Sony Warned Weeks Ahead of Rootkit Flap

pdschmid writes "Business Week has an article describing how Sony BMG had been warned by F-Secure on Oct. 4 about the dangers of their rootkit protection, but failed to do anything until Oct. 31 when computer-systems expert Mark Russinovich revealed the rootkit in his blog." From the article: "Sony BMG officials insist that they acted as quickly as they could, and that they expected to be able to go public and offer a software patch at the same time. However, Russinovich posted his blog item first, forcing Sony BMG to scramble to contain the crisis. It recalled millions of CDs recorded by 52 artists, including Van Zant, Celine Dion, and Neil Diamond. Plus, it offered exchanges to customers."

Comments

What a load

[Microlith]

Scramble? To contain the crisis?

They almost never admitted what they had done, and continually denied the dangers posed by this rootkit.

They only started the recall after people pointed out repeatedly that their "uninstaller" didn't, and recieved criticism from the government.

"as quickly as they could" my ass.

Of course, they could have been smarter and never released it to begin with.

Proves public disclosure is the best for security

[Anonymous Coward]

Until a security hole is widely published (not privately communicated) it's very likely to continue spreading unchecked.

I think this is great evidence that early public disclosure is very important. At the minimum, the affected users can start using workarounds (turn off insecure systems) until fixes are available.

Another possibility exists...

[bigtallmofo]

So Sony was lying its collective arse off when saying it reacted as quickly as it could?

That they were lying is one possible explanation. Looking on the bright side, another possibility is that they're just incompetent.

Re:Another possibility exists...

[CowboyBob500]

A mom-and-pop store or a private individual cannot reasonable be expected to do a good faith patent search when choosing an operating system (MS Windows and Mac OS undoubtedly violate hundreds of software patents, and Linux violates thousands of patents if you include software commonly found in distros, like mp3 players - the mplayer project alone has close to 1,000 known patent violations and countless unknown violations). Legally every single user of a halfway modern OS should have injunctions granted against the use of their computer and massive damages be paid out to the dozens or hundreds of patent holders covering some aspect of their OS.

MPlayer, Linux, LAME etc etc, are perfectly legal here in the UK since software patents are not enforcable. The problem is not with the software, it's with the US patent system.

Bob

Impressions

[A beautiful mind]

When the Sony rootkit case first hit the news, I considered F-Secure to be quite good for an anti-virus company because they were reasonably quick adding the rootkit to their signature file.

They've just lost that credit for me. They knew for a month and were sitting on it! That is not acceptable. There should have been no warning to Sony, just a public statement from F-Secure at the beginning of October about the rootkit.

Re:Impressions

[Anonymous Coward]

This isn't the equivalent of a bug in IE. Sony deliberately infected their customers' computers with malware. Sure it was buggy malware but that's hardly the main issue. If you see a Sony executive breaking into someone's house, would you let the Sony exec know so that he could have a month to fix the problem before anyone else found out?

Re:Impressions

[A beautiful mind]

Someone mod parent up.

The difference between a Microsoft security issue and the Sony rootkit is earth and sky.

If F-Secure would have identified a flaw in Microsoft's software, then it's ok if they give the company a grace period to get a patch ready.

There was no such patch to be prepared in the case of Sony.

The following things are sensible to be done when someone finds a new rootkit spreading in the wild:

• Identify it's source [Sony DRM on cd's - CHECK]
• Find a way to stop the infections/prevent further infections - this can be only done by forcing Sony to stop shipping infected cds - a public disclosure is essential. Also adding the rootkit to the signature file is required. [FAIL]
• Clean up the infections - most anti-virus companies write even small utilities to remove rootkits/viruses/trojans. [???]

Let's face it: By telling Sony about it and not going for public disclosure F-Secure accomplished nothing but let even more users get infected by this rootkit. Sony is not a software company, there wasn't a flaw in a software that needed to be fixed, but the software itself removed! That requires no cooperation on behalf of Sony.

Yeah...

[penguinbrat]

""Most people, I think, do not even know what a Rootkit is, so why should they care about it?"

You can just hear the urgency can't you...

Re:Proves public disclosure is the best for securi

[Al Dimond]

I may be in the minority of /. readers: I don't really know the story of Mitnik. But if GP is accurate, he spent time in jail. You can't put a corporation in jail. $100,000 is a slap on the wrist; probably any fine that will be assessed is a slap on the wrist and probably is just a drop in the bucket of all the money that Sony will spend on legal matters in any given year. But if you fine a corporation enough to actually hurt it, a lot of innocent people lose jobs. So what's the solution to this?

The actual people that did the hacking were working for this "First4Internet" company. Anyone that designed, wrote or approved a part of the software deemed to be inappropriate could face jail time. There were people at Sony that approved this technology for use on CDs; they could face jail time. There were people at Sony that knew that their software included a rootkit and insecure kernel modifications, and yet claimed otherwise; they could face fraud charges (for an individual to say, "I am not a crook," is legal, but to knowingly lie about a product offered for sale is fraud). Anyone with much knowledge of the workings of this product should have known that it was illegal, just as Kevin Mitnik or any other cracker surely knows that whatever he does (like I said, I have no idea what it was that he did) is illegal. That would be equal justice.

Re:Don't forget Sony's other nasty DRM

[Braino420]

Just say NO to DRM. The only thing Sony seems to understand is lost sales.

Haven't you learned by now that any lost sales are blamed on piracy? Which means it will probably just lead to more DRM bullshit. I mean, it's gotten to the point where I can no longer justify buying a CD. Why shouldn't I be able to backup a cd I payed 20 bucks for? It will end up with me doing something illegal either way. It's cool because the stuff I download doesn't have DRM!