Slashdot Mirror
EFF and Sony Disclose New DRM Security Hole
Dotnaught writes "The Electronic Frontier Foundation (EFF) and SONY BMG Music Entertainment said on Tuesday that SunnComm is offering a patch to fix a security vulnerability with its MediaMax Version 5 content protection software on 27 SONY BMG CDs. Security firm iSEC Partners discovered the hole following a request by the EFF to examine the SunnComm software. The vulnerability involves a directory installed on users' computers by the MediaMax software that could allow a third party to gain control over the affected Windows PC. The EFF and iSEC delayed disclosing the problem until SunnComm could develop a fix."
And to think that only yesterday, there was a slashdot story wondering whether the EFF had outlived its usefulness... So there's your answer, I guess.
Sony has done more damage to the DMCA and set back DRM farther than the combined efforts of the EFF and like-minded people around the world. We should all thank them.
But first you install stealthy and quite possibly illegal software with one hand , and on the other you install DRM with a Security hole that hardly anyone will patch because they will likely not hear about it.
Way to go Sony , you truly are a bunch of arse-holes .
Well at least if this gets major press coverage it may cause an even large headache to ever encroaching wave DRM
The only things certain in war are Propaganda and Death. You can never be sure which is which though
Great, now not only do I have to make sure all my users' applications are patched, but I have to track patches on every frigging DRM implementation out there as well.
Well, payback is a bitch.
I have already steered a friend away from a Sony stereo to another brand, making it clear that Sony is not a good "citizen" and they would do well to stay clear of any Sony products.
Yes, I am only one puny person, but I've already cost them a couple of hundred bucks, and will continue do so at every opportunity.
A house divided against itself cannot stand.
DRM software has to do more than regular software to prevent users from circumventing it, with the latest craze being OS hooks.
Insecure software + OS hooks = HUGE security risks.
If you ever want to release a worm that takes advantage of a DRM security hole, just put it on a web site that tells you how to disable that particular DRM. People will google for a way to disable their DRM, go to your site, and WHAM.
$7.95/mo, 200 GB disk, 2TBxfer, MySQL, PHP, RoR.
From EFF: "We're pleased that SONY BMG responded quickly and responsibly when we drew their attention to this security problem," said EFF staff attorney Kurt Opsahl. "Consumers should take immediate steps to protect their computers."
As if Sony, which already has a boatload of negative publicity, could do anything else. I think even the stuffed shirts there must now realize that they can't let anything else fall through the cracks or their music business might collapse. Don't be surprised in Sony divests itself of BMG music at some point in the future, to keep from losing customers for its home electronics business.
GetOuttaMySpace - The Anti-Social Network
RIAA Bans Telling Friends About Songs
Be a real patriot: Question authority. Think for yourself. Formulate your own conclusions.
Or
Sit here and rip the whole thing off the net for free and burn it to CD and copy it to my IPod.Yeah DRM is a great way to stop piracy.Maybe they should try offering value for money instead.
Sony is really setting DRM and copy-protection back by several years. And with each annoucement, they are making more and more people dislike DRM. That's not a bad thing, I suppose, but they're making it painfully obvious that the only fix for this is the complete removal of the software for people's systems with instructions on how to prevent the software from being loaded again in the future. (Sadly, a huge number of people don't know about the Shift key as an autorun disabler.)
/. but it's become clear that negative reactions like DRM are not what keep CD sales going.
Frankly, I want to see a major mea culpa from Sony on just about every TV and radio station that targets the audience from all of those DRMed audio CDs complete with previous said instructions and a promise (that will be kept) that such DRM techniques will never be used in the future.
Considering that even artists themselves are starting to fight back against DRM stating that it does nothing but hurt the fans, which is true, it's about time for the heads of these companies to realize that Sony has crossed the line and that DRM for audio CDs is not only useless but can have dire consequences. I'm not going to use that silly "information wants to be free" dogma that is used too often on
Maybe they should - gasp! - try adding value that the customer wants and cannot get over the Internet through downloading rather than trying to add chains to a product that we want to legally buy. For example:
* Buy the CD and get the concert DVD for 1/2 price
* Buy the CD and get a discount on concert tickets and merchandise
* Buy the CD and accumulate points that can be redeemed for other items
Tactics like these, where items that cannot be downloaded are offered as incentive, is a much better alternative to increase sales than pissing off the customer base by nefarious methods such as DRM. This is particularly true because DRM can be defeated by one simple method: CD line out --> PC line in.
In short, make it worth my while to buy the CD and not download it. DRM, particularly the kind that Sony implemented, does the opposite.
The Overrated mod is for reversing inappropriate, positive mods, not for voicing disagreement with a post.
Who in their right mind would voluntarily install something from SunComm or SonyBMG given their track record?
/. understand the issue. 99% of the population don't even know what "installing software" means, have never done it (intentionally), and aren't to blame for being victims of such things.
Most of the victims have no idea that they're installing software on their computer. They're just playing a CD that they bought.
We geeks and nerds on
Blame the criminals, not their victims.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
The most interesting part about the whole Sony BMG rootkit fiasco, and now this, is that it seems as if Sony is doubly screwed from now on, because whenever they put out a new product, it's going to be hacked from all sides, to find little holes like this. I'm sure there are plenty of other products out there that behave similarly or have holes in them, that are from other companies, and aren't getting exposed because they didn't piss off the internet community.
It's this kind of backlash now that is bustin Sony, because anything they put out from now on better be bullet-proof, or else it will wind up being counterproductive
It just doesnt make sense. Would you hire the burglar that broke into your home to install your security system?
Ah, but the great majority of victims of the first Sony rootkit still have it installed. They haven't heard about the problem, or head and didn't understand at all. If you take a look at the removal instructions, you'll see that there isn't a chance that your typical Joe Sixpack could ever follow them. If he tried, the result would probably be a machine that didn't boot.
But most of the victims haven't tried to remove it, because they don't have any idea it's there.
You might well hire the burglar if you had no clues that he was the burglar, and if friends and the BBB recommended him. This is an old sort of scam.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
I am still waiting to see how you patch a CD -- short of replacing it entirely, that is.
For now, I wouldn't trust Sony to patch my Tinkertoys properly, let alone my computer.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
This is not the "rootkit" DRM software that were talking about here. This is the other DRM crapware that Sony/BMG has on its discs. I buy a moderate amount of music on CDs, then rip them to MP3s to play on my Rio and car stereo. I was planning to buy Carlos Santana's new disc when this whole flap came up. I checked, saw that Santana wasn't on the rootkit list, and briefly considered buying it, although I have avoided all DRMed music to this point. No worries, I'll rip it on my Linux box anyway.
I changed my mind, and I'm glad I did. One less bit of malware in the stream of commerce. I did go to Carlos' website and told them I had decided not to buy the disc and why. From the notes there, it seems they have been getting a lot of that. This may be the most effective way to deal with this issue. Tell the artists that you will not buy their art, if it comes packaged with such crap.
Some mornings it's hardly worth chewing through the restraints to get out of bed.