Slashdot Mirror
Sony Rootkit Settlement Gets Judge's Approval
Lewis Clarke wrote to mention a ZDNet story about Monday's final approval of the rootkit settlement in the case brought against Sony BMG Music. From the article: "The agreement covers anyone who bought, received or used CDs containing what was revealed to be flawed digital rights management (DRM) software after Aug. 1, 2003. Those customers can file a claim and receive certain benefits, such as a nonprotected replacement CD, free downloads of music from that CD and additional cash payments ... At least 15 different lawsuits were filed by class action lawyers against the record label, and the New York cases were eventually consolidated into one proceeding. The parties reached a preliminary settlement with Sony BMG in December, leaving it up to a judge in a U.S. District Court in New York to make it official. "
Imagine if after reading about the original rootkit & associated vulnerabilities, you check your DNS records & see that indeed, one or more PCs you're responsible for are infected. You spend hundreds of hours following it up, removing the PCs from the network, checking to see there were no secondary malware infections, etc, etc, etc.
At the end of all your time, you still can't claim the replacement CD + download + patch, (let alone compensation for your lost time) because you didn't buy the offending CD (it was a temp receptionist).
I really want to see someone go after Sony for a real settlement. For that matter, I'd like to see a government go after Sony. Corporations have the same rights as individuals, how about we give them the same responsibilities as well. I think a four or five years of community service for the entire company (say 20 hours a week), would be about what's deserved for a widespread crack attempt like this.
There are shills on slashdot. Apparently, I'm one of them.
Here's the claim filing website for the Sony BMG settlement, since I didn't see a link to it in the article.
The solutions given almost don't seem worth it, but I'll probably opt-in anyway just so that little bit of money gets drained from Sony so they don't do this again.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
I believe the software did exactly what it was supposed to do. Shouldn't there be mention of a flawed *DRM *strategy being foisted upon consumers?
My turnips listen for the soft cry of your love
If a 15 year old script kiddie had done the kind of damage that Sony did with its rootkit, he'd be spending a couple of years in a "Federal PMITA prison" why does Sony get off this lightly?
Someone should be incarcerated over this.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
If some young "cranker" released this type of virus out in the wild, he or she would be looking at serious jail time. But as is normally the case with corporations, no one is expected to be personally responsible. Just a few dollars that amounts to jack shit for a huge corporation.
Just like when Ford and Bridgestone decided to go ahead and release the exploding tires. Sure a few people got killed, but we can't press criminal charges! These are our captains of the industry! Reason #122,234 that this country is seriously messed up.
(-1, Raw and Uncut is the only way to read)
CDs containing what was revealed to be flawed digital rights management (DRM) software
If Sony pays me a sufficiently huge wad of cash, I might be able to afford to give it back to them in exchange for a PS3.
Slashdot Burying Stories About Slashdot Media Owned
Usually in a class action lawsuit those harmed get a coupon or replacement product that's pretty much worthless. The lawyers get millions of dollars in fees in the name of "protecting consumers." So, how much did the attorneys get in this case?
As others have noted, this is a joke. Those users who were affected are entitled to a replacement CD, free downloads of the music on the CD in question (in who knows what format) or a cash settlement. So someone spends hours cleaning up the mess that Sony made and they get what amounts to $15 to $20 bucks. Most people who are affected probaby won't even bother to claim anything so Sony isn't really hurt by this. It seems to me that the lawyers who brought the class action suit are the only ones who really benefit here.
Welcome to the Empire of the United States of America.
While you serve the sufferance of the 5% of the families in this empire that own 95% of everything here, please be advised that you do not and cannot own:
Any sort of source code, any sort of music, any sort of transportation, any energy source.
You can however, license it from said 5% of the population here that own 95% of everything else.
You may buy a "rights" upgrade to your license to do as you please here, if you get caught violating the law. But bear in mind, sometimes we have to not accept your cash so we can calm the masses and throw them a "justice bone". In that instance should it happen, your "rights" license is null and void.
Above all else, while you are here please be advised that any government official can be purchased for a limited time depending on how much cash you have, and how much influence you want.
Just do not make it obvious and please use foreign banks to make sure transactions are not traceable.
Thank You and enjoy your stay!
-The Empire USA
Got Geometrodynamics? Awe, too hard to figure out? Too bad.
As scandals go, it seems like it took no time at all to go from exposure to out of court settlement. What do people make of that?
Proud member of the American Non Sequitur Society. We might not make much sense, but boy do we love pizza!
Is there any software available to fix and/or remove the rootkit? I played a Velvet Revolver CD on my PC, I believe on of the first CD to have this malware. How do I know if the rootkit was install?
Does that mean that from now on, people infringing copyrights won't be sued for fantastic amounts of money but that they just have to buy a CD for every CD they ripped?
Sounds fair.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Now, at least we know which CDs to avoid and if Sony keeps including any kind of copy protection software, their sales will plummet even more than they already have. The only thing left now is the drawing and quartering of the CEO and other upper-level officers, along with the dissolution of Sony's articles of incorporation, and I would say that justice was served.
But, I'm not holding my breath.
Similar to the upcoming US election results
The Lawyers and the Gov't, the people who were actually harmed will get a small, pathetic amount back. Yay for tort laws!
Unless you mean that Sony actually wanted to:
1. stealthily put a general-purpose rootkit interface on your computer, that leaves it wide open for any script kiddie to hide their malware with,
2. utterly break your computer if you try to uninstall it, even after you no longer own the CD or are interested in listening to the music on it
3. have exploitable bugs in both the original rootkit and in the "solution" to the problem they created
then no, it didn't do exactly what it was supposed to do. Pushing DRM on the consumers is a worthy discussion in its own right, but this crap went beyond that.
If you just buy an iPod with Apple's "fair play" DRM on it, or a Creative Zen with MS's DRM on it, or when you download the latest Media Player or Real One, that's DRM-ed. When then discover it can limit what I do with my music... that's DRM. And it does just what it's supposed to do, and nothing more: it just applies those rights to the DRM'ed music you bought, if you load it on that device. Nothing more. And if you uninstall that player or sell that iPod, then that DRM goes with it.
But Sony's heavy-handed crap was more like breaking into your house when you're away, and bugging your VCR to be sure you don't play some copied tape. And in the process leaving your front door lock broken, making any thief's job easier. And, oh, if you un-bug your VCR, it'll weld your garrage door shut.
I do believe that that's no longer "just DRM", that's a whole new level of crap. In fact the kind of crap that should be outright considered criminal. DRM or no DRM, that doesn't give them a carte blanche to stealthily install a rootkit on someone's computer.
It's the kind of Wild West vigilante justice that's just not Sony's business to enforce in a republic ruled by the law. We're no longer in the days where you'd just get a posse and go kick the Joneses' door in to see if they're the ones who stole your branded cow. So Sony has no business doing the same to the Joneses' computer. Plain and simple.
A polar bear is a cartesian bear after a coordinate transform.
In order for that to have happened, you would have needed to allow the temp receptionist root access on a machine. If you did that, you deserved what you got! The rootkit installs a security hole, but it can't install at all without administrator access.
I work for a media company and recently met with the global "head" of SonyBMG's digial licensing group. I brought up the rootkit thing and asked how that was going to affect them going forward. He seemed suprised that I had even heard about the issue and basically said "I can't believe these people are making such a fuss over it. People are going to eventually get used to it." (not a verbatim quote, but that was the gist)
So I wouldn't consider this much of a "win" at all. Next time they'll just make damn sure they're more stealthy about it. I bet a vanishingly small number of people actually apply for their "relief" so this isn't likely to be a very expensive lesson.
Posting anonymously since I don't think they'd think twice about yanking our license...
You're very wrong about one thing. It's reason NUMBER ONE. This is the PRIMARY problem we and our progeny are going to face.
I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
had the DRM on them? I know a few of my friends who have Sony CD's who might have used them in their PC's. I'm just curious how many different albums did include the protection.
I'm 100% in agreement; see my other comments for clarification. My point is that mainstream press is talking about this like it's an inadvertent error/flaw that somehow got into the product. Like faulty wiring in a toaster. In fact, this "flaw" was a design decision, arising from the fact that the provider's interests are contrary to the customers' interests.
My turnips listen for the soft cry of your love
Lave (958216) writes: I totally agree with you - but at least this set a precedent that this kind of behaviour is unacceptable.
Whiney Mac Fanboy (963289) writes: You spend hundreds of hours following it up, removing the PCs from the network, checking to see there were no secondary malware infections, etc, etc, etc.
A blackhat would have been prosecuted for causing over $1 million worth of damage, easily. Such damage costs are mostly attributed to labor and downtime, so that's probably a fair claim.
Comparing to the extent of this fiasco, jail time for the admitted blackhat would be certain.
My question: Who approved of this project and authorized the release of this malware?
This is not my sig.
Big corporations: pissing on our constitutions.
SonySuit.com notes that attorney's fees are still in dispute, and that there is an appeal of the case still pending.
-- Mark Lyon http://www.marklyon.org
I really don't care about the free CDs, or any other fine that would be levied against Sony. They're huge, and they aren't going to be hurt by this.
What I want is criminal prosecution of the people in Sony's management who directed that this be done, and directed that this malware be distributed. I can't imagine that if I, Mr. John Q. Public, recorded some of my own songs and packaged them with a rootkit of my own, that I'd be prosecuted for it. More than that, I can't imagine that if some employees of Sony burned the CD and took it to work to listen to, where it then installed itself on their computers, that Sony wouldn't quickly rack up the requisite amount in damages and I'd shortly have the FBI on my doorstep.
Is there any valid reason they're not being prosecuted for this? Is it as simple as the DoJ isn't bothered by it? $DIETY knows, I'll never buy another Sony anything if I can help it, but that's not enough. It's well past time that corporations learn they aren't above the law, even if they do write and pay for it.
It seems to me that the issue was their choice of HOW they enabled DRM. Installing a hidden rootkit that opened up millions of computers to hacks was the real damage they inflicted. How will a new CD secure these computers and remedy those affected in an appropriate way? It's like saying, "I'm sorry for smashing into your car. Please accept this tank of gas as compensation for my poor driving."
I guess it doesn't matter anyway...I'm no longer buying Sony products. They no longer exist to me.
Oh suck it, ya fascist. Unless company policy specifically forbids listening to music at work, this shouldn't be an issue. I sincerely hope you don't have authority over anyone you work with, you sound like a perfect Lumbergh. I've got your TPS report right here, buddy, just bend over a little and you can see it...
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
There is a complete list of the cds covered by the Settlement here.
This kind of thing is most likely is a kind of "white collar" crime.
The worst case scenario for white collar crimes is your Martha Stewart incarceration with a felony conviction. You have to really screw many things up to get penalized like her though.
No one is ever going to jail over this one or anything like it because the corporation is the "individual" being prosecuted. Individuals within a corporation rarely get penalized. It's your average American "win-win."
Take them to small claims, it's absolutely worth the effort.
In America, the corporation owns you!
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
I wonder if the judge realised the irony
in allowing Sony to give out free downloads of DRM-laden music files
to people who's computer(s) they made vunerable with their DRM software...
"flawed digital rights management"
Flawed, my ass
If I get caught burning Sony Music's HQ to the ground than that's a "flawed" bonfire.
If you aren't sure if you've got a CD that qualifies, here is a list of the infected cds: with XCP and Mediamax.
Great job to the EFF, one of the few organizations looking out for Joe Sixpack (and everyone else). The email is as follows
The worst part is that the so called recall was only for the large retailers. I work in a friends shop that sells CD's. He still has these CD's sitting on the shelf. When I told my friend about this fiasco he talked to his CD distributor about the recall and they knew nothing.
The agreement covers anyone who bought, received or used CDs containing what was revealed to be flawed digital rights management (DRM) software after Aug. 1, 2003. I think "malicious" might have been a more accurate word than "flawed."
You sure 'bout dat?
We accept unjust settlements and rights infringments not because we don't care, but because we don't have time to do anything about it. People work 40, 50, 60+ hours a week just to make ends meet. Add in 5 to 10 hours of commuting, and the result is very little spare time. I have very little inclination to spend my precious off-hours studying a convolted legal system, promoting a political justice in the community, and organizing a defense against perpetators of injustice. But I also recognize that no one will defend my rights for me, and if I don't defend them myself they will be taken from me. So what can I do? Decrease my living costs rather than increase my income--increasing income always requires an increased expenditure in time, and time is the real resource, the resource that is needed to pursue legal defense and community organization. I believe the largest single expenditure for most Americans is 30-year mortgage or an infinite-year monthy rent payment. If I can use alternative building techniques and piecewise home construction (reducing or eliminating interest, which doubles or triples the cost of a thirty-year mortgage), then expenditures go down, requisite work time goes down, and active time devoted to useful pursuits goes up. We'll see how it goes.
Sony contracted the writing of, and performed distribution of, malware that risked the security of countless systems and generated IT costs for businesses and individuals alike. They should get the same level of punishment that Kevin Mitnick got: the Sony execs should be held in prison for years pending trial, and they should be barred from going anywhere near a computer. And, they should have to pay compensation to all the businesses for all the damage they caused.
Anything less than that isn't holding them accountable for the extent of their evil.
Moderator hint: a comment is neither "Flamebait" nor "Troll" if it is true.
I was hoping to get a "I Love Playstation 3" t-shirt at a special discount price.
MOD THE CHILD UP!
an MP3 download of the same album
free mp3 version of the album, eh? so does that mean sony's gonna dole out mp3's? if so, wouldn't they in effect be supporting piracy, as the whole music believes mp3's are the source of all evil?
What a puny settlement. Sony got off so scott free it's unreal. One of those CDs can bring down a corporate network and screw them out of millions really fucking easily. All one of the employees has to do is play that song in one of their computers and then, with computers connected to the Internet and running around as admin all the time, that box is going to be a Worm Server 2003. That will just bring down the whole network with spyware and viruses. Anyone who's cleaned spyware knows that spyware clearly believes in safety in numbers, as they come by the hundreds.
why not just fine sony (number of employees)*(mean salary)*(hours of community service expected) and then tax everyone else less, providing the same social services?
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
"Those customers can file a claim and receive certain benefits, such as a nonprotected replacement CD, free downloads of music from that CD and additional cash payments "
At the same time they collect $150K for every song someone downloads without their permission. Oh yeah, that sounds fair...
How about this, Sony has to pay $1 billion to every customer that had this root kit installed without their knowledge. Yeah, that's a nice fair figure factoring from the $150K now considered reasonable for illegal downloading a single song or movie. Ooops, I forgot, that would hurt BUSINESS (Vs hurting those pesky people). Gotta protect those poor businesses. Wouldn't want them to have to pay for their behavior.... Now way Josey....
Note that if you chose to become a citizen or landed immigrent and become ill, you are forbidden to pay a doctor for treatment. You must stand in line, and wait your turn for state medical care. We are not responsible for your death in this case.
Welcome to Canuckistan!
If you chose to accept state medical care, you may not leave your province of residence. To do so requires reimbursing the province for any medical care received, at the rates the province prescribes.
Welcome to Canuckistan!
You could've hired me.
I don't do Windows or Sony music CDs and wasn't paying a whole lot of attention to the whole debacle. Did the rootkit still install if you had the windows auto-play-CD thingy turned off? Did it install corectly if you weren't running Windows in admin mode? It seems like the first couple of things someone administering a big Windows network should do is to turn off the CD autoplay and require all the users to use non-admin accounts... If the OS is still subverted after that, THEN sue Microsoft and Sony for damages. Not that you'll get any, since the EULA says your'e on your own.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Maybe this case's high visibility will cause laymen to start thinking, too. If they come to the foolish conclusion that "well, I can still run software given to me by people who do not share my interests, because if something bad happens, I'll just sue" then I forsee more unhappy times for them. It won't matter whose fault the courts say it is; what matters is who suffers. Don't be that person.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
What moron modded up this obviously offtopic post? BTW, I love this kind of asinine reply to a flamebait-y post... "err, well America sucks but.. hmm, here's a problem in this other country!" :)
I wash mah-self with a rag on a stick.
How'd they know who to send a letter to? Did you sign up for the lawsuit, or is there some scary database linking CD purchases and addresses?
Sure, I could jump in on this "settlement", but I don't need to. What I NEED to do is to protect myself and my clients, period.
So for me, Sony loses. I buy and recommend a great deal of products that Sony has in their product lines. I no longer buy ANYTHING made by Sony. I won't trust them again. I don't have to, and I don't feel like I am limiting myself.
We're going to see this happen again. Perhaps from Sony, perhaps from someone else. Sony wasn't the only one that believed that this was a legitimate business practice. Microsoft and Symantec were both aware of what Sony was doing, and chose to allow it in their antispyware product lines. It wasn't until well AFTER Russinovich's expose that they started doing something about it.
So for me, it's just business. I don't trust them, and I don't have to. I have choices.
Would you put one of their DVDs into your computer to watch the movie you paid for? Would you tomorrow?
Lou
Seriously, if an individual did what Sony has, that person would be doing either community service or time in a federal pound-me-in-the-ass prison. And Sony?
Slap on the wrist, and no more.
I'm going to start a hacking corporation that runs a music industry as our legitimate, customer-facing front. We'll release rootkits on CDs of horrible music, and rip off as much privately-owned information from our unsuspecting users as we can. Of course, we won't get it directly -- we'll use elements of the non-corporate community to help us out; to help make us money by proxy...
OK, seriously, if the rule-of-law is to be consistent and thus mean anything in this country, Sony should be forced to send those responsible in the company to U.S. federal pound-me-in-the-ass prison. Why isn't this happening? Well, this was a civil case brought by the EFF. So what about the criminal case? The EFF says they're unaware of any such cases.
Is Capitalism Good for the Poor?
i feel bad for the people who bought any of those albums, because they all suck
i except, possibly, Trey Anastasio, though without the rest of Phish, i don't give him much benefit of doubt
Sony BMG cost my company over $10,000 in damage and lost productivity, and we get butt kiss!? If this had been some teenager he'd be facing criminal charges! but Nnnoooo, we don't want to pis off our international trading partners.
ONE: I'm asking our legal department to seek damages.
TWO: It's time to throw the carpetbaggers out of Washington. This is Bu|| $hit.
THREE: Count on me to look the other way when my employees pirate Sony products. As long as they keep it off my network!
I'm off to put the DVD Copier in the lunch room now....
Where is the list of affected CD's? I looked over the settlement PDF, nothing there. I want to check and see if I own any of these CD's.
Can someone please post the url for the list?, and maybe someone from Slashdot can update the story with that url...
Sony's real punishment comes in the form of antipathy from customers. Previously I didn't have anything against Sony. After this mess, merely seeing their logo makes me feel a bit sick. I definitely won't buy anything made by Sony in the near future (probably at least a few years), even if the product has nothing to do with their music division. Maybe ordinary people (non-Slashdot readers) don't feel quite as strongly about it, but even so, this incident will cost Sony a lot in terms of lost sales and damage to their corporate image.
I signed up for the patch when it first hit the fan. I hadn't been infected, but I thought my wife's computer might have been so I wanted the instructions on how to remove it. As such I gave them my email address.