Slashdot Mirror
Sony Warned Weeks Ahead of Rootkit Flap
pdschmid writes "Business Week has an article describing how Sony BMG had been warned by F-Secure on Oct. 4 about the dangers of their rootkit protection, but failed to do anything until Oct. 31 when computer-systems expert Mark Russinovich revealed the rootkit in his blog." From the article: "Sony BMG officials insist that they acted as quickly as they could, and that they expected to be able to go public and offer a software patch at the same time. However, Russinovich posted his blog item first, forcing Sony BMG to scramble to contain the crisis. It recalled millions of CDs recorded by 52 artists, including Van Zant, Celine Dion, and Neil Diamond. Plus, it offered exchanges to customers."
So Sony was lying its collective arse off when saying it reacted as quickly as it could? This is news how?
Scramble? To contain the crisis?
They almost never admitted what they had done, and continually denied the dangers posed by this rootkit.
They only started the recall after people pointed out repeatedly that their "uninstaller" didn't, and recieved criticism from the government.
"as quickly as they could" my ass.
Of course, they could have been smarter and never released it to begin with.
I think this is great evidence that early public disclosure is very important. At the minimum, the affected users can start using workarounds (turn off insecure systems) until fixes are available.
So Sony was lying its collective arse off when saying it reacted as quickly as it could?
That they were lying is one possible explanation. Looking on the bright side, another possibility is that they're just incompetent.
I'm a big tall mofo.
If this is true, then sony just lost them court cases we've been hearing about. Having been told about it and not issued a product recall at the earliest opportunity (i.e. within a day or two) means that they were intentionally subverting people's computers.
The only defence available to them was that they didn't realise this was happening. They've just lost that.
When the Sony rootkit case first hit the news, I considered F-Secure to be quite good for an anti-virus company because they were reasonably quick adding the rootkit to their signature file.
They've just lost that credit for me. They knew for a month and were sitting on it! That is not acceptable. There should have been no warning to Sony, just a public statement from F-Secure at the beginning of October about the rootkit.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
In this case, "as quickly as they could" seems to really mean "as slowly as they could get away with."
How long is it going to be before these companies realize that attacking their customers and treating them like criminals really is NOT a good way to do business? Microsoft's "product activation", Sony's rootkit, etc. ad naseum do essentially nothing to stop real hackers from copying software, music, etc., as much as they want, so the only thing they really accomplish is hurting the legitimate customers.
These lousy business practices are reflected in their (lack of) sales too. I don't mean to say a boycott of Sony would necessarily be a bad thing, but for those who haven't looked, take a look at Sony's stock prices -- boycott or no, they're not exactly burning up the charts right now.
Now, Sony (etc.) will undoubtedly point to Napster and such as the reason they're not doing as well recently. I don't think that's the case. I think what's happened is that Sony is now concentrating more on forcing customers to pay than they are on producing things customers want. As is visible in their stock price, that simply leads to oblivion, not prosperity.
--
The universe is a figment of its own imagination.
The universe is a figment of its own imagination.
I don't think this was a security hole so much as breaking and entering. I realize the players are different here but didn't Kevin Mitnick spend years in jail for stuff like this? I guess when a corporation hacks a consumer it's OK.
http://www.rootstrikers.org/
Until there are devastating consequences for any company that dies this, it just doesn't matter. 90% of the their customers don't even know about this, and the ones that do, don't fully understand it. This can only change once the average consumer is educated on the issue and there are successful lawsuits that punish companies like Sony. Sony knows that this will blow over in a few months and most people will forget about it (except Slashdot readers of course). People will just continue to buy cds like they always have.
gasmonso http://religiousfreaks.com/This has already been said by Bruce Schneier, but...
F-Secure warned Sony about the dangers on October 4th, yet still failed to protect any of it's users in a timely manner.
Buy a sony Walkman and it won't play anything but a Sony CD?
Sony's way ahead of you. Buy a sony Walkman "MP3" player and it won't play anything but propriatery ATRAC files. It won't even play MP3s, hence the quotation marks on MP3 above.
Bruce Schneier has covered this already, but I would like to know why F-Secure didn't contact, say, everyone else when they found out that Sony was installing a rootkit on people's machines. I would like to know why nobody else on the long list of companies that get paid protection money to keep this sort of thing from happening saw fit to inform the world about this, instead of having it appear on some guy's weblog. It's not like that little cabal isn't paid what amounts to protection money specifically so that this kind of thing doesn't happen.
Mike Hoye
""Most people, I think, do not even know what a Rootkit is, so why should they care about it?"
You can just hear the urgency can't you...
I may be in the minority of /. readers: I don't really know the story of Mitnik. But if GP is accurate, he spent time in jail. You can't put a corporation in jail. $100,000 is a slap on the wrist; probably any fine that will be assessed is a slap on the wrist and probably is just a drop in the bucket of all the money that Sony will spend on legal matters in any given year. But if you fine a corporation enough to actually hurt it, a lot of innocent people lose jobs. So what's the solution to this?
The actual people that did the hacking were working for this "First4Internet" company. Anyone that designed, wrote or approved a part of the software deemed to be inappropriate could face jail time. There were people at Sony that approved this technology for use on CDs; they could face jail time. There were people at Sony that knew that their software included a rootkit and insecure kernel modifications, and yet claimed otherwise; they could face fraud charges (for an individual to say, "I am not a crook," is legal, but to knowingly lie about a product offered for sale is fraud). Anyone with much knowledge of the workings of this product should have known that it was illegal, just as Kevin Mitnik or any other cracker surely knows that whatever he does (like I said, I have no idea what it was that he did) is illegal. That would be equal justice.
Haven't you learned by now that any lost sales are blamed on piracy? Which means it will probably just lead to more DRM bullshit. I mean, it's gotten to the point where I can no longer justify buying a CD. Why shouldn't I be able to backup a cd I payed 20 bucks for? It will end up with me doing something illegal either way. It's cool because the stuff I download doesn't have DRM!
They call me the wookie man, I guess that's what I am
Yes, Mitnick did time - he got a severe sentence, including solitary. It was out of proportion to his crime because his was an early instance of cracking (the swallow before the summer) and he was made a scapegoat. Also, the press paid great interest partly because of the fascinating story of his pursuit and capture, which the authorities treated as a mission deserving all their energy.
Looking back now, you can't help wondering why all the fuss. Mitnick did pry around some academic, corporate and military related systems but always maintained he did no damage. He certainly seemed to act out of curiosity and as a challenge rather than with malice. He has yet to write his account of the episode.
What Mitnik did pales into insignificance compared with what goes on now - spammers acting with apparent impunity, crackers installing and controlling bots in their tens of thousands, market researchers planting spyware, and even previously respected household names like Sony pushing Trojans onto the unsuspecting public. Activities which seriously threaten the continued viablity of the internet as a medium.
Company directors can be sent to jail, as Mitnik was. However I doubt it will happen because the legal authorities and the public are now punch drunk with misbehaviour in the IT field. They were sharp and keen against Mitnik but now they are weary and cannot be bothered to pursue the wrong-doers.
It is much easier for the authorities to dismiss this case with "Oh well, surely Sony couldn't have meant any harm, could they?"