at Sony that approved this technology for use on CDs; they could face jail time. There were people at Sony that knew that their software included a rootkit and insecure kernel modifications, and yet claimed otherwise; they could face fraud charges (for an individual to say, "I am not a crook," is legal, but to knowingly lie about a product offered for sale is fraud). Anyone with much knowledge of the workings of this product should have known that it was illegal, just as Kevin Mitnik or any other cracker surely knows that whatever he does (like I said, I have no idea what it was that he did) is illegal. That would be equal justice.
In their mind, the entire fiasco boils down to the following --
a. How to hide the DRM software better so it will not be detected NEXT TIME.
b. How to silence the whistle blower so that if line item a fails, the word never leaks out.
c. How to fabricate pausable deniablity if the word leaked out despite line item b.
In summary, for the media company, the entire affair isn't about what wrong they inflicted on their PAYING CUSTOMERS, but about how to contain the situtation and continue to "protect THEIR rights."
ELOI, ELOI, LAMA SABACHTHANI!?
While I find your timeline plausible, I think it's only part of the story. It wouldn't surprise me at all if that happened at the START of the project, but I don't find it plausible that they never involved themselves in the software at all. Sony, like any other large scorporation is risk averse, especially in terms of their image. I'm sure they reviewed the software/technical design of what was being suggested by First4. What I don't buy is that Sony distributed software they were so clueless about. Lets face facts, folks: Sony has definitely behaved badly, but they're not stupid. The amount of incompetence required to justify their "duh, we just shipped it" argument is staggering to the point of absurdity.
Haven't you learned by now that any lost sales are blamed on piracy? Which means it will probably just lead to more DRM bullshit. I mean, it's gotten to the point where I can no longer justify buying a CD. Why shouldn't I be able to backup a cd I payed 20 bucks for? It will end up with me doing something illegal either way. It's cool because the stuff I download doesn't have DRM!
They call me the wookie man, I guess that's what I am
Yes, Mitnick did time - he got a severe sentence, including solitary. It was out of proportion to his crime because his was an early instance of cracking (the swallow before the summer) and he was made a scapegoat. Also, the press paid great interest partly because of the fascinating story of his pursuit and capture, which the authorities treated as a mission deserving all their energy.
Looking back now, you can't help wondering why all the fuss. Mitnick did pry around some academic, corporate and military related systems but always maintained he did no damage. He certainly seemed to act out of curiosity and as a challenge rather than with malice. He has yet to write his account of the episode.
What Mitnik did pales into insignificance compared with what goes on now - spammers acting with apparent impunity, crackers installing and controlling bots in their tens of thousands, market researchers planting spyware, and even previously respected household names like Sony pushing Trojans onto the unsuspecting public. Activities which seriously threaten the continued viablity of the internet as a medium.
Company directors can be sent to jail, as Mitnik was. However I doubt it will happen because the legal authorities and the public are now punch drunk with misbehaviour in the IT field. They were sharp and keen against Mitnik but now they are weary and cannot be bothered to pursue the wrong-doers.
It is much easier for the authorities to dismiss this case with "Oh well, surely Sony couldn't have meant any harm, could they?"
F-Secure would probably be facing legal action from Sony if they deliberately prevented Sony's software from running. In the land of the DMCA where a guy who plays chess against the Russians is a traitor and a guy who sells weapons to Iran to give money to a drug dealer is a patriot who knows which way it would go? Either way the antivirus companies lose - viruses and malware produced by companies with major legal clout will most likely be a major headache for the antivirus companies from now own.