Another Sony Rootkit?

An anonymous reader writes to tell us F-Secure is reporting that the drivers for Sony Microvault USB sticks uses rootkit techniques to hide a directory from the Windows API. "This USB stick with rootkit-like behavior is closely related to the Sony BMG case. First of all, it is another case where rootkit-like cloaking is ill advisedly used in commercial software. Also, the USB sticks we ordered are products of the same company — Sony Corporation. The Sony MicroVault USM-F fingerprint reader software that comes with the USB stick installs a driver that is hiding a directory under "c:\windows\". So, when enumerating files and subdirectories in the Windows directory, the directory and files inside it are not visible through Windows API. If you know the name of the directory, it is e.g. possible to enter the hidden directory using Command Prompt and it is possible to create new hidden files. There are also ways to run files from this directory. Files in this directory are also hidden from some antivirus scanners (as with the Sony BMG DRM case) — depending on the techniques employed by the antivirus software. It is therefore technically possible for malware to use the hidden directory as a hiding place."

Comments

Sony

[jshriverWVU]

What happened to Sony? Growing up they always seemed like a great tech company, pumping out quality products that most people liked. When did politics and this kinda crap really start. It's sad.

Re:Sony

[Prof.Phreak]

It started when they became an entertainment corp, rather than a technology corp.

Re:Sony

[FatAlb3rt]

Seems like they've been pushing their own proprietary stuff for the past 20 yrs - most recently Blue Ray, but then there was that miniDisc that went nowhere. Not sure...did they have a roll in VHS/Beta? I used to be a fanboy, but it seems they get more negative press anymore.

Re:Sony

[plover]

It happened when they added a movie studio and a recording label to the corporation. The media side of the house demanded copy protection from the technical side of the house, without understanding the technical limitations.

Re:Sony

[Anonymous Coward]

they are under the direct control of satan. Or so it would seem.
Growth leads to power and power leads to corruption and corruption leads to desire and desire leads to power. Not always, but often enough to be considered valid.

Re:Sony

[Anonymous Coward]

Sony, where the customer getting screwed comes first!

Re:Sony

[king-manic]

Seems like they've been pushing their own proprietary stuff for the past 20 yrs - most recently Blue Ray, but then there was that miniDisc that went nowhere. Not sure...did they have a roll in VHS/Beta? I used to be a fanboy, but it seems they get more negative press anymore.

MD disks were actually very successful across asia. They didn't find a market in North America. In the same span they have also created the 3.5 inch floppy, the CD, and had a bit of input on the DVD. It's be more accurate to describe their format strategies as being hit and miss since they have been part of some huge dogs (beta, UMD) and some very successful formats (CDs, 3.5 inch floppies).

Re:Sony

[morgan_greywolf]

Not sure...did they have a roll in VHS/Beta? Yes. Beta was a proprietary Sony product, while VHS was what was being produced by almost everyone else.

Re:Sony

[Otter]

When did politics and this kinda crap really start.

Hype here notwithstanding, this is not a "rootkit". It seems to be a bizarre form of write-protection.

Re:Sony

[Andy Dodd]

CD was Philips, not Sony.

As to DVD - Not sure about the original DVD format, but Sony effectively created the recordable DVD format war with the + series of formats.

And yes, Sony had a role in VHS vs. Beta - Beta was Sony's format.

Re:Sony

[omeomi]

Philips and Sony collaborated on the CD specification.

Re:Sony

[omeomi]

Don't forget about Memory Stick, the solution to a problem that nobody has...a lack of choices among removable flash storage media.

Re:Sony

[SenseiLeNoir]

Yes, they were very successful with the 3.5 inch floppy.. also Trinitron screens, and the CD, which was co-developped with philips. They were also very successfull at putting DV/Firewire video in the hands of ordinary customers.

yeah they made some lemons too, but like any tech company, that actually tries to invent stuff.

Re:Sony

[hackstraw]

It started when they became an entertainment corp, rather than a technology corp.

So, are rootkits entertainment or technology?

Re:Sony

[ajs]

I posted this on the firehose version of this article. Thought I should do so here too:

Please note: this software simply creates a directory that is hidden from the Windows API for its fingerprint authentication. It's not actually a rootkit, just using one of the many tools of the trade of rootkits. The concern is that the hidden directory is hidden from all of the Windows API, including virus scanners, and thus could be used by malicious software to hide infected files.

I'm not sure that it's reasonable to accuse Sony of distributing a rootkit when they've simply distributed software which uses a technique that could accidentally help malicious software.

It's also probably a bad thing to keep swinging the rootkit-bat around like this. The next time some large corporation really tries to root all of their customers' machines, no one will believe the story.

Re:Sony

[f0dder]

It started with the Betamax. They're like the retarded cousin of Apple, always wanting to lock people down to Sony hardware but never figured out how to do it properly.

Re:Sony

[Anonymous Coward]

Betamax was the better format but it lost due to politics & porn.

Re:Sony

[Anonymous Coward]

I'm finding this all quite entertaining, I must say. So I think that's your answer.

Re:Sony

[AKAImBatman]

Yes, it is a rootkit. It's modifying the kernel space to hide directories from the user. There are better ways of doing such a thing, but a rootkit has the advantage of keeping the files hidden from common methods of hidden-file detection. Something like a virus or trojan would tend to use a kit like this to make sure that it couldn't be found by antivirus software. Such kits also tend to mask the presence of their processes, just to make sure that they REALLY can't be detected.

Re:Sony

[harrkev]

Please note: this software simply creates a directory that is hidden from the Windows API for its fingerprint authentication. It's not actually a rootkit

Please note the defenition of "rootkit," ripped from the beginning of the rootkit wikipedia article:

A rootkit is a set of software tools intended to conceal running processes, files or system data from the operating system.

If it looks like a duck, quacks like a duck, yada yada yada.

Re:Sony

[OldeTimeGeek]

Which shows that better marketing beats better technology...

Re:Sony

[Harmonious Botch]

If it is a rootkit or not seems to me an academic question. I prefer to be asking: is my computer more vulnerable?

Re:Sony

[morgan_greywolf]

No, it doesn't. I remember the VHS vs. Beta wars. Sony pulled out all the marketing stops, whlie VHS had virtually nothing. If there's one thing Sony has always been very good at, it's marketing.

All it proves is that since you could get porn on VHS and you couldn't on Beta, people like porn, so they stuck with VHS.

Re:Sony

[king-manic]

Like someone else pointed out, CD was a Sony/Philips collaboration and if you look at the spec and who contributed what it's nearly 50/50.

Re:Sony

[Anonymous Coward]

Which shows that better marketing beats better technology...

The proliferation of Windows and the proliferation of x86 processors is the ultimate proof of that statement.

Re:Sony

[AKAImBatman]

is my computer more vulnerable?

Generally, yes. A virus could check for the existence of one of these rootkits, and abuse its hidden locations to hide itself. Which means that a virus can hide from even rootkit detectors in the shadow of "legitimate" software.

Re:Sony

[tsa]

Yes it does. Remember video 2000? It was by far the best video system out there. It could show stationary pictures that were really stationary, fast-forward and -backward without the annoying lines in the picture, and you could swap the cassette like an audio cassette and record on the other side. The story goes that it failed because Philips refused to put porn on the cassettes, which is of course very bad marketing :)

Re:Sony

[king-manic]

Generally, yes. A virus could check for the existence of one of these rootkits, and abuse its hidden locations to hide itself. Which means that a virus can hide from even rootkit detectors in the shadow of "legitimate" software.

A virus could just skip the middle man and do it themselves. There no special permissions needed to create a malformed directory. I doubt it makes the system more vulnerable, it's just a very annoying hidden file hack.

Re:Sony

[jandrese]

But the Memory Stick had all sorts of advantages, like a useless DRM system and twice the price per bit of all of the competing flash solutions. It also capped out on capacity a lot quicker than its contemporaries. Who wouldn't want one?

Re:Sony

[OldeTimeGeek]

I bought my first VCR in 1977, so I was there. Sony marketed Beta to people that were willing to pay a premium for quality (just like they did with their TVs). JVC licensed VHS to every other manufacturer and let them do the marketing. And new development. It would have been a good trick for Sony when they still owned the professional market and could have lived with a smaller portion of the whole pie. Sony would live with the high end and concede the rest of the market to VHS. Unfortunately for them, the "rest of the market" became huge.

I think that nobody really considered how much people would trade tapes between themselves. You can live with incompatibility when you keep stuff to yourself, but if you want to watch a TV show that someone else taped and you have a different system, well, you're SOL.

Of course you could get porn on Beta. Long before you could get prerecorded Hollywood movies (at least the ones that *weren't* made from midnight showings before a video camera), you could get porn. A friend of mine bought an early model Sony in 1976 and he seems to have found porn tapes easily enough.

Re:Sony

[mattpalmer1086]

God, memory stick. I have a Sony phone, which is quite nice. I was recently in Tokyo, and I wanted some extra memory for my phone, so I went to Akihabara - geek central. All the sales assistants in about 20 shops I visited just looked at my phone, shrugged their shoulders and said "Sony!". My Japanese is pretty poor, but I got the message. So I went to the big Sony building at Ginza. No deal. They said they only sold memory sticks in the European market - they were using something else in Japan.

Since I was there, I pulled out a Sony camera I was trying to get a USB cable for. Again, no deal. This camera was North American Sony, and they didn't have those kinds of Sony cables in Japan.

Sigh. This insistence on ignoring standards and doing everything themselves - not even consistently across the world - bugs me like hell. I doubt I'll buy any more Sony consumer electronics until they get it. Hope they do - they know how to make nicely designed bits of technology.

Re:Sony

[dougmc]

Yes, it is a rootkit. It's modifying the kernel space to hide directories from the user. That's not what a rootkit [definition] does. It might be one part of what many rootkits do, but it's not the purpose of a rootkit.

The purpose of a rootkit is to let you get back in easily later, or once you're in, to let you get `root' easily. The Bioshock SecuROM thing *is* a rootkit -- the service it installs is there to let the SecuROM stuff run as a privileged account, and that's what rootkits do (it's also what things like `su' do.) But merely hiding a directory doesn't make it a rootkit. (It's probably still malware, but a different kind of malware.)

Rootkits often do attempt to hide themselves, but merely hiding yourself doesn't make you a rootkit.

Re:Sony

[AKAImBatman]

According to TFA (which could be wrong, I suppose) this isn't a malformed directory. It's one that's being explicitly hidden from listings by a rootkit. The files are still there, but they're completely invisible to any and all tools. If you uninstall the rootkit, suddenly they'd pop back into visibility.

Re:Sony

[Captain Splendid]

So, are rootkits entertainment or technology?

It's shitty technology, but it's damn entertaining watching 'em do it.

Re:Sony

[spikedvodka]

at this point, where it "looks like a duck, quacks like a duck, and smells like a duck"

I'm almost tempted to buy one, just so that I can submit the software to clamav, symantec, mcafee, et. al.

It looks like a virus, quacks like a virus, and smells like a virus, lets treat it like a virus

Re:Sony

[Anonymous Coward]

Well, that actually is not too uncommon.
Sony just bought Ericsson mobile phone division and relabelled their products as Sony and sold them in certain markets.
Someone in another market sees the Sony badge but does not recognize the product, because it is an Ericsson product not sold there.

Re:Sony

[Anonymous Coward]

Basically none of what you wrote above has anything to do with reality.

- a Sony Ericsson employee

Re:Sony

[AKAImBatman]

Your definition is the original definition, but it's not how it's currently used. By your definition, the BMG CDs were not rootkits either. These days "rootkit" is used on Windows systems to refer to software which modifies the kernel space for nefarious purposes.

Re:Sony

[ajs]

Please note the defenition of "rootkit," ripped from the beginning of the rootkit wikipedia article:

A rootkit is a set of software tools intended to conceal running processes, files or system data from the operating system.

If it looks like a duck, quacks like a duck, yada yada yada. This is a naive definition (I'll edit it later, with appropriate sources). Many programs attempt to conceal files which are not rootkits. Rootkits are the core of a type of software that seeks to hide its own existence. This Sony software does no such thing. You can see the software. You can remove the software. You can view every one of the software's files. Even F-Secure said that they believed the software was designed only with the security of the thumbnail drive data in mind, not with any subversion of the host (like the real Sony rootkit that got them in so much trouble). It only seeks to protect sensitive biometric data which should not be visible to all programs) from the normal Windows API. Again, I'm not defending how they did this. It's poor design, as it has huge security implications. However, it's not a rootkit, but a poorly designed driver.

We need to be more careful to cry wolf when there's, you know... a wolf. Otherwise, when some company decides to deploy a real rootkit again, no one is going to listen to us.

Re:Sony

[ZorroXXX]

I can confirm that. - an Ericsson employee.

Re:Sony

[Anonymous Coward]

If you're going to "confirm that" how about an explanation, eh?

Re:Sony

[Lord Pillage]

Don't forget about SPDIF (Sony Philips Digital Interface I believe) that's on so many mobos.

Re:Sony

[Anonymous Coward]

Gee, I wonder why a program that is made to hide data from anyone without the proper fingerprint is hiding data from the user? Must be something nefarious!!!

Clearly Sony should have instead put all the files in a directory called "c:\AttentionHackersFingerprintDataHere".

Re:Sony

[GIL_Dude]

Maybe it is, maybe it isn't - but it will probably be less stable as these folks have proven time and again that they can implement these rootkit like techniques, but they don't do it perfectly and may end up introducing vulnerabilities or more like just causing stability issues. The real problems would come in when you have a couple of these darn things loaded. You wouldn't even see them, but they could certainly cause the hated BSOD or hide your files accidentally or who knows what.

Re:Sony

[dougmc]

And anything that does anything bad is a virus (even if it's really a worm, or just a `click on me and I'll format your harddrive' piece of malware) ... yes, I've seen that mindset.

I think I'll stick with the original definition, even if some Windows users have decided to misuse the term.

Re:Sony

[Anonymous Coward]

Sony Ericsson is owned 50% by Sony, 50% by Ericsson. All phones, all over the world, are sold under the Sony Ericsson brand. The technical input comes from both parents.

This would take, what, one minut to find out using that thing called the Internet?

Re:Sony

[fastest fascist]

The story goes that it failed because Philips refused to put porn on the cassettes, which is of course very bad marketing :) If that means Philips refused to license the tech to the porn industry, then it's no wonder the system failed. Who wants to give the developer of a medium any say on what kind of content can or can't be sold on that medium?

Re:Sony

[modecx]

Huh, I thought memory stick was Sony's pride and joy. Don't PSPs use it as well? What on Earth could they be using besides one of the current flavors of memory stick?

Re:Sony

[JoshHeitzman]

Yes, it is a rootkit. It's modifying the kernel space to hide directories from the user. There are better ways of doing such a thing, but a rootkit has the advantage of keeping the files hidden from common methods of hidden-file detection. Something like a virus or trojan would tend to use a kit like this to make sure that it couldn't be found by antivirus software. Such kits also tend to mask the presence of their processes, just to make sure that they REALLY can't be detected.

The article doesn't say anything about modifying kernel space. Windows has a hidden file attribute built right into it, and from the article:

The Sony MicroVault USM-F fingerprint reader software that comes with the USB stick installs a driver that is hiding a directory under "c:\windows\". So, when enumerating files and subdirectories in the Windows directory, the directory and files inside it are not visible through Windows API. If you know the name of the directory, it is e.g. possible to enter the hidden directory using Command Prompt and it is possible to create new hidden files. There are also ways to run files from this directory. Files in this directory are also hidden from some antivirus scanners (as with the Sony BMG DRM case) -- depending on the techniques employed by the antivirus software. It is therefore technically possible for malware to use the hidden directory as a hiding place.

Since the command prompt can be used to enter the directory, create files there, and run files from there, the directory is not hidden from the Windows API, it's merely ommitted by default like any other file or directory marked with the hidden attribute. Windows explorer can have it's options tweaked so that hidden files will be displayed by default.

Re:Sony

[AKAImBatman]

Fair enough. Just as long as you're aware that when the media says "rootkit", they really mean "malicious kernel driver". :-)

Re:Sony

[nuzak]

> If that means Philips refused to license the tech to the porn industry, then it's no wonder the system failed.

It means you have been trolled, in classic AFU style.

As for "betamax porn": http://message.snopes.com/showthread.php?t=2126

Re:Sony

[ZorroXXX]

The company Sony Ericsson is a separate company where Ericsson and Sony owns 50% each (joint-venture), started six years ago. Notice that Ericsson still kind of produces mobile phones, but in the form of reference designs (with the basic functionality) which then is sold to Sony Ericsson who takes this as a basis for making the finished phone (adding applications, menus, mechanics, etc). We also sells this to other companies, although Sony Ericsson is our largest customer.

Re:Sony

[Anonymous Coward]

As mentioned by other posters, both Philips and Sony developed the CD. But there's more, they also worked together on the SP/DIF, also known as toslink, digital audio standard. Sony also created the DAT, which you may be more familiar with as the DDS tapes found in my Unix systems.

They've had their shares of screwups, but also some very successful products. The MD was quite successful in Europe as well. I had one until the flash-based mp3 players become really cheap.

Why the rootkit fiascos I don't know. Probably conflict of interest by being both an entertainment conglomerate and a technology company. Thankfully those rootkits only affect Windows, so I don't really care :)

Glass

Re:Sony

[Alioth]

Where have all the rootkits gone?
      Long time passing
Where have all the rootkits gone?
      Long, long ago
Sony picked them, every one.
      When will they ever learn?
      When will they ever learn.

Re:Sony

[davecb]

Grampa Sony died, and the whole place went downhill from there. --dave

Re:Sony

[jedidiah]

What marketing?

The proliferation of DOS and kludge clones was all viral.

The association with the monopoly of the day (IBM) started the ball rolling.

Re:Sony

[brundlefly]

Ditto. 10 days ago I searched all over Budapest for a replacement battery for my Sony camera. Every store I went into looked at me apologetically when they saw I was looking for Sony parts.

(I swore off Sony electronics about 5 years ago, but in this case I found the camera. Even as a *free* camera, I'm still getting burned by Sony's stupidities. And on a related note, if you're looking for a cheap Sony camera, check out ebay in a few hours... mine will be up there.)

Re:Sony

[mattpalmer1086]

Well, that's what I thought too. I should clarify - the phone uses Memory Stick Micro 2, which is even less well known than Memory Stick. For all I know, Sony do use MS for phones in Japan, but not the micro version 2, for sure.

Re:Sony

[mrchaotica]

They were also very successfull at putting DV/Firewire video in the hands of ordinary customers.

Yeah, but they didn't invent it. IIRC, Apple did that.

Re:Sony

[SenseiLeNoir]

...if you READ what i WROTE, i said that they were ALSO very successfull at PUTTING DV/Firewire in the hands of ordinary customers... I was just trying to say, they invented stuff.. and also they helped make stuff available to ordinary customers. Nothing wrong with what was said.

Re:Sony

[lordofthechia]

A remnant in that collaboration and be seen the form of the acronym for the digital hookups on CD-Roms - SPDIF (Sony Philips Digital Interface).

Re:Sony

[Anonymous Coward]

Stop spreading the FUD moron. Saying BluRay is Sony is like saying CD is Sony.

http://en.wikipedia.org/wiki/List_of_corporations_ supporting_Blu-ray

Re:Sony

[saigon_from_europe]

I had their laptop. After some time, its transformer stopped working. I live in Serbia, and it is a bit tricky to get decent technical support/service here, but Sony has huge store in Belgrade downtown.

I went there, but no luck. They do not sell laptops in Serbia (mine was brought from UK), so they gave me the telephone of one repair shop, but they were not sure if they could help me. Repair shop sent me to another repair shop, and so on... After three hops, they explained me what's the issue. Sony has very rigid standards for their repair shops. To be their certified repairmen, you have to guarantee that you'll solve all problems in 24 hours. They were not able to find anyone capable of that in Serbia, so they don't have any repair shop in Serbia.

That's very interesting policy. Instead to give second class service to your customers, you give them - none.

Re:Sony

[Anonymous Coward]

I guess that depends on what decade you grew up in. I remember when Sony,and any products made in Japan, were utter crap.

Re:Sony

[Hatta]

I doubt I'll buy any more Sony electronics... ever.

Re:Sony

[DrSkwid]

The + format is much better and will win out in the end. If DVD survives long enough :>

Re:Sony

[starnix]

correction: c:\attentionhackers\encryptedfingerprintdatahere\n yanyanya

Re:Sony

[InvalidError]

I wish IEEE-1394 managed to gain stronger traction in the external storage area - since FW is dual-simplex, it behaves much better in cases where large bulk transfers are involved when compared to the half-duplex Hi-Speed USB2. I usually get ~25MB/s while moving data between two chained FW boxes but I rarely get more than 15MB/s while doing the same thing with USB boxes even if I mess around to put them on two separate root hubs... and the CPU load is usually higher with USB boxes too.

Now I am slowly switching from FW&USB to eSATA for external storage... I could use an external eSATA-to-eSATA port replicator with hot-swap.

Re:Sony

[CrossChris]

The V2000 system was way ahead of the rest - if they'd added "auto-reverse", it would have been able to record up to 8 hours continuously on one tape, which would have killed off the competition...

Re:Sony

[Dahamma]

Generally, yes. A virus could check for the existence of one of these rootkits, and abuse its hidden locations to hide itself. Which means that a virus can hide from even rootkit detectors in the shadow of "legitimate" software.

Well, the thing to remember is that the software installed is for a USB fingerprint reader. I would say that if you are using biometrics rather than a simple password, you are adding security to your computer. The point of the hidden directory was probably to "try harder" to keep sensitive data hidden from people trying to break said securtiy. So, it's very possible that *generally* the computer is more secure, but *very specifically* there is one more thing that could be a problem.

That said, this does sound like a pretty overcomplicated and stupid way to hide data... yet more security through obscurity...

Re:Sony

[pixelite]

"The purpose of a rootkit is to let you get back in easily later..."

That would be a backdoor.

Re:Sony

[Thingummywut]

Yes!

Re:Sony

[kwark]

The last models did this with the "long play" option IIRC. So a total of 16 hours.

Truely a great system, it played 15 year old recordings like they where recorded last week. I was not amused with the quality of the VHS thingy that replaced the broken V2000 a couple of years ago.

Re:Sony

[smittyoneeach]

find out

I know what the verb and preposition mean independently, I'm just not sure that the two words, together, are bound in /. for any case, particularly sexual ones.

Re:Sony

[ukemike]

And yes, Sony had a role in VHS vs. Beta - Beta was Sony's format. Actually both VHS and Beta were Sony creations. Sony licensed the lower quality VHS to give them $$ to get Beta out there in the market. That was a bit of a mistake.

Re:Sony

[Harik]

Actually, "rootkit" told me all I ever needed to know about their "security". It's nothing but a USB image aqusition device and PC-side software to handle the matching and authorization. In other words - completely useless from a security standpoint. Think DRM - plug in the USB stick, it copies the decryption software, image matcher AND THE SECRET KEY to your harddrive, then uses a rootkit to "obscure" it.

The trick here is it's cheap as shit. Doing it properly on the keychain costs money - you'll need a decent processor to handle image aquisition and processing. Why bother with that when there's a 2+ghz CPU right next door on the bus? Worse, because they sell this crap as "security devices", they undercut everyone who spends the money to do it right. And of course they lie about how it really works, throwing buzzwords like "biometrically encrypted data storage" out.

tl;dr: snake oil.

Re:Sony

[McFadden]

Which fantasy version of Tokyo were you visiting? They use the same memory sticks and USB cables in Japan as everyone else.

Re:Sony

[DigiShaman]

That's very interesting policy. Instead to give second class service to your customers, you give them - none.

Which in turn provides first class metrics applauded by upper management.

Re:Sony

[dougmc]

That would be a backdoor. Often one thing has several names.

To be more precise, a rootkit helps you to `maintain root' -- often, part of that is letting you back in later.

Re:Sony

[batkiwi]

Oh, well if the catb jargon archive says it then it is DEFINITELY 100% legal truth.

Rootkits are generally understood to be anything that patches itself into the kernel in a hidden way. The etymology follows from the original unix rootkit definition, but that hasn't really been used in years.

Ignoring the root origin of a term is silly, but refusing to let go of it in a "you kids get off my lawn" sort of way is also immature. It's like the original "wiki" people stating that wikipedia isn't a wiki because by definition a wiki is ALWAYS editable by "anyone." Definitions change and are adapted.

Re:Sony

[Anonymous Coward]

truth is sony was never all that great. they made walkmans and they made playstation1. i suspect you grew up in the mid-80s and early 90s. sony has always screwed themselves. they've had great ideas and technology like betamax and mini-disc and blu-ray, but they always screw themselves by being too greedy. instead opening and compromising and sharing the pots of gold they create, they turn deaf ears on suggestions for improvements and offers to license the tech. they want it all...and they get it...although it is very little. they don't seem to understand volume. if you sell something to 1000 for $2 you make more than selling it to 100 people for $10. i think they call themselves protecting their image and good name by not allowing others to make cheap imitations, but this only works for Apple.

Re:Sony

[Anonymous Coward]

I will then declare MS Windows a rootkit since it is doing exactly the same with its protected directories and files... and even the administrator is denied access.

Re:Sony

[mattpalmer1086]

I can only assure you that they definitely don't use Memory Stick Micro 2, they didn't have any Sony cables for my camera in the biggest Sony building in Japan, and that no-one in Akihabara could find compatible items either.

As far as I could see, they seemed to use the more standard kinds of flash memory you find everywhere else, so in that regard you are probably correct. They just don't seem to use the proprietary Sony kinds!

Re:Sony

[r3m0t]

+ really is a better format, though.

http://adterrasperaspera.com/blog/2006/10/30/how-t o-choose-cddvd-archival-media/

Re:Sony

[chrish]

Tinfoil hat time!

USB causes higher CPU loads. USB is Intel's standard. Intel makes CPUs. Hmm...

Re:Sony

[PCeye]

No, VHS was JVC's creation, and support led by Matshuisa and other manufacturers, not Sony's.

Re:Sony

[InvalidError]

USB does not cause quite as much of a load as Intel's early prediction that MMX would make dedicated 3D accelerators unnecessary would have, should that claim have materialized.

Well, that graphics prediction could still come true but off by ~15 years: with all the SIMD extensions and CPU improvements since then, I read Intel's realtime raytracer is now starting to pull decent 720p framerates on the latest Core2Quad CPUs. The near-future DSP-like tack-ons should also help quite a bit. It is quite possible that by ~2012, "integrated graphics" will be equivalent to AC97-for-Video... little more than DMA + LVDS transceiver.

Re:Sony

[Vellmont]

A virus could check for the existence of one of these rootkits

Why check, when you can copy the installed driver and do the same thing? If this is going to be considered "legitimate" software, it's an excellent way to hide from malware detectors. It's not like virus or worm writers are really concerned about breaking copyright laws.

Re:Sony

[tomofumi]

Sony always likes to create something new from others, they called it "i.Link" rather than Firewire/IEEE1394...though it is compatible with the original spec.

Consider

[nlitement]

It is therefore technically possible for malware to use the hidden directory as a hiding place. Isn't software behaving like that already considered malware?

Re:Consider

[wizardforce]

Isn't software behaving like that already considered malware?

yes and no. it depends on what and how you use it. if you use the property of hiding directories as a simple way of keeping data from less experienced people [eg. slashdotters hiding the porn from their parents] then it isn't malware; in this case sony's software doesn't seem to be hding a directory for any good purpose, so yes it is malware.

Re:Consider

[B'Trey]

No. The distinction is WHO's doing the hiding. If a user on the computer intentionally hides files or directories from other possible users on the computers, it's not malware. It may or may not be ethical, depending on who's doing the hiding and why. Presumably, it's the owner of the computer and they have a right to hid info from prying eyes. If not, the issue is with the user's actions and not with the software. If, however, a program creates files or directories and hides them (by means other than simply using the H attribute, at least) from the owner/user of the computer, it's malware. It's understandable for a content owner to wish to protect their content, but that doesn't justify them altering the behavior of a computer without the owner's express understanding and permission for what they're doing.

Re:Consider

[HTH NE1]

No. The distinction is WHO's doing the hiding. If a user on the computer intentionally hides files or directories from other possible users on the computers, it's not malware. What if the hidden files or directories are software-based keyloggers and associated data?

Re:Consider

[Tom9729]

Agreed. When I do an ls of my home directory, I don't really want to see 50+ config files/directories.

I think the fact that Sony isn't hiding this directory with conventional means proves they're up to something shady...

Re:Consider

[Anonymous Coward]

I beg to differ, son.

if you use the property of hiding directories as a simple way of keeping data from less experienced people [eg. slashdotters hiding the porn from their parents] then it isn't malware

It is if it's their computer! Hiding your porn from Mom on Mom's computer constitutes abuse. Hiding porn from Mom on your computer doen't.

-mcgrew

Re:Consider

[Anonymous Coward]

he never said anything about hiding it on their computer, suppose for example that your parents use your computer and you dont want them sneaking around directories they shouldn't.

Re:Consider

[irc.goatse.cx troll]

If I want to log my own machine, its no more malicious than if I want to videotape my house -- It just changes from an illegal and unethical voyeur cam into a security camera.

Now, when others are subjected to either without knowing it then you get into ethics, but I'd still question the term 'malware' applying.

If you wanted to be the only user of your machine, keylogging it would actually be a good idea to see if your roomate is using it without permission.

Re:Consider

[Drgnkght]

Hmm, in that case I would probably make a folder on my desktop labeled "Secret Porn Stash - Click Here!!!!". It would never get opened. My mother would just think I was being a smartass. Not that I've ever done something like that, no sir.

Hidden files

[king-manic]

Is root kit now the new buzzword for "please send me traffic"? This isn't the same as a rootkit, it's just a annoyingly hidden directory. Can we tag this as FUD?

Re:Hidden files

[Carewolf]

Depends on how it accieves it. Hiding stuff is one of the primary functions of rootkits, though usually to hide themselves.

Re:Hidden files

[j00r0m4nc3r]

It doesn't matter what their intent is, they are using rootkit techniques to hide shit on your computer. This allows other parties to piggyback on that tech and install other nastier UNDETECTABLE malware. It would be like if your house cleaning lady leaves your front door wide open when she leaves. Someone could stroll in, fuck your shit up, and leave undetected. Definitely something to seriously worry about.

Re:Hidden files

[Applekid]

Hiding from the API is pretty important, actually. That's done by pulling the rug under the pointers to the functions that retreives lists of files/directories. If that's not a Windows rootkit, what is?

And much like their last rootkit, this one can easily be used to cloak files on your system and is pretty much a fantastic place to put your virus. Way to really push the limits, guys.

Re:Hidden files

[MontyApollo]

First sentence from wikipedia article:

"A rootkit is a set of software tools intended to conceal running processes, files or system data from the operating system"

So, it sounds like a rootkit as described by wikipedia.

Re:Hidden files

[king-manic]

It doesn't matter what their intent is, they are using rootkit techniques to hide shit on your computer. This allows other parties to piggyback on that tech and install other nastier UNDETECTABLE malware. It would be like if your house cleaning lady leaves your front door wide open when she leaves. Someone could stroll in, fuck your shit up, and leave undetected. Definitely something to seriously worry about.

However any old program can also do similar things by creating badly formated directory names. Rootkit implies a bit more. There are many files that employ the hidden property (like thumbs.db). Would we consider merely trying to hid enough to be a root kit? Or does it have to be malformed directory names? The previous rootkits made the Os unable to even see these files directly but this malformed directory can still be seen if you know what your looking for.

Re:Hidden files

[Anonymous Coward]

So every unix file with a "." prefix is a rootkit? Twat!

Re:Hidden files

[projectmalamute]

Those are not hidden from the operating system, try ls -a (twat)

Re:Hidden files

[Anonymous Coward]

except those aren't hidden from the file system api, they're only hidden from the user with the default ls output

Re:Hidden files

[chad.koehler]

While the '.' prefix will "hide" a file from plain view of a user, it is hardly hidden from the operating system.

Re:Hidden files

[Anonymous Coward]

Haha, way to prove you have no idea what the fuck you're talking about.

Re:Hidden files

[Anonymous Coward]

Tard, the '.' prefix doesn't hide the file from the operating system. It just doesn't show up in a 'ls' list. 'ls -a' will display the file.

Re:Hidden files

[The_mad_linguist]

No, it's the buzzword for "the editors don't RTFA"

Re:Hidden files

[Anonymous Coward]

The '.' naming convention is a convenience function, much like "hidden" directories in dos/windows, both of those have to be specifically honored by an application to have an effect.

Do you see the difference yet or does someone have to break this down for you step by step till you understand?

Re:Hidden files

[Kozar_The_Malignant]

>There are many files that employ the hidden property (like thumbs.db).

However, by clicking "Show Hidden Files and Directories" they are made visible. This, apparently, is not. This is not OK. It allows things to be hidden from scanners and from the owner of the machine, me. That makes it malware.

Re:Hidden files

[aztracker1]

If it doesn't show up in nautilus via ctrl+h it is... if it doesn't show up in windows with "show hidden files and folders" checked it is.... simply setting an *intended* file system attribute isn't the same as hiding from the operating system.

Re:Hidden files

[Anonymous Coward]

Nice of you to call names when you are clueless yourself.

"ls -la" will show "." hidden files meaning it isn't transparent to the OS but only to the user.

Whereas this *is* hidden from the OS meaning that "dir /A:H" doesn't show it.

Re:Hidden files

[HTH NE1]

And such a virus that hides in a directory hidden by a fingerprint-reading USB drive has a greater likelihood to have an opportunity to steal sensitive information, particularly information protected by a fingerprint-reading USB drive.

It's like installing surveillance cameras with deliberate blind spots.

Re:Hidden files

[Anonymous Coward]

Thank you for pointing that, we will need to donate some roo^w page editing tools to Wikipedia project.
Yours SONY co.

Re:Hidden files

[Anonymous Coward]

You know, there's a reason the OS lets you do stuff like this. For example, suppose you wanted to create a fingerprint reading system that allowed the user to secure files. To do so, you'd need to put the biometric data someplace that can't be normally read. Otherwise, it'd be pretty easy for someone to screw with that data and bypass the reader.

This article is more like saying "OMFG! If you give that key to the security guard, anybody could get it from him and rob your house!!!!"

Re:Hidden files

[_xeno_]

if it doesn't show up in windows with "show hidden files and folders" checked it is

There are actually two options: "Show hidden files and folders" and "Hide protected operating system files." To see everything, you need to select "show hidden files" and uncheck "hide protected."

"Show hidden files and folders" reveals files marked "hidden" and not "system" while unchecking "hide protected operating system files" shows things marked both "hidden" and "system." These include files like Restore Points (under \System Volume Information), NTLDR, and the page file.

Re:Hidden files

[UncleTogie]

This article is more like saying "OMFG! If you give that key to the security guard, anybody could get it from him and rob your house!!!!"
This article is more like saying "OMFG! Sony hired a security guard, sent him to my house, stuffed him in the attic, and didn't tell us a damn thing!!!"

Re:Hidden files

[nschubach]

But it's OK for Microsoft to hide files and folders from you using this same technique?

As I posted above:
http://it.slashdot.org/comments.pl?sid=280553&cid= 20375331

Re:Hidden files

[nschubach]

And neither is this file:

C:\>cd $extend

Go on.. try to cd to $extend from your command line...

Access Denied! OMGWTFBBQ!! Microsoft put a rootkit on my PC!

Re:Hidden files

[Kozar_The_Malignant]

No, it's not.

Re:Hidden files

[Anonymous Coward]

That's not quite correct, is it ?
You can't see the content of some folders and you can't open them...

Format before use

[VincenzoRomano]

Maybe formatting USB memories before usage would be a good move.
And using OS that won't run anything from the newly attached memry as a default would also help.

Re:Format before use

[andrewd18]

Maybe formatting USB memories before usage would be a good move.

That sounds like an awesome plot for Tron 3.0. The main character is digitized into the computer to determine why all the USB drives are suddenly losing their memories. Unfortunately for the Symantec security company hired to patrol the streets, the suspect program has eluded all searches so far...

Re:Format before use

[morgan_greywolf]

Maybe formatting USB memories before usage would be a good move.
And using OS that won't run anything from the newly attached memry as a default would also help. You mean like, say, Linux? ;)

Everytime I see stuff like this, I just chuckle and smile and say "Well, that's why I run Linux."

Re:Format before use

[VincenzoRomano]

No. I mean "non MS Windows". You choose.

Re:Format before use

[djdbass]

Yeah just stick it in your pc and format it before you stick it in your....

Wait...

Re:Format before use

[jimicus]

Maybe formatting USB memories before usage would be a good move.

It might, but this is a biometric USB memory stick - it requires a fingerprint before you can access files.

Most of these devices do the fingerprint reading in software, so without it you may as well buy a normal memory stick and save a bit of money. (On a side note: has anyone seriously investigated how secure these biometric memory sticks are?).

And using OS that won't run anything from the newly attached memry as a default would also help.

Good point. Does pressing shift when you insert the stick work like it does with CDs?

Re:Format before use

[morgan_greywolf]

Well, true. But I made my choice apparent. ;)

Re:Format before use

[penix1]

On a side note: has anyone seriously investigated how secure these biometric memory sticks are?

Well, if it is anything like the ones for security doors that are being pushed as "unbeatable" on Homeland Security then yes. The Myth Busters did a whole thing on it and beat it not once, not twice, but ALL the tries they did.

http://www.youtube.com/watch?v=LA4Xx5Noxyo

Re:Format before use

[Bob of Dole]

"If these USB memory cards are just like doors, then this mythbusters episode is relevant!"

Come on man, I know mythbusters is cool and all, but whaaaaaaaaaaaaat

Re:Format before use

[mr_mischief]

Like anything that's secured in software, the security is a joke when someone has physical access to the device. If it can be done in software, it can be bypassed in software given the chance to tweak or replace the binary.

Re:Format before use

[jimicus]

Not true, if it's implemented properly. If implemented properly, they'd use a half-decent symmetric key cipher based on a passphrase entered by the user to encrypt the data on the stick itself.

But there have been instances where the manufacturers have crippled the security, generally by storing the passphrase in plain text. Of course, such a route isn't practical with a biometric device so I wouldn't expect it to be hugely secure.

Re:Format before use

[Minwee]

That's assuming that the security wasn't developed by a finite number of monkeys, all sharing one typewriter.

Re:Format before use

[Arabani]

Good point. Does pressing shift when you insert the stick work like it does with CDs? It does. Pity only a relatively small number of people know that.

Re:Format before use

[Anonymous Coward]

I'm not certain that would work, even then.

It's been a while, so I don't fully recall, but for some USB sticks, a SanDisk Cruzer in particular, had some nasty self-installing software that would happen as soon as you inserted it. And formatting it did no good, apparently. The software was somehow hidden on the drive, and would come back even after trying to wipe it. You needed a third-party app in order to terminate it, which I broke down, got, and used it to clear it out.

It's possible there is a better way to format it than I might have. Additionally, I use Windows, so it might not have popped up on an alterantive OS. The only question is whether it could have been fully terminated without whatever software SanDisk pointed folks to.

Re:Format before use

[callmevinny]

Shift is handy but doesn't handle the case where someone else
puts media into one of your drives/ports.

To stop any media from auto-running, search for the registry entry
named NoDriveTypeAutoRun. Review Microsoft's information on this key
(via google) then run regedit and set every instance you find to the
value \xff. Reboot. Nothing (CD, usb, whatever) should ever autorun again.

Re:Format before use

[mr_mischief]

If they use a symmetric key cipher on the data itself, that does complicate things a bit.

If they use the passphrase itself as the key for the symmetric cipher, though, you have a short set of text the user can easily remember running against hundreds of megs of plaintext. The resulting crypted text would have all kinds of patterns in it.

It could be made better by having the passphrase run against a larger key. Your 10 to 20 character passphrase encrypts a 1024-bit key (which is only 128 bytes). Then, that could be used to encrypt the files, preferably in a chaining block cipher organization per file. If you can stand the space overhead a new 1024-bit random key embedded after every 1024 bits of plaintext and encrypted with the previous key would be nice, but CBC is generally considered good enough without the space overhead.

Of course, if someone has intermittent physical access to your stick, they'd just patch the part that moves the decrypted data across the USB connection (or, if the decryption takes place on the PC, they could do it in the driver). Even easier, given physical access to the PC where you use the stick, would be to just patch the OS or put a memory sniffing program onto the PC where you're working with the plaintext anyway.

In this particular instance, the passphrase being replaced by a fingerprint scan, one only needs enough physical access to store the pattern the thing makes from your fingerprint so they can resubmit it to the authenticator the next time around. You probably won't be changing your fingerprint once a month, so this gives them possibly unlimited access in the future even if you're continuing to use the device. A fingerprint and passphrase both are the only way to improve on this.

Oh, and one of the technical challenges to using the passphrase itself to encrypt the whole data store is that every time you change the passphrase, you need to decrypt and re-encrypt the whole store. That's some nasty overhead. Just decrypting and re-encrypting the 1024-bit key I mentioned earlier would be much more plausible.

Re:Format before use

[PastaLover]

To clarify, the doors have fingerprint locks.

Is there a way to permanantly disable this?

[RyanFenton]

I'd really rather not have this 'capability' when using windows, to allow software to hide files/directories on my system through these registry/filesystem techniques.

Is there anything that would break if one was to find a way to nullify this functionality in OS calls?

Ryan Fenton

Re:Is there a way to permanantly disable this?

[BronsCon]

Is there anything that would break if one was to find a way to nullify this functionality in OS calls?
No. But, the universe would begin to unravel as Windows became more secure.

Yes. That flushing sound you hear is my karma going down the toilet.

Re:Is there a way to permanantly disable this?

[adrianbaugh]

To disable this permanently:

1. Download kubuntu install CD
2. ???
3. Profit! (Well, insomuch as you won't have to worry about this kind of crap anymore.)

Oh, you want to keep Windows? You're probably SOL then.

Re:Is there a way to permanantly disable this?

[mdmkolbe]

If I understand the situation correctly, the reason this can't be permanently disabled is that the Sony software is installing a driver. A driver basically amounts to a way to inject code into the kernel, so the Sony software is actually replacing the Windows API functions in the table where they are looked up. The pseudo-code would look something like the following (appologies for wrong signatures or function names):

char *[] (*windows_api_function)(char * dir);

char *[] sony_version_of_the_function(char *dir) {
if (dir == "Windows) { return do_sony_version(); }
else { return windows_api_function(); }
}

int DriverInit () {
windows_api_function = windows_api_table[47];
global_windows_api_table[47] = sony_verion_of_the_function;
return 0;
}

One solution to this problem is to have drivers run in user-mode instead of kernel-mode (which is possible on Linux), but even with such a system there is likely to be other ways to do this.

Bottom line, any driver you install can open up this sort of security hole (possibly unintentional due to bugs in the code). This is why installing a driver usually required adminitrator rights.

Re:Is there a way to permanantly disable this?

[Kalriath]

Windows drivers do run in User Mode. Very few need to (or do) run in Kernel Mode. Mostly things like Video, Network, Host Bus, and dodgy Printer drivers do. What would be better is if Kernel Mode drivers could run in Ring 1 instead of Ring 0. Well, that would be better if newer processors actually HAD a Ring 1.

Why?

[thatskinnyguy]

How many lawsuits is it going to take before Sony gets it into their head that rootkit=bad? I, for one, am going to fight against our new malware overlords.

Re:Why?

[JrOldPhart]

Big company, Lots of momentum. The death will sadly be slow.

Re:Why?

[theshowmecanuck]

Bah!! There is enough info and history about Sony doing this. If someone has their computer (or whatever) screw up because they bought some root-kit-ish containing Sony product, then they deserve what they get. A lawsuit is not needed. Just stop buying their crap.

Re:Why?

[mtmra70]

What is happening is the Sony Execs are thinking "Rootkit!. This is bad". The program managers are misinterpreting it into 'rootkit!=bad'.

Re:Why?

[Anonymous Coward]

How many lawsuits is it going to take before Sony gets it into their head that rootkit=bad?

How many rootkits is it going to take before you people get it into their heads that Sony=bad?

-mcgrew

Re:Why?

[Gravatron]

You can almost hear the different departments banging their heads against the wall when one of them does stuff like this. I still find it hard to punish some of the departments for it, as well, the teams and management probabaly have no contact whatsoever with each other. I'm not gonna stop buying ps2/3 games because of something the BMG or PC acessories group did, i'll just stop buying from those divisions.

tsk tsk tsk...

[JazzyMusicMan]

They are simply conditioning a public growing weary of dishonest tactics and policies to steer clear of any products they produce. Sony has many divisions and has a presence in many markets, and they are royally screwing all of them up. First the music cd fiasco, now this, no wonder they were prematurely blasted for the SecuROM program that was talked about on here a few days ago. Most people automatically saw it as a rootkit or something they didn't want on their computer because of the record that Sony is establishing for itself. It doesn't matter that maybe it wasn't a rootkit or something malicious, if the public starts thinking that everything you produce is going to create security vulnerabilities and screw up their machine, they'll simply stay away without giving you a second (or third, [or fourth]) chance...

Re:tsk tsk tsk...

[Beer_Smurf]

Don't forget conditioning gamers to avoid them with the Star Wars Galaxies nightmare.

Re:tsk tsk tsk...

[broggyr]

"Whaddaya mean I can't jump over it. I gotta go around??"

kiosk

[SolusSD]

It seems to me that our personal computers are becoming more and more like kiosks where "vendors" install software they want and the "end users", ie) us, have less and less control over our own PCs. Think about it- DRM, (truly) hidden folders, subscriptino software, product activation, ..vista?

Re:kiosk

[jshriverWVU]

that's why some people are moving to linux and OS X. No matter what your believe on open vs closed source code. Linux is more "free" as in "freedom" than Windows, you don't hear people complaining about putting in a CD/DVD/USB key and having their system owned by some root-kit or DRM system that was installed w/o intervention. The freedom to own and do what I want with my hardware makes Linux a necessity. I agree with you. Running windows anymore is like running a kiosk. You pay for the hardware, and the software companies dictate what you do with that hardware. With linux, I dictate what I do with my hardware. It's that simple.

Re:kiosk

[Idaho]

It seems to me that our personal computers are becoming more and more like kiosks where "vendors" install software they want and the "end users", i.e. us, have less and less control over our own PCs. Think about it- DRM, (truly) hidden folders, subscriptino software, product activation, ..vista?

It seems to me that you are making the classic mistake of saying "personal computers" when you really mean "computers running Microsoft Windows".

Re:kiosk

[swb]

You're not kidding.

I keep trying to convince my customers they'll pay me less money in the long run to do clean setups on new machines versus the time spent both uninstalling conflicting software they won't/can't use (ie, Symantec AV, PDF Complete, etc) and the problems they inevitably run into down the road when the factory installed crapware craps the machine out, requiring a clean load anyway.

I've pretty much quit gaming due to all the copy protection crap that gets installed with most modern games (and interferes with legitimate software).

Another followup to your post mentions migrating to OS X/Linux, where I guess you're less victim to this kind of nonsense, but you're still locked in (to Jobs/Apple) or dealing with a lot less functionality (Linux zealots aside).

Re:kiosk

[robbiethefett]

http://www.ubuntu.com/

Re:kiosk

[spikedvodka]

I've pretty much quit gaming due to all the copy protection crap that gets installed with most modern games (and interferes with legitimate software). Look into PlaneShift http://www.planeshift.it/ it's free (as in beer) and while it's still in beta, much work is actively being done... /me can't say more due to NDAs

The code is free (as in speech), but the content is under a proprietary lisence.

like I said, it's still beta, but very playable, and there is a lot of work being done all the time

Re:kiosk

[Explodicle]

Because of this trend and because I don't like to have to mess with WINE, I just bought a console and started using that for games instead. Before now, I hadn't owned one since my old Sega Genesis.

Re:kiosk

[Anonymous Coward]

With linux, I dictate what I do with my hardware. It's that simple If only it was really that simple. You said you want to dictate what you do with your hardware- well, I want to to dictate *to* my hardware but unfortunately voice recognition software in Linux leaves a lot to be desired. Is it my hardware's fault? No, I can use DNS on Windows. Certainly, DNS on Windows isn't perfect, but it's ages ahead of anything I've found on Linux. Also, I'd really like to listen to my Launchcast station from Linux, but no go. Wait, you'll tell me to use Pandora/lastFM... but I thought you said I was allowed to dictate? It sounds to me that even in Linux the software (or lack of software) is dictating what I can do with my computer.

Re:kiosk

[Anonymous Coward]

Yeah! Next thing you know, some corporation is going to start charging us money to play on-line for games we already bought and paid for (when they are not even providing servers to host)!

Oh wait ... MS already does that. Enjoy "Live!"

Re:kiosk

[dpilot]

It seems to me that there has been come change of nomenclature from "Personal Computer" to "Windows Computer" in recent years. Not too widespread, but still present nonetheless.

Re:kiosk

[xhrit]

>It seems to me that there has been come change of nomenclature from "Personal Computer" to "Windows Computer" in recent years. Not too widespread, but still present nonetheless.

I noticed this too. Games are no longer labeled 'pc-cdrom' or 'pc-dvd' but 'windows cdrom' or 'windows dvd'. The entire games section at compusa was renamed from 'computer games' to 'games for windows'.

No doubt due to exclusive backroom deals by microsoft.

http://www.gamesforwindows.com/

Re:kiosk

[Hatta]

So you felt that software companies were exerting too much control over your computer, and you go buy a platform where you have even less control? I hope you modded that thing.

Re:kiosk

[ball-lightning]

Bingo... 'cept s/he doesn't care. What's the point of modding an X-box 360... really? Sure it is fun to run Linux on it, but I have a PC for that. When you buy a game console, you are paying for the ability to play games, nothing else. It's not a PC, meant for general tasks. It's unfortunate the parent felt they needed to buy a game console because gaming companies are forcing DRM on their customers, but it's not at all hypocritical, imho.

Re:kiosk

[Hatta]

I dunno about the 360, but modding the original Xbox lets me upgrade my hard drive. It lets me keep games on my hard drive. It lets me play emulated games. It lets me view any kind of media I want without buying anything extra. And it lets me manage all this media (audio, video, AND games) through ftp, HTTP, or SMB. So there's definately a point to modding a console.

Re:kiosk

[Obsidian Butterfly]

Why do you think they call us "consumers"?

God, I hate that word. I've hated it my whole life.

Re:kiosk

[Lost Engineer]

Last I checked all you could do with a modded Xbox 360 was play pirated games, due to code signing.

It seems their method of stopping from running unsigned code is a bit better than "let the PC roll over to zero" this time.

Re:kiosk

[SolusSD]

for the record-- i run linux exclusively

Re:kiosk

[Explodicle]

I was unclear in my original post... I still have my computer, and use THAT for the added Xbox functions you just described (except for storing games on the HD, I have to use a shelf for that).

Wow...

[shoptroll]

Did anyone read the article before coming up with the post title? They say right in the middle of the article that it's not a rootkit, and "It is our belief that the MicroVault software hides this folder to somehow protect the fingerprint authentication from tampering and bypass. It is obvious that user fingerprints cannot be in a world writable file on the disk when we are talking about secure authentication. However, we feel that rootkit-like cloaking techniques are not the right way to go here."

This is also nothing new in terms of USB drives. I have a USB flash drive, which I can't remember the name of, that essentially keeps a secure partition hidden from Windows unless you run a special app to put in a password to make it visible to Windows.

Re:Wow...

[sacrilicious]

Did anyone read the article before coming up with the post title?

Even if it turns out to be a misleading headline, I can live with Sony being vilified some more. I'd consider it appropriate collateral payback for their original rootkit foray.

Re:Wow...

[Anonymous Coward]

Umm... creating a hidden folder in c:\windows is quite different than having a hidden partition on the device. Perhaps you should read the article again, and pay closer attention to the details.

Re:Wow...

[LarsG]

Other programs (i.e. malware) can use the hidden directory to hide themselves. Not to mention potential stability problems caused by the software altering core OS functions.

Password protected hidden partitions don't patch OS function pointers and can't really be (ab)used by malware in the same way, so not the same thing.

Re:Wow...

[empiricistrob]

While I agree that using the term rootkit is highly questionable in this context, I think there's an important distinction between having a hidden partition on a USB drive and what this driver does. This driver installs an inaccessible directory in C:\windows\, not on the USB drive. Still, what this driver does certainly doesn't fall under the category of rootkit, IMO.

Re:Wow...

[makomk]

That depends on your definition of "rootkit". It's using a driver to conceal the existence of a directory from standard Windows APIs and programs, which is very definitely a rootkit technique.

Re:Wow...

[gad_zuki!]

If article contains word 'rootkit' then lots and lots of pageviews.

Example: See Bioshock.

I'm really getting sick of this. Its like the C-class bloggers and clueless tech writers have discovered a magic word that gets them all the ad impressions they want, and techies dont seem to care as the exposure just lets them bitch and moan. Facts be damned.

Re:Wow...

[Library Spoff]

My Disgo USb drive does this. Will it did till I deleted the software/partition.

Re:Wow...

[Idaho]

Did anyone read the article before coming up with the post title? They say right in the middle of the article that it's not a rootkit, and "It is our belief that the MicroVault software hides this folder to somehow protect the fingerprint authentication from tampering and bypass.

The intent is irrelevant w.r.t. the fact whether or not it uses rootkit-like behavior to implement it.


  It is obvious that user fingerprints cannot be in a world writable file on the disk when we are talking about secure authentication.


This is why file access permissions/restrictions where invented in the 1970's.

This is also nothing new in terms of USB drives. I have a USB flash drive, which I can't remember the name of, that essentially keeps a secure partition hidden from Windows unless you run a special app to put in a password to make it visible to Windows.

That is a completely different technique at about 10 different levels. Of course the driver of some USB device may chose to reserve parts of the storage on said USB device for internal usage such that it cannot be (easily) accessed by normal means (i.e. the API offered by said driver). However, "cloaking" parts of the driver itself using rootkit-like mechanisms has, well, about nothing in common with such techniques.

Re:Wow...

[shoptroll]

and it allows every "Comic Book Guy" esque nerd get their paranoia on for the day.

The BioShock problem got blown way out of proportion and sent me into angry curmudgeon poster mode in an off-topic section on another site railing against the idiocy of people. I swear the internet is only good for three things these days: stupidity, paranoia, and yes: porn.

Re:Wow...

[MontyApollo]

What does something have to do be defined a rootkit? There seems to be different definitions going around, but the people saying it is not a rootkit are not really spelling out why.

Re:Wow...

[The MAZZTer]

This is also nothing new in terms of USB drives. I have a USB flash drive, which I can't remember the name of, that essentially keeps a secure partition hidden from Windows unless you run a special app to put in a password to make it visible to Windows.

That's different. Windows can't "see" more than one partition on a USB flash drive... which is why the Disk Management MMC snap-in won't let you create more. If you make more than one partition Windows only mounts the first one it sees.

Of course this assumes you're talking about actual partitions. More likely you're confusing a virtual drive for a real partition; I'm thinking TrueCrypt, which is promoted by many as a way to keep files safe and encrypted on your thumb drive. You enter a password and an encrypted file on the first and only partition on the drive is mounted as a virtual partition on it's own drive letter. Nothing is ever hidden from Windows; Windows never knows that the simple file is supposed to be a partition, nor what the encryption key is that is needed to decrypt it. TrueCrypt supplies the first function, while the user's password or keyfile supplies the second. The only things hidden are the things the user explicitly wanted hidden by making the TrueCrypt Volume and putting files in there.

Re:Wow...

[Anonymous Coward]

When you need a rootkit to protect your fingerprint authentication, the authentication is shitty to begin with.

Re:Wow...

[kwikrick]

Yup. I have a flash drive (Imation) that hides a small partition (1MB) from windows too. Or rather, XP stupidly doesnt show it. Under linux, both partitions show up. On a Mac, only the small partition shows up. (oops, Mac users get a bad deal from this brand).

The only file on the small partition is the PDF user manual.

Re:Wow...

[ivan256]

The same thing was true about the "first" Sony "rootkit". It didn't "root" your machine. It just used the same techniques that actual rootkits use to hide itself from the user. Add a little anti-sony bias, and a lack of technical understanding, stir, and you get a headline like we see here.

Re:Wow...

[Obsidian Butterfly]

That depends on your definition of "rootkit".

My definition of "rootkit" is gradually being expanded to include anything Sony does these days.

Then again...

[Anonymous Coward]

There was a moderate buzz about Bioshock installing a rootkit that turned out to be false.

Rootkits aside...

[Skiron]

... which I still do not think should be called 'rootkit' in these instances, as this is what MS code allows for - it is part of the system and designed to be so.

The issue here is the biometric stuff. If your CC number gets stolen, or your password gets hacked, you can simply cancel the old CC/reset your account etc.

Now, what happens when your data 'fingerprint' [retina scan, whatever] gets hacked and compromised? Get new fingers? Get new eyeballs (ala Tom Cruise!)?. I think not. The sooner people learn not ot buy and trust this crap the better - but thinking, perhaps the people that buy this crap deserve a MS designed rootkit anyway.

Re:Rootkits aside...

[deftcoder]

A malicious driver is being installed that patches the Win32 API ( FindFirstFile() and FindNextFile() ) not to report the presence of a directory when enumerating through your C:\Windows folder.

How is this *NOT* a rootkit? This is the very definition of one!

Re:Rootkits aside...

[Skiron]

Because the windows code is DESIGNED to do this - you don't need to back door anything to do it.

Remember the WinNT4 client WinNT4 server difference? It was one registry key that was needed. Much the same is going on here with Sony (which they used for the CD [sic] rootkit]. MS DESIGNED it to work this way to allow stuff to be hidden.

It is not a rootkit. It is a usage of the system abilities allowed to do this.

Re:Rootkits aside...

[deftcoder]

Rootkit doesn't necessarily imply 'backdoor'. A rootkit CAN open a backdoor, but it's possible to rootkit a system for other reasons.

Example: Daemon Tools, a popular virtual drive program, uses rootkit-esque behavior to hide its drivers from the various game copy protections it aims to defeat. It's a rootkit for a legitimate purpose. This is not.

It's a malicious driver attempting to hide things from the user without their consent. QED.

Re:Rootkits aside...

[Skiron]

OK, I see what you are saying, but the point is NOTHING gets changed on the system - it uses MS code handles to employ the 'rootkit' - there is no subterfuge involved on the system at all!

I think MS built in all this from trying to keep the innards so secret squirrel it is now coming back to bit them. Mark Russinovich, remember, was the one who sussed the secret squirrel stuff on the first Sony attempt at this - he (and Company) was very soon bought by MS to SHUT UP about it.

Re:Rootkits aside...

[NumbDr9]

A malicious driver is being installed that patches the Win32 API ( FindFirstFile() and FindNextFile() ) not to report the presence of a directory when enumerating through your C:\Windows folder.

[Allow] or [Deny]

Re:Rootkits aside...

[Anonymous Coward]

Er...it's security software...it's no more "without the user's consent" than virtual drive.

Re:Rootkits aside...

[deftcoder]

... Other than the fact that one scenario is desired, while the other is not.

Re:Rootkits aside...

[Lost Engineer]

It's actually cancel or allow, although your version does make a lot more sense.

Re:Rootkits aside...

[Anonymous Coward]

...so there is a hidden rootkit inside MS Windows ?
if I were you I would consider sueing MS.

Look at the bright side

[nlitement]

You can now hide porn effectively, with little effort and money!

A Nasty Trick

[Sigismundo]

It reminds me of the time that some friends and I discovered that a labmate had left himself logged in as root on a virtual console at his Linux workstation. Here's what we did:

1. Created a directory with the name " " (single space)
2. Added that directory to his path
3. Wrote a Perl script that would spit out a random quote from zippy 1/3 of the time, and then execute the program pointed to by argv[0]
4. Populated the special hidden directory with symlinks to the perl script, each given the name of a common command like ls, ps, and so on.

So whenever he ran a common command from his shell, he would first get a random quote from fortune appearing, followed by normal command output. He figured it out pretty quickly, but I like to think that there were a few moments where he entertained the idea of his workstation gaining sentience.

Re:A Nasty Trick

[MrBulwark]

See, if you had a real OS like Windows, this kind of security problem wouldn't...oh...nevermind.

Re:A Nasty Trick

[sholden]

Whenever people left themselves logged in (not as root, since no one used root...) we'd always add

echo sleep 1 >>$HOME/.bash_profile

to their .bash_profile

Re:A Nasty Trick

[Anonymous Coward]

With friends like you, it's a good thing I use [t]csh.

Re:A Nasty Trick

[El_Oscuro]

Windows has lots of good tools for stuff like this too. I once wrote a simple C program which would print out ASCII 7 (beep) randomly every 20 minutes or so, then used the NT Resource Kit to install it as a service. However, my evil coworker accomplice changed the requirements so it would beep randomly every 2 minutes. Instead of the Chinese water torture I envisioned, my other coworker victim was pulling his hair out ("WTF is wrong with my computer?") within a few hours of getting back from vacation. Just because you are paranoid doesn't me others aren't out to play jokes on you.

SUCKERS! What did you expect?

[Anonymous Coward]

Fool me once, shame on you. Fool me twice, shame on me.

How fucking stupid can you people be? Stop buying Sony!

-mcgrew

Re:SUCKERS! What did you expect?

[Chutulu]

yeah let's play with our wii's instead...

Re:SUCKERS! What did you expect?

[Rabid Cougar]

Fool me once, shame on you. Fool me twice, shame on me.

You got that saying wrong. I believe it's, "Fool me once, shame on -- shame on you. Fool me -- you can't get fooled again."

Is this a problem under Linux too?

[rdavidson3]

I realize that this is an issue under Windows, but can this cause issues in Linux?

Also, can we see the directory and the contents and determine the reasons behind this?

Re:Is this a problem under Linux too?

[Anonymous Coward]

I realize that this is an issue under Windows, but can this cause issues in Linux?

This is a malicious driver (installed by the user) that patches the API. Could this be done in Linux?

I don't see why not (but it would be interesting to hear from someone with solid knowledge of Linux internals). There are some quite scary rootkits for Linux out there.

Re:Is this a problem under Linux too?

[ThePhilips]

It's possible. For particular known in advance kernel version. In other words, thanks to multitude of Linux configurations, such attack vector isn't practically feasible. Rootkits try to patch syscall table but it is not always trivial from user-space. And again - not reliable. Now with so short update cycle (about 3-6 month) I haven't seen Linux root-kits in a wild for very very long time. Before in 2.0/2.2 times there were root-kits as well as popular security systems against them.

On other side, Linux file system API does support so called namespaces (or what windows calls mount points). IOW it is possible to remove something so it would be invisible to user and his/her applications. But then it is feature for user - not against user - so s/he can easily see that something was manipulated and undo the manipulations.

Re:Is this a problem under Linux too?

[Wyzard]

On other side, Linux file system API does support so called namespaces (or what windows calls mount points). IOW it is possible to remove something so it would be invisible to user and his/her applications.

A mountpoint in Windows means basically the same thing that it does in Linux: a place where the root of one filesystem appears to be a subdirectory on another filesystem.

A namespace is something different: it's the set of all mounts seen by a running process. If you launch a program in a new namespace, it can mount a filesystem and see its contents without making the filesystem appear mounted (and therefore the contents visible) to the rest of the system. (Or, it can unmount a filesystem that's already mounted, and it'll no longer be able to access those files, but everything else on the system will. But that's less interesting.)

So, a malicious program running with root privileges (CLONE_NEWNS is a privileged operation) could mount a ramdisk that nothing else can see, and store files there. (Using a real disk partition is trickier, since it'd have to find a partition that isn't already in use.) However, the program itself would still be running as an ordinary process, visible with "ps" and similar tools, and able to be killed by the administrator. It could patch the kernel (a rootkit technique) to hide its presence, but if it's sophisticated enough to do that, it could also just patch the kernel to hide files, and wouldn't need to bother with namespaces and hidden mounts.

In general, though, the conservative assumption is that if a malicious program manages to run with root privileges on your system, you're hosed. The front lines of defense are avoiding letting malicious code run in the first place, or if it does, making sure it can't get root. (That's why we use non-privileged accounts for day-to-day work; compare to Windows, where users on most desktop systems have Administrator rights all the time. Combined with Autorun, you can be rooted just by putting a malicious CD in your drive, or plugging in a malicious flash drive.)

Re:Wow..., double Wow.

[whoever57]

Did anyone read the article before coming up with the post title?

Apparently you did not.

They say right in the middle of the article that it's not a rootkit

Where? They do not claim that it is a rootkit, but they consistently describe its behavior as "rootkit-like".

You can't solve this on a single system.

[argent]

The issue here is the biometric stuff.

This is an inherent problem in biometrics: you have to trust every scanner that takes a reading not to be trapdoored.

The entire authentication process has to be performed verifiably in the scanner hardware and firmware, and the scanner itself had to be trusted - either it's your scanner or it belongs to someone you have to trust anyway.

But no reversible form of the biometric information can be transferred to potentially untrusted storage.

Re:Wow..., double Wow.

[shoptroll]

Since when is something x if it is x-like?

Do you mean Loot kit ?

[Anonymous Coward]

Very sim poe
loot kit This
  Buy products with your loot from some other company who doesn't loot kit

Just stop buying all Sony stuff

[Anonymous Coward]

I wanted a new DVD burner recently. Some good reviews on Sony but then I remembered their infectious love for customers so no Sony drive for me. Just buy someone else's product.

what a bunch of weasels

[swschrad]

down around the courthouse, they have some terms for mutts who don't learn and keep on doing the same crimes.

the classy term is "recidivist."

of the others, we can probably safely post "weasel," "snake," "bastard," "crook," and "lowlife."

HDTV is around the bend, and I'm remodelling the basement soon to accomodate its new wiring requirements. Sony, the snake-in-a-box company, is not going to be a part of this undertaking.

Desensitized

[Dachannien]

The overuse of the term "rootkit" points to (at least) one thing: we've become so desensitized to security hazards that it takes a new buzzword for nefariousness to grab people's attention. Regardless of whether this is itself a rootkit or not, it's still a security hazard, and what's perhaps more ironic, that hazard was created in an attempt to effect "security through obscurity".

Re:Desensitized

[MikeBabcock]

Its annoying isn't it? Rootkits are software that allow administrative access to a computer without permission, typically remotely.

Many computer programs, since longer ago than I've been alive have used various obscure methods of trying to hide themselves or 'protect' themselves from users and other software.

Now try not to be all Sony-hating for a moment -- if you were handling the number of tech support requests Sony does for people who uninstall the software that lets them access their "secure" memory stick files, wouldn't you try to make it unremovable? Its not like Microsoft provides a "this software is system software and really shouldn't be removed" option in the API or anything.

Re:Desensitized

[drew]

Congratulations on being probably the first person I've seen in at least six months to properly use the word "effect" as a verb.

Re:Desensitized

[Anonymous Coward]

Rootkits are software that allow administrative access to a computer without permission, typically remotely.

No, that's backdoors.

A root kit is the program you use to hide what you are doing once you DO have access (e.g. through that back door). It does this by hijacking system calls and filtering out your processes or files. Which is EXACTLY how this works.

Re:This article is retarded

[LarsG]

First, the article has so many grammatical errors, that it's laughable.

F-Secure is from Finland. You try writing Finnish some time.

My "Windows API" as this article calls Explorer, is already set to view hidden folders.

Turn in your geek card at the door when you leave.

This is a driver that patches the Windows APIs in order to hide a directory. It will not show in Explorer or in any other program for that matter, even if Explorer is set to show 'hidden files'. Rootkit hunters like Blacklight and Rootkit Revealer do not flag regular 'hidden directories'. They read and parse the raw on-disk directory structure (that is, they have their own NTFS parser) and compare that to what the Windows FS API reports.

Ha! it melted anyway!

[Anonymous Coward]

My 11-year-old bought one of these a couple of days ago.

It got so hot when he plugged into the USB port on his linux machine that the plastic casing literally melted. He took hold of it and yelled "Ow! it's hot!" and when I looked at it the whole case was drooping and had his thumbprint in it.

At the time, I was mildly annoyed, but now I'm going to tell him he didn't want that one anyway. We'll be returning it for cash and buy another brand at a different store.

Re:Ha! it melted anyway!

[Anonymous Coward]

there isnt that much power that flows through the USB port, not enough to cause that much heat surely - and any power surge which could occur from a short circuit would trip the hardware protection circuits.
I call FUD on this one.

Re:Ha! it melted anyway!

[Fooker]

Why would you want to goto another store to get a thumbdrive? That makes no sense, the company your mad at is sony, not the store you bought it from.

Re:Ha! it melted anyway!

[bitrot42]

> when I looked at it the whole case was drooping and had his thumbprint in it

Well, after all, it *is* a thumbprint reader!

(I agree with other poster, there's no way a USB device can suck enough power to melt itself.)

Re:Ha! it melted anyway!

[WaXHeLL]

5V @ 500mA max == 2.5W. That's absolutely nothing in terms of power.

Re:This article is retarded

[deftcoder]

Hi.

They are patching 2 API functions, FindFirstFile() and FindNextFile(), not to report the presence of a directory. They are doing this by loading a malicious *DRIVER*.

This is quite different than simply toggling a flag for a given directory.

Not an Accident

[Nom du Keyboard]

This is no longer an accident with Sony. No longer a simple lapse in judgment. This is a bad, ugly, habit on their part now, likely caused by the dichotomy of trying to be a content producer and a tech company at the same time.

Re:This article is retarded

[Anonymous Coward]

Consider:
  Most computer users just are consumers .
Purchase decisions are digital.
All they know is legit or not legit
One man or woman may be the technical guru for 50 people or more
I am such a man, and my answer to the 50 is,:
No! You don't want to buy that one
Get another brand instead
  I think that I am not alone in my feelings and anger

Wikipedia?

[Spy der Mann]

So, it sounds like a rootkit as described by wikipedia.

Not for long! *rushes to edit wikipedia*

"A rootkit is a set of software tools intended to conceal running processes, files or system data from the operating system, except when it's with Sony products"

There! Now by definition, sony's isn't a rootkit anymore! :D

(Legal Disclaimer: This was actually a joke, I didn't vandalize wikipedia or the like. <-- you can't never be too sure these days)

Re:Wikipedia?

[Anonymous Coward]

Yes, but I did. And Spy der Mann will take all the blame, bwahaha.

Re:Wikipedia?

[Spy der Mann]

Just remember your IP is recorded :P

Oversimplification

[Phil John]

It wasn't just the availability of adult titles. What really scuppered BETA was the short length of the tapes compared to what was available with VHS.

Re:Wow, it's a hidden directory

[Anonymous Coward]

Big difference between hidden due to file system settings (ie don't show 'hidden' files) and the os not being able to see there are files there in the first place.

Last straw for me...

[SlashdotCrackPot]

I just had to go admit to my damn boss that I (a diligent (also been referred to as 'anal') security minded individual) that thanks to my "handy" pen-drive that at LEAST 25-30 of our client's servers, not to mention our office equipment now have root-kits on them. That was it for me, now I just have to find a replacement product for the several ux380 we were looking at for toys for the boys.

I imagine though, that an outburst of uncontrollable laughter from my boss while telling him about this is a sign of job security.

Is there an anti-rootkit utility that would be updated/recent enough to facilitate this infection? Or the fact that I can view it from command line mean that I can remove it manually from there? I don't have to worry about re-infection because I already threw 2 of them straight in the trash, no use even giving them to a friend.....

Re:Last straw for me...

[Anonymous Coward]

Since you are a business at a loss for needing to replace them, you should sue sony. You should probably make it class action for everyone that bought it, that way you have enough teeth.

Re:Last straw for me...

[The Cisco Kid]

There is some anti-rootkit system available that prevents that vast majority of this crap from ever being installed on your systems in the first place. Its called 'not using Microsoft platforms'.

Re:Last straw for me...

[Guaranteed]

Does anyone else ever get sick of these smarmy responses from slashdot users?

The parent is obviously working in a business environment where he serves CLIENTS. Read he does not choose the kind of systems he works on. Maybe you are one of the priveleged few who can insitute wide-ranging changes in corporate policies to suit your whims and desires regarding Operating System choices, but the vast majority of us do not have that luxury. Do I use and love Linux? Yes. Do I work with Windows in my 9-5 life? Also yes, and there's not a thing I can do about it.

So thanks for nothing buddy, you're about as much use as a poopy flavoured lollipop.

Goodbye Karma.

Re:Last straw for me...

[Emetophobe]

There is some anti-rootkit system available that prevents that vast majority of this crap from ever being installed on your systems in the first place. Its called 'not using Microsoft platforms'.

I hate Microsoft as much as the next slashdotter, but that's simply not true.

Linux and Unix used to be just as vulnerable to rootkits as any Windows sytem, the difference is Windows is much easier to gain root access to install a rootkit. I repeat, Linux and Unix are not immune to rootkits. If you can hack your way into a system, you can install a rootkit.

For instance, the famous lrk4 (Linux Root Kit 4): http://staff.washington.edu/dittrich/misc/faqs/lrk 4.faq

From the wikipedia entry on Rootkits:

Rootkits exist for a variety of operating systems, such as Microsoft Windows, Mac OS X, Linux and Solaris

Re:Last straw for me...

[The Cisco Kid]

Microsoft in general, and Windows specifically, are *less* useful than a poopy flavored lollipop.

And there is something I can do about it - refuse to touch it with a ten foot pole.

Someone who bought a particular make car, and it blew up, and went back and bought the same brand of car again, and it blew up again, and who have done this over and over with the same results, and yet *still* keeping going back and buying from the same car maker, apparently are incapable of learning.

If you chose to work on, use, support, or worse, recommend, Windows systems, then you are a fool. Enjoy being locked-in to your monopolizing corporate overlord - I'll enjoy laughing at you and everyone like you.

Yes, it is your right to chose whatever brand of OS you want. But when your choices have less than desirable results, thats your fault, not anyone else's.

Re:Last straw for me...

[The Cisco Kid]

So feel free to point out the URL of the story where $big_media_company developed a product with a rootkit for anything other than Windows.

Of course, why anyone would even consider installing some proprietary binary-only software to use a flash drive, let alone consider or allow it to be the automatic default, just boggles me. If I bought a flash drive, and it contained some such drive you can beleive the first thing that would be done is a clean wipe.

(And yes, I get that it was some sort of encryption software for 'added (in)security'. There is plenty of Free Software that implements real security without needing to rootkit your system to do so)

Compromised?

[phorm]

How about when the machine gets compromised, aka a file in the hidden directory gets infected, or a virus decides to nest in there. Are you virus-scanners going to find the file, or are they being prevented so because this thing UPDATES A CORE FRICKING API ON YOUR MACHINE. Yes, it's a rootkit. It might not be used for malicious purposes quite so much as the sony-CD's were some time ago, but that doesn't mean it's not compromising the overall security of your system. It's an attempt at security-through-obscurity that endangers the overall system.

Besides - to put it in your terms - if somebody get ahold of your "data fingerprint," what are they going to do? Make fake eyes? Fake fingers?

Re:Wow..., double Wow.

[MontyApollo]

It all depends on your definition. What was described in the article satisfies many people's definition of a rootkit, no matter how the authors chose to word it.

Everybody saying it is not a rootkit needs to define rootkit.

The example you used in your earlier post about partitions on memory sticks is completely different than what is happening here (the windows API is being modified to hide a directory on the c: drive)

Memory Stick?

[Doc Ruby]

How about those MemorySticks that have no competition for filling the slots in Sony equipment (including PCs) that requires them?

More Baloney from Sony...

[AetherBurner]

I patently refuse to buy Sony products. Their quality went downhill way before all of this digital shenanigans. The only thing that I have that actually still works for 16 years is a My First Sony "Electric Etch-a-Sketch" that you plug into the TV. All the other Sony junk has died within one-two years of purchasing. At least my IBM laptop didn't have a Sony battery in it.

Nitpickers' Addendum

[The MAZZTer]

1. Windows' inability to see more than one partition on a USB drive is not a rootkit trait, but a bug (or "feature") or unimplemented functionality.
2. And by "TrueCrypt" I also include other possible programs with the same or similar functionality.
3. Technically TrueCrypt Volumes are hidden from Windows, but I mean not in any way where you could take the drive, put it in another computer in a controlled environment and mount the drive as read only, and see things you couldn't see in Windows. The encrypted file and it's contents are viewable under all conditions... they just don't mean anything unless you use TrueCrypt.
4. And by the above I mean not including things that are, by design, hidden such as \$MFT on NTFS drives which holds the master file table, etc).
5. Finally, the Sony Rootkit #2 hides files from the user that don't need to be hidden and which the user can't make use of, AND which can be used by malware to hide their own files. On the other hand, TrueCrypt is used BY users to hide files, the user who uses it will be able to see the files hidden, it can only be utilized by Windows, the user, and any potential malware when the user explicitly mounts the drive and before they unmount it. Malware which installs itself cannot do anything from the drive when it is unmounted since the drive can't be accessed then. In the Sony scenario, the software has full control (but allows malware to take some of that control) and yields none of it to the user nor allows the user to use it themselves (well they could but I assume the average user isn't going to know about this, much less have need of using it. If they did need it, they'd Google and find TrueCrypt).

A virus could put its files in the hidden folder

[Joce640k]

A virus could put its files in the hidden folder, so yes, you're more vulnerable. SONY is doing the virus writer's job for them.

Re:Wow..., double Wow.

[Anonymous Coward]

Say you are a researcher, studying stuff. Like maybe viruses (the biological kind). You come across a new virus in the wild. You describe it as flu-like, until you are able to really study it and say yes, the virus really is a strain of influenza. Your argument is that the words "flu-like" precludes it from being the flu, when in certain situations "flu-like" means it is very likely to be an influenza virus.

If it looks like a duck...

[IBBoard]

If it looks like a duck, quacks like a duck,...

Then lawyers for some large corporation will argue that it's actually some previously rare form of feathered marsupial?

Re:If it looks like a duck...

[nschubach]

Ooh, and since this virus **scratch** duck cannot be found populated throughout the majority of the US, it should be covered by the extinction acts and listed as a protected animal!

Re:Wow, it's a hidden directory

[Anonymous Coward]

-1 Retard
Try ls -a (show hidden files) Much like windows "show hidden files" option. This is not the same as hooking into the kernel driver to make sure that the hidden folder is never shown. If the OS can't see it then it is a rootkit, or at least rootkit-like

Desensitized to the one real problem

[Sloppy]

we've become so desensitized to security hazards that it takes a new buzzword for nefariousness to grab people's attention.

What's sad is that it's the same old "security hazard" that we've been hearing about for decades. The hazard is not Sony's software or any of the software's mechanisms. The hazard is that users decide to execute it. Why are people still desensitized to that, in spite of the fact that it's the cause of 99% of people's computer security problems?

If you don't have reason to trust it, then don't run it (unless you've got a damned good sandbox). And Sony already showed that they're not merely 'iffy' on trust -- they're known to the actively hostile. And people still ran it. Wow!

You're missing the point.

[KingSkippus]

It only seeks to protect sensitive biometric data which should not be visible to all programs) from the normal Windows API.

The intentions behind the software are irrelevant. The only thing that matters is what it does. What this software does is an end-run around the operating system, deliberately hiding things that should not and need not be hidden.

Why shouldn't it be hidden? Because as has already been pointed out, malicious software can take advantage of the rootkit—which is what this is—as an attack vector to control someone's machine without their knowledge, and with damn little they can do about it.

Please remember also that a lot of computer viruses and worms didn't start out with people saying, "I'm going to write a computer virus today!" They started out with someone saying, "Hmmm... I wonder if that would work..." and it goes from there. In fact, the guy who is credited with writing the first computer virus said, "It was a practical joke combined with a hack. A wonderful hack." Maybe, but it's stupid to deny what it was, a virus, just as it is to deny what this is, a rootkit.

Re:You're missing the point.

[ajs]

It only seeks to protect sensitive biometric data which should not be visible to all programs) from the normal Windows API.

The intentions behind the software are irrelevant. The only thing that matters is what it does.

Correct.

What this software does is an end-run around the operating system, deliberately hiding things that should not and need not be hidden. Mostly True. I'm not sure I agree with "should not and need not," but I'll grant that they did it the wrong way. No question.

The bottom line is that this is not a rootkit. It's simply not. The term rootkit refers to a class of software that hides its existence from the OS, and this software does not do that. There's also the matter of the goal (you mentioned intent, but I think goals are more quantifiable and measurable). Rootkits have as their goal the subversion of system security. It doesn't matter if their DRM-enforcement modules from Sony CDs or virus delivery vectors. They exist to prevent the system from being aware of their installation and preventing their deinstallation. This software does not have any such goal. Its goal is to prevent casual API calls from accessing sensitive biometric data. Period.

I'm all for slapping Sony around over distributing software that has a security problem (e.g. it can provide safe harbor for malicious code), but let's not throw around the word "rootkit" unless we really mean a piece of software that tries to mask its existence on the system. Otherwise, we'll just have to come up with a new word for that.

Re:You're missing the point.

[overnight_failure]

Rootkits have as their goal the subversion of system security
And that's exactly what this software is supposedly doing.

Re:You're missing the point.

[ajs]

Rootkits have as their goal the subversion of system security And that's exactly what this software is supposedly doing. No. There's a difference between making a boneheaded security gaffe and subverting security. If you can't see the difference between the two, then I suppose this conversation is moot, and we'll have to declare every piece of Linux software a rootkit if it's ever had a security issue that wasn't just a bug, but a deliberate design choice that turned out to have security implications.

That said, I'm actually not sure that this is as much of a problem as F-Secure has claimed.

What the software is doing is creating a hidden directory that the standard Windows API can't access except by explicit path name (e.g. it doesn't show up in the directory contents). So, here's the question: what does this gain a malicious program? Sure, such a directory is handy, but your friendly neighborhood worm or spyware could just create such a directory itself. It doesn't help the software in question get past local virus scanners in the first place, only hide from them subsequently... so what's the issue, here? What has Sony done that actually improves the situation for any malware?

I'm not saying it's a good policy to have such directories, but I'm also not sure that this is a serious security problem especially since, obviously, F-Secure's software was able to detect it.

Re:You're missing the point.

[MRAB54]

I seem to remember having this statement beat into my head a few thousand times: security by obscurity doesn't work. Regardless of that, it is completely ridiculous to do something like this because like others have said, it gives other malicious software another avenue to do their dirty work.

Re:You're missing the point.

[Shadowlore]

And you are not explaining your argument properly.

You state that the data that is hidden should not be hidden. Then you argue that the data should not be hidden because the method used to hide the data *COULD* be used maliciously.

Your first problem is you didn't justify why encryption information should be hidden. Second, you say the means to hide it MIGHT be used to do something bad. Well, you can say that about most anything really.

People shouldn't post to /. because someone might do something bad with those postings.

People shouldn't have/use encryption because someone might use it maliciously - as in to hide data.

Would malicious software take advantage of the so-called rootkit? Why bother? Put yourself in the place of the bad guys. Would you rely on this driver to be present for your malware to stay hidden? Or would you be better off just writing other things to hide your data?

Now let us go the other way. I could use this driver to hide data myself, right? If malware could do it, so can I. Maybe I stick my important data in there. Maybe I encrypt a file containing my user/pass combos, then put the encrypted data there.

The intent does matter. A "rootkit" as has been referred to for years is so named because it grants a non-authorized user "root access". In this case it's "Administrator" access, but the principle is the same.

Despite the fallible Wikipedia entry, a rootkit is not something that hides process or files. That is a method. A rootkit is a piece of software that grants a non-authorized user admin level access. That's all. It may or may not hide itself. I've seen rootkits that do not hide themselves.

Calling this a rootkit is a bad idea. Calling it a poor implementation of an idea would be a much better start. Security through obscurity is rarely a proper defense. But butchering the longstanding use of a term to make Sony look bad is not good policy, nor good karma.

Intent matters in nearly all things. As noted, criminals, murderers, terrorists, corrupt government officials corrupt business officials, and just plain arseholes can all do bad things using the same methods, techniques that good guys use.

Oh look you have lock picking tools, go straight to jail. No it doesn't matter that you are a locksmith and
do not intend to do bad things with them, you have them. That is what your "intent is irrelvant" argument leads to. No thank you.

Much like calling copyright infringement Piracy, calling this a rootkit is being deceitful. To me it also demonstrates a lack of good vocabulary skills. Ignoring why something is done is also improper. For all I know you are astroturfing for one of Sony's competitor. No I can't go looking at your posts to see if you are or not, or do some research to verify that. After all, stalkers and pedophiles use those same techniques to do bad things. And I'd hate for your "intent does not matter" world to brand me among them because I used the same technique to see if you are a shill or not.

Re:You're missing the point.

[KingSkippus]

I'm not going to respond to your entire post, because you're just plain wrong. However I will point out a couple of things.

Would you rely on this driver to be present for your malware to stay hidden?

Of course. Why wouldn't I? I would exploit the hell out of everything like this that I could. When Sony's original (that we know of) rootkit was put out on those audio CDs, it was not very long before malware that exploited the fact that being named $sys$stuff would make it disappear completely off of Windows's radar. Duh.

If malware could do it, so can I. Maybe I stick my important data in there.

Yeah, that's a good idea. Do an end-run around the OS API yourself. Also lose the ability to back that data up, open it from most applications, etc. It's better to simply encrypt it, but you know, if that's really what you want to do, go for it.

The intent does matter.

So if I write a nasty computer virus with the intent of studying it, and it manages to accidentally get out in the wild and infect half the world's computers, does that mean that it's not a computer virus because I didn't mean for it to cause any harm? No, as I said, what counts is what it does.

Oh look you have lock picking tools, go straight to jail.

As a matter of fact, unless you are a locksmith, you can go to jail for possessing lockpicks. For example, according to Nevada law (and I'm chopping parts out for clarity, the original is here:

Every person who has in his possession any picklock or implement commonly used for the commission of burglary, under circumstances evincing an intent to use or employ in the commission of a crime, shall be guilty of a gross misdemeanor. The possession thereof except by a mechanic, artificer or tradesman at his place of business, open to public view, shall be prima facie evidence that such possession was had with intent to be used in the commission of a crime.

Many other states have similar laws.

A "rootkit" as has been referred to for years is so named because it grants a non-authorized user "root access". In this case it's "Administrator" access, but the principle is the same... A rootkit is a piece of software that grants a non-authorized user admin level access. That's all.

If Wikipedia's description of a rootkit is inaccurate, yours is just plain laughable. The thing that distinguishes a rootkit from other malware is precisely the fact that it hides itself from users and/or the OS by altering or bypassing the API. Windows has had many security holes over the years that grant administrative access to a machine. By your definition, any malware that exploits a security hole would be a rootkit. Try telling that to any competent systems administrator and they'll probably mock you for not knowing what the hell a rootkit is.

But it doesn't work for security, either!

[dpilot]

For a moment get past the Rootkit or Registry thing.

I just plain isn't good security. If they're really counting on Registry entries to "protect" the "secure" data, there must be a thousand ways to get around that in Windows, let along just plugging it into a Linux machine. Real security is HARD to do, and promoting something like this as "secure" when it really isn't is a disservice. I read one review a while back that indicated that *none* of these "secure USB" flash plugins were really secure.

Incidentally, I have a USB flash plugin. The data I really care about is AES-encrypted in a container file that I can loopback mount and use the kernel crypto stuff to access.

Security through obscurity

[Crazy Taco]

I guess this just proves again that some companies unfortunately still believe in "Security through obscurity". Sony, quit trying to hide junk all over my drive!

A propos...

[Mr_Icon]

A humorous story about what would happen if porn had "root kits." (SFW)

Could this be done on any OS so easily?

[Viol8]

I'm assuming this kit loads a driver which somehow intercepts kernel API request (or whatever , I'm just guessing). What I'm curious about is could this be done on linux /unix / OS/X or is this ability to intercept standard kernel API requests a bad design perculiar to Windows?

Re:Could this be done on any OS so easily?

[Anonymous Coward]

under linux you could use the ld_preload variable to intercept any library call.

I think that this is really needed as results of the dll hell - the first windows library missed the versioning info, so if you installed some component over another the dll downgrade went unnoticed, and in the days vb programs installing vb 4/5/6 runtimes all over the place were quite common.

however, there are plenty of legit times where you'd would overload a call: under linux, for example, you have a libgl.so that comes with the display driver, and one that comes with xgl to make some special effects (not technically true, but almost. LD_PRELOAD allows you to chose wich library to use for each program.

under windows, you could have a program that requires an old version of a com api as it relies on some obscure bug. just put the different dll in the same folder of the executable, and presto you're "overriding" the standard functionality. (an example of this is steamemu^H^H^H^H^H^H^H^H internet explorer 7)

Re:Could this be done on any OS so easily?

[ThePhilips]

under linux you could use the ld_preload variable to intercept any library call.

Not much effective, since most of secure software is written in special scripting languages (e.g. perl -T) and uses analogue of '/usr/bin/env -' to clean environment before doing anything. And has bunch of secure wrappers before doing anything serious.

And do not forget, that with ld_preload you can overload libc calls - but it all fails if application calls syscalls directly. And some applications do call syscalls just to check whether environment is sane and libc isn't screwed. (What happens sometimes even w/o cracking attempts.)

And well, user can always do manually in terminal 'unset LD_PRELOAD'... How would you protect root-kit against that? Environment is just lump of RAM with bunch of strings in it - application (consequently user) can do with it whatever it/s/he likes to.

Re:Could this be done on any OS so easily?

[Hatta]

Of course it could, but you'd have to manually run the rootkit and give it root permissions instead of having it autolaunched under your admin equivalent user account.

Re:Could this be done on any OS so easily?

[Wyzard]

Not much effective, since most of secure software is written in special scripting languages (e.g. perl -T) and uses analogue of '/usr/bin/env -' to clean environment before doing anything. And has bunch of secure wrappers before doing anything serious.

By the time the script is running, the malicious library would already have been preloaded by the script interpreter. The script could unset LD_PRELOAD prior to launching any sub-processes, but a well-written preload rootkit would intercept execve() calls and put the variable back before allowing the exec to happen. It might also be possible to alter the environment data passed to the program when it starts, to hide the LD_PRELOAD setting.

And do not forget, that with ld_preload you can overload libc calls - but it all fails if application calls syscalls directly.

The "system calls" you're thinking of are libc functions. The kernel's system-call interface works by loading parameters into specific CPU registers and invoking a software interrupt, much like the "int 21h" mechanism used by DOS, so to truly invoke system calls directly, you have to write assembly code. The C-callable "system calls" we normally think of, like execve(), read(), and write(), are provided by libc as convenient wrappers which invoke the real system call on your behalf. Those can be intercepted by a preload rootkit.

And well, user can always do manually in terminal 'unset LD_PRELOAD'... How would you protect root-kit against that? Environment is just lump of RAM with bunch of strings in it - application (consequently user) can do with it whatever it/s/he likes to.

As mentioned above: sure, you can remove LD_PRELOAD from the environment in your shell, but the shell already has the rootkit library loaded. When you run a program from the shell, the shell fork()s and the child process calls execve(), passing the desired environment (sans LD_PRELOAD) as a parameter. The execve() that gets called is the preloaded malicious one, though, which just puts LD_PRELOAD back into the given environment before passing it along to the real system call.

Since environments are passed down from parent process to child, a preload-based rootkit would need to replace /sbin/init with a wrapper that sets LD_PRELOAD prior to running the real init, to make sure that every process on the system preloads the malicious library. And being based entirely in userspace, it wouldn't be able to conceal itself quite as completely as one which patches the kernel; it could be completely bypassed by a program that directly invokes the real assembly system calls, for example. Still, it could be fairly effective if done right.

Re:Could this be done on any OS so easily?

[Wyzard]

Oops, correction: interrupts probably aren't used anymore for invoking system calls. On x86, at least, there's a machine instruction called sysenter that's designed specifically for this sort of thing and does it much more efficiently than int, and I'm sure most other architectures have something similar.

My main point still stands, though: Invoking real Linux system calls directly requires writing assembly code. Very few programs do that; everything uses the wrappers provided by libc.

Re:Could this be done on any OS so easily?

[Harik]

Sure, if you get root on a linux box, you can load a module to grab the syscall handler and rewrite the ones you want. It's not as trivial on linux - the syscall table has no hooks for being tampered with at all, and has no fixed position for binary compatability. Still, it's been done. Adore traps sys_readdir, sys_open and a few others to hide processes and directories from view. And of course, it only takes one person to write the initial code - the armies of script kiddies will happily spread it without understanding what it does.

Other options are using the *trace(2) functions to hook into all running processes and trap/modify their syscall use, or simply replace ld.so with one that silently adds libtrojan.so to every program. The trace functions can be raced against (fork/clone followed immedately by the syscall you want to use. The latter can be defeated by directly using sysenter/int80 via inline asm.

Re:Could this be done on any OS so easily?

[ThePhilips]

well-written preload rootkit would intercept execve()

I wonder why the possibility never crossed my mind.

like the "int 21h"

It is actually "int 0x80". libc always choses best way to call kernel, but Linux (and I believe *BSD) do support entry thru "int 0x80" (on IA-32 of course).

Additionally, libc has prototypes and macros for syscalls. If application would use the macro to generate a call to syscall, then you wouldn't be able to intercept it - because it would be inlined right in the calling code.

Still, it could be fairly effective if done right.

True.

LD_PRELOAD wouldn't work for suid-root applications, so running fresh "login" should kind of sanitize environment. But I think that now only few applications are suid-root, so shaking off the thing might be a real pain.

P.S. And of course do not forget, that LD_PRELOAD works only for dynamically linked apps. In older times, every system had for bootstrap purposes a copy of statically linked shell, which would be immune to LD_PRELOAD crack vector.

Re:Could this be done on any OS so easily?

[ThePhilips]

Since environments are passed down from parent process to child, a preload-based rootkit would need to replace /sbin/init with a wrapper that sets LD_PRELOAD prior to running the real init, to make sure that every process on the system preloads the malicious library.

Environment isn't inherited by default. It is free service of simplified call exec().

Also, init has no environment, first, and, second, login is what creates a new copy of environment for every new user session. So you would need to replace login with root-kit. (login is called by *getty (which handles initial setup of terminal) when you enter username. *getty is instantiated by init. Chain is: init -> *getty -> login -> -sh.)

IOW, it would work, but bit differently from what you have outlined ;)

rootkit actually influned my choice of a camera

[Anonymous Coward]

I was in a store looking at several different cameras, and had pretty much narrowed it down to a Sony and A Canon. i had a somewhat difficult time deciding between the two, but than i remembered the root kit fiasco and chose accordingly. so I'm one of those folks that actually voted with their wallet. Somewhat related to your statement, so I'd thought I'd share it. maybe there ought to be a list somewhere of people who have actually voted with their wallets, and have a list of receipts and such to prove it.

How to hide files

[spaceyhackerlady]

What's wrong with attrib +h my_secret_file?

There are legitimate ways to hide files from casual inspection. There is no need to fuck with the user's system to do so.

...laura

Re:How to hide files

[Bou]

Or, you could always use NTFS's build in root kit 'feature': Alternate Data Streams.

Virtually undetectable for the casual user:
They don't show up in explorer and other file managers and task manager even shows the name of the host file.

Re:How to hide files

[Kalriath]

It's like the resource fork of a file on an HFS+ disk (Mac OS)

Re:How to hide files

[Sanat]

The Family Tree site Ancestry.com attached an ADS stream to each downloaded ".GED" or ".exe" and Zip file that is called Zone.Identifier which appears to be a 26 byte field. What it is used for is not known.

I may have to look at the sector data for one of these files to see what is hidden beyond the end-of-file. Perhaps it is a date/time stamp or perhaps my user ID. Most likely it is file header to stop malicious renaming activity... as an equivalent example renaming a "George Jones" MP3 to a Madonna MP3 but the system would still know it was a George Jones tune regardless of what it is named.

Copying the file leaves the ADS data intact.

Sanat

Re:How to hide files

[schweinhund]

Curious. Among the multitudes of sometimes-shady, closed source Windows shareware out there, I wonder how much more is hidden in ADS?

Re:How to hide files

[Sanat]

I ran the program lads.exe against my hard drives to see what was there. Just the family tree data files (compressed to an exe/zip/ged showed the ads stream.

I used Freeware program lads.exe by Frank Heyne (http://www.heysoft.de/)

Be sure to use a /s to check all subdirectories.

It would interesting to see who all uses the ADS for additional information and/or tracking.

Sanat

Re:This article is retarded

[Anonymous Coward]

It's not the article that's retarded... it's you.

Re-read that

[AKAImBatman]

the USB stick installs a driver that is hiding a directory under "c:\windows\". So, when enumerating files and subdirectories in the Windows directory, the directory and files inside it are not visible through Windows API.

Hidden files do not require a driver, nor are they 100% invisible to the Windows API. :-/

Re:Re-read that

[r3m0t]

You mean files and directories with the "Hidden" flag that you can set in Windows Explorer.

This is a driver that hooks into the part of the Windows API which an application such as Windows Explorer uses to ask "hey, what is there in (e.g.) C:\Program Files\?". Then if the directory in question is "C:\Windows\", it removes a certain directory from the list. However, if you know the name of the hidden directory, you can get there by typing its address into Windows Explorer directly.

That directory contains files used to protect the "security" of the USB stick.

Re:Re-read that

[Anonymous Coward]

You missed the point. He was pointing out the fact that it says right in the text that a driver needs to be installed, while the GGP post claimed that TFA said nothing about kernel-level code. GGP obviously failed to understand what he quoted.

Karma Abuse Poetry

[MightyMartian]

Let's see if I can get even more karma by posting this old poem I wrote on Sony last year:

Well the Devil had a brand new plan,
"I don't want any ordinary DRM!"
So he called his boys at Sony Corp,
"I'll make this fast and I'll make it short."

"There's a Limey company, as evil as hell,
They've got a rootkit they're waiting to sell.
So grab some cash, make it quick,
There's a half million networks we just gotta fix."

Now Sony knew the Devil well,
Why these guys were already half way to Hell.
So off they went to England fair,
And bought themselves a rootkit there.

To protect themselves and their evil scheme,
They wrote a EULA that would make you scream.
"No problem," they said, "we can do as we please,
We're all scummy bastards, so what's some more sleaze?"

But not all were asleep when they played Van Zant,
And the racket grew so loud Sony just had to recant.
"We'll take back all those discs, we really were wrong,
Oh, and you Mac users, your turn's coming before long."

So THAT's how the Japanese communicate...

[Anonymous Coward]

All the sales assistants in about 20 shops I visited just looked at my phone, shrugged their shoulders and said "Sony!". My Japanese is pretty poor, but I got the message.

So I guess that explains the old "SEGA!" commercials. My Japanese is pretty poor too, but I get the message.

Wasn't it 3M?

[Anonymous Coward]

I could have sworn that it was actually 3M

Re:Sony Windows only?

[Technician]

Yes, it is a rootkit. It's modifying the kernel space to hide directories from the user.

Has anybody tried one of these in a Ubuntu or other Linux machine? Do the hidden files show?

zero?

[Kohath]

Since anyone can sue anyone else without regard to any merit or wrongdoing, lawsuits indicate nothing. Anyone who has a lot of money will be sued. Repeatedly.

Lawsuits indicate nothing -- nothing except that lack of lawsuits indicates you're too poor for it to be worthwhile for someone to sue you.

---

How many false rootkit stories will it take for Slashdot readers to "get it into their head" that Slashdot-news=uncertainty? Any news story posted on Slashdot may or may not be true. The more hyped, news-worthy or interesting, the less likely it is to be factual.

Re:A virus could put its files in the hidden folde

[nschubach]

A virus wouldn't put itself in this hidden folder instead?

%USERPROFILE%\Local Settings\Temporary Internet Files\Content.IE5

Or this one?
%USERPROFILE%\Local Settings\Temporary Internet Files\OLK6F

Maybe one this windows built in rootkit folder?

c:\$Extend

..or maybe one of these hidden files?
c:\$AttrDef

c:\$BadClus

c:\$Bitmap

c:\$Boot

c:\$LogFile

c:\$Secure

c:\$Volume

All which the handy SysInternals hides as "Standard NTFS Metadata Files" by default.

The existence of these files/folders are hidden to most users and most of them don't even know about them. You think virus scanners check the c:\$Extend folder? Is someone willing to drop in a known virus and see if it detects it? Honestly, I'm curious as to how many actually check this folder...

About Sony and rootkits

[Boycott BMG]

I feel like I finally have to create a user account to correct a misconception I see a lot on the internet. It wasn't Sony that put a rootkit on the music CDs, it was Sony-BMG which is a separate company that is 50/50 owned by Sony and Bertelsmann (BMG stands for Bertelsmann Music Group). Furthermore, the top executives at Sony-BMG all come from the BMG side, like that guy Thomas Hesse who made those stupid remarks that consumers shouldn't care about rootkits. If anything, all the anger toward Sony should be directed at the entity involved, which is Sony-BMG. Just boycott their music.

Re:About Sony and rootkits

[pandrijeczko]

And Sony gave Michael Jackson a recording contract - that's another reason to hate Sony.

Re:This article is retarded

[Anonymous Coward]

Wow, thanks for the informative post.

Sounds like you could teach us a lot about the law, brain surgery and girls, too.

You, sir, are an idiot

[Anonymous Coward]

>>because I already threw 2 of them straight in the trash, no use even giving them to a friend...

If you really are a computer professional (and I really hope you are not) then you would have RTFA and would now not be making a fool of yourself by writing to /. boasting about throwing away perfectly good hardware.

>>we were looking at for toys for the boys.

Says everything that needs to be said about you, your boss, and your company. I'm looking you up to make sure that you and your organization are NOWHERE NEAR any of our supply lines.

Print this out and give it to your boss.

Can't affect me ...

[Lou57]

This cannot affect me because I've refused to buy any Sony product since the last fiasco. Additionally, I will NOT deploy any Sony products for my customers, and I always explain to them why I don't trust Sony. This will add to my stack of evidence against Sony and will validate my concerns in the eyes of those customers.

Will you buy Sony products?

Re:Can't affect me ...

[Emetophobe]

Will you buy Sony products?

Yes.

I came to the conclusion several years ago that if I boycotted every company that had done something I considered unethical, there would be no companies left to buy goods or services from. Pretty much every company has done something unethical at some point, does that mean we should boycott them all?

I hate most Corporations, but I'm not to the point yet where I renounce all physical possessions, grow my own food and make my own clothing.

Re:Can't affect me ...

[16K Ram Pack]

"I came to the conclusion several years ago that if I boycotted every company that had done something I considered unethical, there would be no companies left to buy goods or services from. Pretty much every company has done something unethical at some point, does that mean we should boycott them all?"

No, but it's more a question of degrees. Some companies are more ethical than others. Google got a huge amount of flak for censoring in China, but Yahoo has been far more co-operative (and also more co-operative with the US government).

Re:Sony/Phillips

[FauxReal]

They also created the Sony/Phillips Digital Interface for audio known as SPIDF. It's been around for a while but is only now picking up momentum in the consumer market. It's been in use for professional audio for a long time. Though, my Archos Jukebox Recorder has a SPIDF interface. (It was the first USB 2.0 hdd based mp3 player on the market.)

Re:Sony/Phillips

[leenks]

S/PDIF is a consumer interface, but is popular on "prosumer" equipment and PCs. Professionals tend use AES/EBU as it is both balanced and incorporates error correction - neither of which are supported on S/PDIF - and uses standard XLR cables for transmission, rather than non-standard coaxial cinch/rca/phono cables.

F-Secure Morons

[Anonymous Coward]

"There are also ways to run files from this directory."

What kind of idiot writes that? F-Secure are 101% hype and -1% brains. Always have been, always will be.

Re:Sony/Phillips

[SenorCitizen]

They also created the Sony/Phillips Digital Interface for audio known as SPIDF. It's been around for a while but is only now picking up momentum in the consumer market. It's been in use for professional audio for a long time. Though, my Archos Jukebox Recorder has a SPIDF interface. (It was the first USB 2.0 hdd based mp3 player on the market.)

Actually, S/PDIF was designed for consumer devices. It's a slightly modified version of the AES/EBU digital interface used in professional equipment. They added SCMS serial copy protection and removed mandatory support for 24-bit audio. The connectors and cables are also different. S/PDIF uses either RCA or TOSLINK connectors, while AES/EBU typically uses XLR connectors. It's also not new at all, I had a Sony Minidisc recorder with optical S/PDIF inputs and outputs over ten years ago.

Not rootkit, not malware.

[rtechie]

The clarify here: The issue is that the Sony MemoryVault USB drives (NOT MemorySticks) include a fingerprint reader, which combined with a driver and (presumably) encryption software, provides a "secure data vault" on the USB drive.

The malware aspect comes in because the Sony software installs a driver for the fingerprint reader in a special hidden directory, presumably with the intention of making the driver more difficult to tamper with and/or bypass. The idea here is that if an attacker can tamper with the driver they can have the tampered driver send a false "correct read" signal to the vault which would expose the content to attackers. Vista's driver protection basically works the same way by preventing you from editing sections of the registry and editing/deleting certain files. So, in theory anyway, if Sony updates the driver for Vista this behavior shouldn't be necessary (not that it is now) beacuse Sony can make it a "signed" driver that this more difficult to tamper with. The driver might also contain some sort of obsucated code (I'm that familiar with this kind of driver hacking).

On the grand scale of software that breaks Windows conventions, this is a rather petty example. There are anti-virus tools and debuggers that tamper with the kernel. There is DRM software that breaks other apps on your system. There are virtual disk drives that can destroy your entire Windows install, Really, one hidden driver ain't so bad.

Here's a question: Does the uninstaller remove this hidden driver cleanly? If so, what's the problem?

You shouldn't be using this Sony software anyway. Do you really want to stick you confidential data into a propretary database coobbled together in a weekend by a few chumps at Sony? There are far more robust and flexible password vaults out there. Many are free.

Does any of you know if you can use the fingerprint reader without installing Sony's software?

Heh, heh...

[hitmanWilly1337]

Good luck installing a rootkit on my gentoo box, sony. Or my kubuntu one.

DRM as well

[eatont9999]

I bought the game Bioshock (which won't even load a splash screen). It installs the same kind of rootkit. I think it is just wonderful the way Sony thinks they can create directories in my system for themselves. After all, why not. It can only be compromised by the would be virus or data harvesting malware. Riiiight.... I don't think I will be buying anything Sony for quite a while.

simple... stop buying sony

[blad3runn69]

The answer is simple friends. Stop buying sony, they have shown time and again they can not be trusted.

Re:simple... stop using windows

[Anonymous Coward]

The answer is simple friends. Stop using windows, they have shown time and again they can not be trusted.

How do I block articles with '?' titles

[Anonymous Coward]

Why do they think they can make any statement they want in an article's title as long as it ends with a question mark? Does this absolve the title from having to have anything to do with reality?

World ends tomorrow?

Make millions without lifting a finger?

Slashdot commits to credibility and abandons sensationalism?

What to hide?

[xororand]

It's not just that they hide the drivers but even if you find them, you can't look into it. Some may say this is for security's sake.
But seriously, this device seems to be designed for securing your data. Would you trust a vendor who takes these measures to hide the inner workings of the device?
It's not that obfuscation, hidden, binary code ever stopped ambitious crackers. On the contrary, I think it just gives a false feeling of security to the vendor.