Slashdot Mirror

← Back to Stories (view on slashdot.org)

Another Sony Rootkit?

Posted by ScuttleMonkey on from the slow-learners dept.

An anonymous reader writes to tell us F-Secure is reporting that the drivers for Sony Microvault USB sticks uses rootkit techniques to hide a directory from the Windows API. "This USB stick with rootkit-like behavior is closely related to the Sony BMG case. First of all, it is another case where rootkit-like cloaking is ill advisedly used in commercial software. Also, the USB sticks we ordered are products of the same company — Sony Corporation. The Sony MicroVault USM-F fingerprint reader software that comes with the USB stick installs a driver that is hiding a directory under "c:\windows\". So, when enumerating files and subdirectories in the Windows directory, the directory and files inside it are not visible through Windows API. If you know the name of the directory, it is e.g. possible to enter the hidden directory using Command Prompt and it is possible to create new hidden files. There are also ways to run files from this directory. Files in this directory are also hidden from some antivirus scanners (as with the Sony BMG DRM case) — depending on the techniques employed by the antivirus software. It is therefore technically possible for malware to use the hidden directory as a hiding place."

3 of 317 comments (clear)

  1. Re:Sony by Prof.Phreak · · Score: 5, Interesting

    It started when they became an entertainment corp, rather than a technology corp.

    --

    "If anything can go wrong, it will." - Murphy

  2. A Nasty Trick by Sigismundo · · Score: 5, Interesting
    It reminds me of the time that some friends and I discovered that a labmate had left himself logged in as root on a virtual console at his Linux workstation. Here's what we did:
    1. Created a directory with the name " " (single space)
    2. Added that directory to his path
    3. Wrote a Perl script that would spit out a random quote from zippy 1/3 of the time, and then execute the program pointed to by argv[0]
    4. Populated the special hidden directory with symlinks to the perl script, each given the name of a common command like ls, ps, and so on.

    So whenever he ran a common command from his shell, he would first get a random quote from fortune appearing, followed by normal command output. He figured it out pretty quickly, but I like to think that there were a few moments where he entertained the idea of his workstation gaining sentience.

  3. Re:Sony by mattpalmer1086 · · Score: 5, Interesting

    God, memory stick. I have a Sony phone, which is quite nice. I was recently in Tokyo, and I wanted some extra memory for my phone, so I went to Akihabara - geek central. All the sales assistants in about 20 shops I visited just looked at my phone, shrugged their shoulders and said "Sony!". My Japanese is pretty poor, but I got the message. So I went to the big Sony building at Ginza. No deal. They said they only sold memory sticks in the European market - they were using something else in Japan.

    Since I was there, I pulled out a Sony camera I was trying to get a USB cable for. Again, no deal. This camera was North American Sony, and they didn't have those kinds of Sony cables in Japan.

    Sigh. This insistence on ignoring standards and doing everything themselves - not even consistently across the world - bugs me like hell. I doubt I'll buy any more Sony consumer electronics until they get it. Hope they do - they know how to make nicely designed bits of technology.