AntiPiracy Macrovision Bug is Actually Six Years Old

twitter writes "A recently reported Macrovision bug has actually been around for six years, according to Computerworld. 'Flawed antipiracy software now being exploited by attackers has been bundled with Windows for the last six years to protect game publishers, Macrovision Corp. said today. The "secdrv.sys" driver has shipped with all versions of Windows XP, Windows Server 2003 and Windows Vista ... users do not have to play a SafeDisc-protected game to be vulnerable.' The article goes on to play down danger and claim that Vista is safe, but ZDNet notes: 'Malware authors are actively exploiting a zero-day privilege escalation vulnerability ... [which] can be exploited overwrite arbitrary kernel memory and execute arbitrary code with SYSTEM privileges. This facilitates the complete compromise of affected computers.'"

Comments

Yay DRM.

[RandoX]

Can Macrovision be held liable for losses?

Re:Yay DRM.

[stonedcat]

Yea like that's ever going to happen..

Re:Yay DRM.

[Unclescar]

Can Microsoft be held liable for losses? Fixed it for you.

Re:Yay DRM.

[vtscott]

Pff. When you installed windows you agreed not to hold them liable.

17. EXCLUSION OF INCIDENTAL, CONSEQUENTIAL AND CERTAIN OTHER DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL MICROSOFT OR ITS SUPPLIERS BE LIABLE FOR ANY SPECIAL, INCIDENTAL, PUNITIVE, INDIRECT, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING, BUT NOT LIMITED TO, DAMAGES FOR LOSS OF PROFITS OR CONFIDENTIAL OR OTHER INFORMATION, FOR BUSINESS INTERRUPTION, FOR PERSONAL INJURY, FOR LOSS OF PRIVACY, FOR FAILURE TO MEET ANY DUTY INCLUDING OF GOOD FAITH OR OF REASONABLE CARE, FOR NEGLIGENCE, AND FOR ANY OTHER PECUNIARY OR OTHER LOSS WHATSOEVER) ARISING OUT OF OR IN ANY WAY RELATED TO THE USE OF OR INABILITY TO USE THE SOFTWARE, THE PROVISION OF OR FAILURE TO PROVIDE SUPPORT OR OTHER SERVICES, INFORMATON, SOFTWARE, AND RELATED CONTENT THROUGH THE SOFTWARE OR OTHERWISE ARISING OUT OF THE USE OF THE SOFTWARE, OR OTHERWISE UNDER OR IN CONNECTION WITH ANY PROVISION OF THIS EULA, EVEN IN THE EVENT OF THE FAULT, TORT (INCLUDING NEGLIGENCE), MISREPRESENTATION, STRICT LIABILITY, BREACH OF CONTRACT OR BREACH OF WARRANTY OF MICROSOFT OR ANY SUPPLIER, AND EVEN IF MICROSOFT OR ANY SUPPLIER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Oh, you didn't know about those terms when you bought the product? And you want to return software that's been opened? It was in all caps, surely you could have read that through the box.

So, the slashdot lameness filter doesn't like the the clip of the microsoft eula I posted because it has too many caps. Well I'm not retyping all of that in lower case, so I guess I'll post another part of the eula that doesn't abuse the caps lock key...

18. LIMITATION OF LIABILITY AND REMEDIES. Notwithstanding any damages that you might incur for any reason whatsoever (including, without limitation, all damages referenced herein and all direct or general damages in contract or anything else), the entire liability of Microsoft and any of its suppliers under any provision of this EULA and your exclusive remedy hereunder (except for any remedy of repair or replacement elected by Microsoft with respect to any breach of the Limited Warranty) shall be limited to the greater of the actual damages you incur in reasonable reliance on the Software up to the amount actually paid by you for the Software or US$5.00. The foregoing limitations, exclusions and disclaimers (including Sections 15, 16 and 17) shall apply to the maximum extent permitted by applicable law, even if any remedy fails its essential purpose.

Re:Yay DRM.

[Volante3192]

EULAs are shaky legal ground though; they're untested. Just because they say they're not liable doesn't mean it's been held up in court. They're there to scare people into thinking there's no recourse.

Re:Yay DRM.

[Anonymous Coward]

"Can Macrovision be held liable for losses?" or "Can Microsoft be held liable for losses?".

Now I'm not a lawer, but I will go ahead and say 'no'. Why, because it's software, sold WITHOUT WARRANTY, or even FITNESS for a PARTICULAR PURPOSE.

It's made by simple programmers, under the whims of marketing folk. Nothing to back up their trust, and no remedy besides the money you paid for it.

It's software people, you pay your money, and you take your chances.

Re:Yay DRM.

[jZnat]

Well I'm not retyping all of that in lower case Some geek you are! guG or similar in Vim is all you need.

Re:Yay DRM.

[reebmmm]

Just to be TOTALLY fair, most every software license includes a limitation on liability AND an exclusion of consequentials (GPL):

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
***
If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.

This makes a lot of sense since it makes almost no business sense to extend unlimited liability (or any multiple of actual fees paid) to software products. Most companies typically can't afford to insure users only paying $500 for software against most anything that could happen while using their software.

As an aside, a majority of states say that such a waiver with regards to gross negligent or willful misconduct would be unenforceable. And, there may be such an argument in this case--though, that's served with the caveat that THIS IS NOT LEGAL ADVICE.

Re:Yay DRM.

[truthsearch]

Not necessarily. At least one court has found that a shrink wrap license is enforceable.

Re:Yay DRM.

[Volante3192]

Hrm, gray area...

First paragraph:

...Shrinkwrap licenses are enforceable unless their terms are objectionable on grounds applicable to contracts in general (for example, if they violate a rule of positive law, or if they are unconscionable). Because no one argues that the terms of the license at issue here are troublesome, we remand with instructions to enter judgment for the plaintiff. But it seems the only aspect of the licence that was questioned was the following:

This license, which is encoded on the CD-ROM disks as well as printed in the manual, and which appears on a user's screen every time the software runs, limits use of the application program and listings to non-commercial purposes. Other aspects of EULAs, specifically the arbitration clauses, have been found to be unconscionable ( http://games.slashdot.org/article.pl?sid=07/06/08/2017257 ). It all depends on which part of the EULA you're going after.

Re:Yay DRM.

[truthsearch]

It all depends on which part of the EULA you're going after.

Very true. I was simply referring to the fact that an EULA, in general, has been found to be a valid contract in court. Assuming everything within the license is legal and legit, it is enforceable.

Re:Yay DRM.

[reebmmm]

This is not very good legal analysis or advice. EULAs are far no "untested" (though, the same is not necessarily true for browsewrap agreements).

EULAs are very much enforceable and have definitely been held up in court. Like any contract, though, some have certainly been found to be unenforceable in their entirety or in part. Those that are denied enforceability have some other procedural or technical flaw, usually proper notice.

In addition, as between a company and a consumer, there are definitely some hurdles to enforcing certain provisions like arbitration, choice of law and choice of venue. These can frequently be much more unreasonable than a court is willing to stand. This may also be true with respect to a waiver of liability or consequential damages. That said, the issue isn't whether the EULA in and of itself is enforceable, but instead whether there is proper notice of the clauses or whether such clauses are unconscionable.

Also, despite what slashdotters like to think, EULAs almost certainly meet the requirements of contracts: offer ("take it or leave it"), acceptance (by signature or performance) and consideration (in exchange for the right to use the software at the price I'm selling it to you, you agree to these other terms).

I have never seen a coherent argument that would state a EULA was per se unenforceable. Indeed, I would doubt seriously that such an argument would pass the laugh test. Nevertheless, if you want to argue that there's no signature (a frequent comment), take a look at the definition of "electronic signature" in E-SIGN or UETA. In both cases, a "process" (think clicking "I accept") can be a signature. Finally, acceptance can also be shown by performance. Also, there's a great big body of case law that assumes acceptance of a contract where there is performance by both parties--notwithstanding the other requirements.

While IAAL, none of this is legal advice. Enforceability of a contract is very fact specific (see the guy who couldn't see the terms because his monitor wasn't working). If you have questions, definitely seek the advice of your own lawyer who will evaluate your situation under your own facts.

Re:Yay DRM.

[CodeBuster]

The Sony DRM Rootkit case should server as a useful template for litigation so the answer is yes, provided that somebody can actually show damages (i.e. borked computer, identity theft, etc.) based upon a known exploit of the safe disc driver, but once again the lawyers will get 90% of the money with the remaining 10% divided among millions of claimants in the form of $0.20 checks issued to those who will provide their name and address (which will subsequently be sold for marketing purposes). The only consolation that consumers would get is the knowledge that Macrovision took a hit to the wallet but probably not a knockout blow (settlements tend to be lower than the amounts that can be had for litigating a case to its conclusion, albeit at greater risk to all parties).

Re:Yay DRM.

[houghi]

So, the slashdot lameness filter doesn't like the the clip of the microsoft eula I posted because it has too many caps. Well I'm not retyping all of that in lower case, so I guess I'll post another part of the eula that doesn't abuse the caps lock key...

You could have also done the following:
CTRL+T, then enter the following search `lowercase online` and you would have found http://www.string-functions.com/case.aspx where you could have turned it all in lowercase

Re:Yay DRM.

[sowth]

Also, despite what slashdotters like to think, EULAs almost certainly meet the requirements of contracts: offer ("take it or leave it"), acceptance (by signature or performance) and consideration (in exchange for the right to use the software at the price I'm selling it to you, you agree to these other terms).

Okay, IANAL, so help me understand this better. You can buy something from a store, take it home, and after you have purchased the item, the manufacturer of the product can hold usage of said product hostage until you "agree" to an EULA.

This doesn't sound proper to me. I've only had a few simple business law classes, but I would think this would fall under duress or a blank contract or something like it. Why not?

Re:Yay DRM.

[reebmmm]

You can buy something from a store, take it home, and after you have purchased the item, the manufacturer of the product can hold usage of said product hostage until you "agree" to an EULA.

Let's be clear here. A contract proposed after the fact with no notice of terms prior to a transaction may well be unenforceable because of the lack of notice. Some courts, in enforcing EULAs without prior notice, have found that a EULA may nevertheless be enforceable if there is a meaningful way to reject the terms (e.g. return the software for your money back). This is not usually how smart software vendors are advised.

In a pragmatic way, courts recognize (and not just in the software context) that notice doesn't require EVERY term be printed on the outside of the box. Instead, courts usually require merely that the consumer be put on NOTICE that there are additional terms, that there's some mechanism to view those terms, and that there be some meaningful way to reject the terms later (e.g. a refund). Also, internet transactions make this situation easier, since you can actually present the terms BEFORE you purchase the software.

Importantly, this doesn't just affect software. Courts have been willing to enforce provisions printed in users manuals (no requirement to click I accept) of all sorts of consumer goods provided that there was some notice that those terms existed.

Frankly, this makes a lot of sense when you think about it in any number of contexts--not just software. Most business do not intend to assume unlimited liability (and most consumers don't expect that they would) in every type of transaction.

As to your other points, a court is not going to find duress. Duress would require some threat of physical or economic harm sufficient to provide the party asserting duress no practical choice. It's not enough that it is a take it or leave it proposition. This is highly unusual set of circumstances: think something tortious or criminal.

I'm not sure what a blanket contract is, but I assume you mean some form of contract of adhesion. However, this analysis basically gets you back to where we started: usually an analysis of notice and unconscionability.

Finally, and just to make this point, most software companies CAN and DO negotiate their software terms--Microsoft, Oracle and SAP a frequently the most reluctant. The problem is that most individuals don't have much in the way of leverage (plus, it makes little sense for them to engage in any legal review for one sale when the lawyer will cost more than that). However, if you're buying $100,000+ worth of software and buying software support and maintenance, then you had better have an attorney negotiating the terms. Among other things, most software companies under those circumstances are willing to increase the liabilities, add indemnities, and strike all around unfavorable choices of law or venue.

Re:Yay DRM.

[MisterCaptainFunKill]

I like the part about paying $5.00 to people who have incurred damages from their software. It's like the "if everyone gives me a penny" thing in reverse. Imagine if everyone who used Windows tried to cash in on that... Microsoft would drown in paperwork and go broke at the same time!

Re:Yay DRM.

[node 3]

Pff. When you installed windows you agreed not to hold them liable. I didn't *agree* to shit. I clicked a button.

It's well known that people don't read the EULA. It's also well known (and follows) that the overwhelming majority of people have no idea the actual contents of the EULA. That strikes me as extremely shaky ground on which to base claims of any sort of actual "agreement" to anything.

In reality, the only thing agreed to is the user agrees to click a series of "affirmative" buttons in order to install some software.

Re:Yay DRM.

[reebmmm]

Actually, they're setting a minimum amount of liability. It does say the "greater of... [your actual damages] up to the amount you paid [OR] $5.00". Generous, aren't they?

Re:Yay DRM.

[reebmmm]

I'll feed the trolls. Here's the problem with your analysis.

First, and fortunately, courts are unwilling to reward ignorance or laziness since that just would make for REALLY bad policy. The fact that people don't read EULAs is not the point; most people don't read the laws either. Courts have been pretty clear that as long as (i) there's notice with a reasonable opportunity to reject and (ii) the provisions aren't wildly unfair, they're going to be binding.

Second, you've manifested your assent (*agreement*) in any number of ways: clicking a button (see E-SIGN or UCITA for the definition of "electronic signature"), by going ahead and performing (continuing to install despite notice), by paying for a product that tells you that there may be certain legal terms (I haven't looked closely at the windows packaging, but it's probably there somewhere), etc.

Finally, there are certain terms that people rely on, for example: the grant of right to use, warranties, and, though not in MS' case, the IP infringement indemnity.

As always, I would like to hear a constructive, coherent argument that EULAs--in general, and not in some fact specific situation--aren't contracts. Anyone can construct any type of "contract" that is going to be unenforceable, but that doesn't mean that all of them are.

Re:Yay DRM.

[Bert64]

And that's their own fault.
Would you sign an employment contract without reading it first? How about a contract for the transfer of a house or other property?
If your willing to agree to things without reading them, i have a few contracts for you to sign!

People need to be educated as to what they're agreeing to, and perhaps get legal advice before agreeing to anything like this. If more people were aware of these things, then vendors would be forced to make their license agreements less onerous.

Re:Yay DRM.

[node 3]

In order for a contract to be valid, there *must* be some reasonable measure of actual *agreement* and *understanding* (among other things, but these are the aspects pertinent to the topic at hand).

Clearly, most people do not understand, and have not actually *AGREED* to anything. All they've done is clicked a button. That click *might* count as an "electronic signature", but that's not the primary issue I've raised. The issue is that the contract is not predicated on the fundamental principles of a contract.

Those fundamental principles include (as stated above), agreement and understanding (again, amongst other things). The signature on the contract merely "seals the deal", but if there is no actual agreement, and no actual understanding, the underlying foundation of the contract is critically weakened, and the contract is, essentially, void.

With software EULAs, that essentially means you no longer (and really, never did) have the right to "copy it into memory" (a very dubious restriction as it is, but an entirely separate topic).

Re:Yay DRM.

[node 3]

And that's their own fault. No, it's not. Your sentiment essentially says it's OK to do whatever you can to *trick* people into contractual obligations. It's like that old trick, "a [something negative] says what?" and when the person asks, "what?", you treat them as if that means they *actually* are the [something negative].

Would you sign an employment contract without reading it first? How about a contract for the transfer of a house or other property? Absolutely not. But we're not talking about employment contracts or deeds.

If your willing to agree to things without reading them, i have a few contracts for you to sign! And, hypothetically, if I *were* to sign such a contract without reading it, without any actual *agreement* between us being met, without any understanding or knowledge of the contents, I would be legally able to void the contract. That's because the signature isn't the actual agreement, it's merely the physical representation of it. If the thing it represents doesn't actually exist, it's a sham.

People need to be educated as to what they're agreeing to, and perhaps get legal advice before agreeing to anything like this. It's absolutely absurd to expect people to consult a lawyer every time they are presented with an "I Agree" button. You're right about the need for education, however. Which is the exact thing needed to make these EULAs actual, honest contracts. If the end-user *actually* understands the contents, then that makes them much, *much* more valid as a legal contract.

If more people were aware of these things, then vendors would be forced to make their license agreements less onerous. That doesn't necessarily follow.

Re:Yay DRM.

[Bert64]

// If more people were aware of these things, then vendors would be forced to make their license agreements less onerous. // That doesn't necessarily follow.

It does, if people were unwilling to accept onerous agreements, vendors would be forced to change them.

Also, even if an agreement is unenforceable, it's still used to scare people into thinking it is. Such tactics need to stop, agreements should be clearly written and users should be educated not to accept an agreement they don't understand.

These agreements won't be changed without user education. Users need to realise if an agreement is unenforceable, not scared into following them. And users need to reject onerous agreements which are enforceable, forcing vendors to make them more reasonable.

Re:Yay DRM.

[Anonymous Coward]

Also, there is the argument (which doesn't hold up in all cases) that the consumer is bright enough to realize that not all the terms are listed on the box, nor can they be. I haven't taken a formal poll, but it looks like the courts are increasingly ok with the fact that this is the way computers work.

You buy a computer, there are various programs installed, you'll click yes at the opening screen and thus agree to any of the things listed in the 28 pages (or at least they would be if they were printed) of all caps block letter text.

The argument that you didn't have a chance to look at the terms and thus the contract is one-sided is also sometimes countered with "was there another way to get the information?" IOW, could you have looked at the terms of sale on the company website, could you return the computer once you'd had a chance to turn the computer on and see all the legalese, or better yet, was it printed on a manual inside the box so they could literally open the box, find out what's going on and then decide to purchase/keep it?

Also keep in mind, the fact that the courts realize that even if Microsoft a Powerpoint presentation to be shown to any prospective computer purchaser explaining their rights and obligations, almost nobody (I'm sure there's at least one person, somewhere) would take them up on it.

It's a 50/50 proposition. The courts have to choose between forcing the manufacturer to attempt the lengthy terms and conditions down the throats of people who aren't going to pay attention no matter what the terms say, and holding consumers responsible for terms and conditions that they may not have conveniently been able to read before bringing the box home.

As for simplifying the terms, that's not going to happen ever. As long as there's going to be the battle of rights between the two parties, the manufacturer is going to continue attempting to shut down loopholes. Look at the current battle over DVD rights for a good example. As each side claims to have more and more rights (time-shifting, fair use) the other side claims the opposite and does it's bit to counter-act those claims (you don't have the right to distribute copies, you may or may not be able to download a copy.)

Re:Yay DRM.

[PitaBred]

So, is a company not liable when it sells you a part that doesn't function like they said it would? "I sold you that dog, but it turns out that he was malnourished and died the next day? Sucks to be you". Doesn't quite fly. There have to be reasonable limits on disclaimers, and I'd think that a gaping security hole in the system built in solely for anti-operator actions that happened to be WORSE for the buyer/owner/operator than it was originally intended to be really isn't what someone realized was part of the package when they got it.

Re:Yay DRM.

[PitaBred]

"Asphinctersayswhat?"
"What?"
"Exactly!"

Re:Yay DRM.

[PitaBred]

Uhhh, sure, this is food. I won't feel bad about selling it to you. Oh, you mean it was rat poison? Oh well. Tough cookies. You took your chances giving me money in the first place.

Re:Yay DRM.

[reebmmm]

First, most courts today state that the fundamentals of contract law are: offer, acceptance and consideration. While it is true, that "meeting of the minds" (assent) has historically been listed as one of those elements, you give it too much weight. Courts nowadays have basically disregarded it as a requirement of contract (See Mark Lemley's "Terms of Use" for a long list of citations). I bet that there are very few courts that wouldn't enforce a contract merely because someone didn't read it and didn't negotiate it. To a court, a manifestation of "assent" (such as clicking "I accept") is enough evidence that the parties recognized a contract was being for and would probably get over the "assent" pretty easily--even if there isn't the nobleness of a fully negotiated agreement.

Second, even if there were an assent problem, broadly declaring a contract void and unenforceable for that reason is really bad policy. That's far to strong a result and it would leave the everyone (including the purchaser) unprotected. I haven't done the research for you, but I'm sure that you can find really old common law cases that relied on lack of assent to deal with how to get a "meeting of the minds" without voiding the entire contract. They likely still would not reach your conclusion.

Third, it's not clear that there would be a failure of assent anyway. The test for assent is usually an objective one: would a reasonable person [usually a judge, sometimes a jury] looking at the acts of the party understand the parties to have reach an agreement WITHOUT reference to what the parties actually thought they agreed to. Hence the reason that acts (such as clicking 'I accept') matter in this situation. Laziness or lack of understanding doesn't help you here when you were presented with an opportunity to do so.

For these reasons, the question isn't usually "assent" ("meeting of the minds") it's one of notice.

Finally, and just food for thought, what happens if a court doesn't enforce EULAs as they are now? One result is that the terms are just moved elsewhere and somewhere more readable. This would certainly impose additional costs on bricks and mortar purchases (think rental car agreements for software purchases!). It also wouldn't change online sales where terms are frequently presented BEFORE a sale anyway. So the net result is a policy that benefits online sales, punishes regular purchasers, and changes nothing.

Re:Yay DRM.

[Holmwood]

The company that sold you the dead parrot... err... dog... might well be required to refund you your purchase price, sure.

The distinction is, if the dog they sold you fails to apprehend an intruder who robs you blind, they're not liable for everything he stole.

Similarly, if some piece of software you purchase for $500 crashes and corrupts your hard drive, the developer isn't liable for the $100,000 (pick a number) worth of data you have on the drive.

Limitation of liability is important, and not just for 'evil' big companies and their presumably not-so-evil shareholders and employees. Would you like unlimited personal liability for every piece of code you write?

Re:Yay DRM.

[reebmmm]

This is actually a more complex question.

First, even the most onerous EULAs have a warranty that looks something like this: "Licensor represents to you that the Software will perform substantially in accordance with the Documentation. LICENSOR HEREBY DISCLAIMS ALL OTHER WARRANTIES..." Therefore, you'd probably have a remedy.

Second, even if they didn't have that warranty, there may be a fraud issue. Fraud can invalidate a contract--including the limitation of liability.

Third, if there's not fraud, there could be mistake. Mistake may void a contract as well.

Finally, the limitation of liability is really meant to protect the software vendor from risks that they have not priced into the sale of software to you. Therefore, both parties will share the risk (though, disproportionately on you). As I said in another comment, a limitation of liability may not be enforceable if relates to a protected party's gross negligence or willful misconduct.

This standard probably wouldn't reach bad programming or bad design. If that were the case, a lot more software companies would need a lot more insurance. In fact, it would probably make OSS impossible.

Re:Yay DRM.

[node 3]

// If more people were aware of these things, then vendors would be forced to make their license agreements less onerous. // That doesn't necessarily follow.

It does, if people were unwilling to accept onerous agreements, vendors would be forced to change them. You said, "if more people are aware of these things", not "if more people were unwilling to accept onerous agreements". It's an important point, and I do not think a mis-wording on your part. How many geeks are sufficiently aware of the 'onerous agreement' and still willing to click "I Agree"? I suspect your average person, were they aware of the terms, would be even more likely to accept.

It just doesn't follow that onerous terms are sufficient to stave off acceptance of the agreement. "Free Market", Libertarian-types, will point out that this means that the terms are acceptable. I fully disagree with this notion. The problem is that, for most people, it is (or they think it is) a choice between Windows and nothing. That puts Microsoft in a position to make outrageous demands, because they are competing against "No Computer At All", not "Reasonably Equivalent OS B with less onerous EULA".

These agreements won't be changed without user education. That's not true. Not even *remotely* true. A single lawsuit that only accidentally educates a fraction of the user population could change these agreements. A law, which educates even fewer users, could have the same effect. Other marketplace changes could change the EULA. For example, if Linux ever became a major threat against Windows (a greater threat than Firefox currently poses against IE, for example), MS's EULA could change, not because the users are any more educated, but because it might keep the geeks that advise their friends and family, and write tech reviews for the media, might either be less adamant about promoting Linux, or more friendly towards Windows.

The point being, that there *are* ways to change the EULA that don't require user education. Even more notable is that these ways are much easier to bring to pass than the monumental task of not only *educating* a majority of users, but of also convincing them to care enough about this issue to switch from Windows in numbers sufficient to convince MS to fix their EULA.

Re:Yay DRM.

[rtb61]

Only in a very few states is the EULA actually enforceable. In the majority of locations any conditions of contract have to be available and visible at the point of sale. The fair and logical reason for this is the customers cost in going to the store to get the product, returning home and installing and setting up the product only to find the conditions unacceptable and then having to return the product. So in the case of M$ windows O$ say an hour to get the product, and hour return trip home, four hours to install the product in between and seriously what criminally corrupt anti-consumer state would consider that all the customer is entitled to is a "fuck you", sintead of a fair a vaild 6 hour payment for the labour, plus the ancillary costs, so be be legally fair, for the EULA to be legally binding, if the customer refuses to accept the EULA, M$ should pay the customer cost for the purchase and return.

Re:Yay DRM.

[Pofy]

>Pff. When you installed windows you agreed not to hold them liable.

Pff. When many people installed windows they lived in countries with consumer laws not allowing the removal of many liabilities thorugh contracts.

Re:Yay DRM.

[Pofy]

>Also, despite what slashdotters like to think, EULAs almost
>certainly meet the requirements of contracts: offer ("take
>it or leave it"), acceptance (by signature or performance)
>and consideration (in exchange for the right to use the software
>at the price I'm selling it to you, you agree to these other terms).

I guess contract law can differ between countries, but at least here in Sweden, one of the requirements of the contract is that the acceptance should reach the one making the offer. There is no contract until that moment. Thus if one one can intercept the acceptance before it reaching the one making an offer one can recall it. For example, if you send in a mail were you accept a contract offer, one can tear it up before putting it on the mail box or even after putting it there, if one can get the mail back before it is deleivered one can also tear it up and so on. In no case is there a contract formed.

A problem in the case of many such EULA contract offers is that there is never any acceptance that reaches the one making the offer. Note that the software or program itself can't work on behalf of the one making an offer since a computer program is not a legal entity. This of course means one need to have some copmmunication back (over the net for example).

One can also discuss what types of performances or actions that can be acceptable as showing acceptance. In the case of software, it is typically in one way or another "if you use it" (this includes the Click on OK since the software is basically set up to not be usable unless you do so). So what other such perfromances are acceptable? One can note that at least Swedish contract law doesn't specify any specific ways how the acceptance or offer shall be made and one can not generally through the contract specify how a contract should be formed. You can't contract saying that an oral contract is not valid since the law specifically allow any way to form contracts. This was even in court not long ago for cable televisions were the cable company claimed that to end the contract one had to do it in writing and that it was not valid to do so orally (for example by phoning). It was ruled that this was not acceptable since the law honours any form of entering int contract. So what if one indicate in some way the none acceptance (other than clicking "do not agree" button) for example by sending a letter to the manufacturer, and then continue to use the program? Is really a contract formed (note that you really don't have to specifically decline a contract for it to not apply, such types of contracts were you enter into a contract by NOT telling you don't want to is not allowed).

One can think of many other "problems" with the way EULA contracts are offered and entered into (or not entered into). Of course, it can probably vary a lot between countries.

6 years old?

[Anonymous Coward]

So, wouldn't this be a -2190 day vulnerability?

That's not *terrible* by MS or Oracle standards...

Re:6 years old?

[Racemaniac]

depends on how long they know it
the 0day doesn't specify how long the bug has existed, but since how long they know how to exploit it

Re:Not a bug

[TheMeuge]

It's not a bug, it's a feature.

0 Days

[DrSkwid]

0 days is the length of time Windows goes without a critical vulnerability.

Yay DRM!

[aweiland]

Another glowing testimony for the greatness that is DRM.

Re:Not a bug

[Atriqus]

...And that feature is: to bug your machine.

WINE

[Anonymous Coward]

Sigh, call me when WINE catches up with this feature.

Here is update (Macrovision SECDRV.SYS Driver)

[holywarrior21c]

Upgrade your driver here: http://www.macrovision.com/promolanding/7352.htm
Microsoft Security Advisory(944653)http://www.microsoft.com/technet/security/advisory/944653.mspx

Re:Here is update (Macrovision SECDRV.SYS Driver)

[Sen.NullProcPntr]

Can I just delete secdrv.sys?

AFAIK I don't use any macrovision disks.

Re:Here is update (Macrovision SECDRV.SYS Driver)

[BlueStrat]

Can I just delete secdrv.sys?

AFAIK I don't use any macrovision disks.

Well, I just renamed the files to $secdrv.sys (I found 2 copies..one in system32/drivers and one in a game folder (MechWarrior4 Vengeance, in mw4x folder) and the game still loads and runs.

Cheers!

Strat

Re:Here is update (Macrovision SECDRV.SYS Driver)

[Nom du Keyboard]

Well, I just renamed the files...and the game still loads and runs.

Did you reboot after the rename, and ensure that the rename still held? DRM seeks to protect itself.

Re:Here is update (Macrovision SECDRV.SYS Driver)

[Anonymous Coward]

Oh great! I'll download this DRM update ASAP!

Re:Here is update (Macrovision SECDRV.SYS Driver)

[DigitAl56K]

Being vulnerable or upgrading the Macrovision drivers you never knew you had = Stuck between a rock and a hard place.

Re:Here is update (Macrovision SECDRV.SYS Driver)

[RadioElectric]

Don't say that, once it's proven to be self aware it'll get rights of its own!

Re:Here is update (Macrovision SECDRV.SYS Driver)

[TheoMurpse]

If I recall correctly, to remove/delete/rename anything in the system32 or I386 folders, you have to boot Windows into safe mode. Otherwise, whichever file you change will be replaced by a backup from the other of the two directories.

Why are they shipping this in business computers?

[140Mandak262Jamuna]

This is complete lunacy. Almost all corporations prohibit their users from playing computer games on their PCs. The fastest safest thing for MSFT would be to tell its customers, "If you are not playing macrovision protected games in your computer, just rename this xxx.dll or yyy.sys file."

Why was it not disclosed to the corporate customers that a dll or a sys file, that is exclusively used to play games published by a particular vendor is bundled and installed on ALL their computers? What are the priorities here? We have been pained enough by MS-Office suddenly demanding you to pop in the origial CD/DVD-ROM to get a particular module. But they don't want their users to be hassled to fetch the original disc to get a driver used only by a subset of users. How screwed up this set up can be? Why are not the corporate customers demanding a full disclosure of what is being bundled, and why and what can be safely removed from their computers?

Does the total cost of ownership studies include the cost of keeping up with these security disclosures and applying patches to the holes?

DRM: It's not just wrong

[blueZ3]

It's wrong in so many ways.

I'm not a big fan of the "oh noes! DRM is the suxors!" crowd, because I'm rational enough to see both sides of the DRM issue: producers want to get paid, consumers want full control over what they've bought. But there are a lot of reasons DRM sucks, besides the wild conspiracy theories and the "porn just wants to be free" arguments that you regularly see on /. This article is an example.

Letting some (lame) third-party, like Macrovision, put hooks into the OS, and then have no clear or timely answer on how this is going to get fixed is a perfect example of why I'm opposed to this type of restriction. On top of that, every expensive new DRM trick that gets tried is broken almost immediately by hackers and companies that see profit in selling the work-arounds. So what's the point?

I think Apple's solution with iTunes was a reasonable compromise (though I know not everyone agrees). You prevent casual copying to reassure the artists/labels, but let users access the music on a large number of computers/devices and close your eyes to the loopholes that essentially allow unlimited copying into other formats. I never found Apple's DRM onerous, obtrusive, or objectionable (nice alliteration, eh?)

In any event, I think that it's likely that this argument (for music) is likely to be mooted in the next year or two as the industry embraces the MP3 format. Whether the movie industry sees the light and follows their lead is another question.

Re:DRM: It's not just wrong

[MarkGriz]

"I never found Apple's DRM onerous, obtrusive, or objectionable (nice alliteration, eh?)"

Unless you are one of the millions of people that have a non-Apple MP3 player.

Re:DRM: It's not just wrong

[Dog-Cow]

Apple's DRM has zero affect on non-Apple anything.

Re:DRM: It's not just wrong

[OrangeTide]

iTunes music has always played fine for me in my car CD player. And I don't own an iPod.

Re:DRM: It's not just wrong

[Bert64]

It is completely unreasonable to have this macrovision driver on every windows system, even those that will never be used to run games.
Windows 2003 is supposed to be a server OS, and yet it ships with drivers for copy protection schemes in games? How ridiculous is this?

DRM does not, and is not intended to, stop piracy. DRM is fundamentally flawed due to it's very nature of having to give out the keys in order to play DRM'd media. The major cracking groups have some very skilled people, and any DRM scheme will be cracked fairly quickly. Pirates will then simply obtain copies of media which has had the DRM stripped.
Legitimate buyers on the other hand, will receive DRM encumbered versions and have to buy multiple copies for use on different devices, or replacements for damaged/lost media etc. This is what DRM is for, to extract more money from the people who are willing to part with it. Look at systems like the region encoding on DVDs or console games, they don't even pretend to do anything to stop copying, they are simply used to gouge different markets.

DRM ensures that paying customers suffer, and get shafted even more. Pirates are better off, having a more usable product.

I would quite happily pay more for the pirated versions of many things.

Re:DRM: It's not just wrong

[cstdenis]

The media companies WANT their customers to get shafted. They like it when customers have to by their content over and over again in different formats.

Re:Not a bug

[Anonymous Coward]

If you've read up on some of the abusive tricks these copy protection schemes pull (corrupt registry entries etc.) I really wouldn't be surprised if it WAS a feature that something relies on.

There's a solution!

[VincenzoRomano]

Don't worry, windowers!
All these problems will loose any meaning with ... Windows 7

Re:There's a solution!

[Anonymous Coward]

Don't worry, windowers! All these problems will lose any meaning with... Linux.

There, fixed it for you.

Re:There's a solution!

[Anonymous Coward]

All these problems will loose any meaning with ... Windows 7

Yeah, but my linux goes to 11.

Re:There's a solution!

[HTH NE1]

Don't worry, windowers!
All these problems will lose any meaning with ... Windows 7 What's in the box?

1) Accountability 2) Technical integrity

[dpbsmith]

How can an operating system be considered "secure" if the inclusion of a third-party component makes it insecure? Why does Vista allow Macrovision's component to do whatever it likes?

Is this a case where Microsoft allowed "signing" to be a substitute for good engineering?

Even if the act of buying Windows implies that I trust Microsoft, does the act of buying Windows imply that I trust Macrovision?

When I buy a home computer with Windows on it, do I even know all of the companies that have contributed content that is included on the hard drive at the time of purchase? Do I have a list? Have I agreed to trust them all? Does Vista trust all of them? Could all them them punch holes in Vista's security if the vendors that supplied them don't have engineers as competent as Microsoft's?

Re:1) Accountability 2) Technical integrity

[A beautiful mind]

Could all them them punch holes in Vista's security if the vendors that supplied them don't have engineers as competent as Microsoft's?

Let's stop asking highly theoretical questions.

Re:1) Accountability 2) Technical integrity

[Anonymous Coward]

I think you'll find Linux kernel modules can do whatever the hell they like too, including elevating privileges.

Re:1) Accountability 2) Technical integrity

[Anonymous Coward]

This vulnerability doesn't affect Windows Vista.

Re:1) Accountability 2) Technical integrity

[BronsCon]

Could all them them punch holes in Vista's security if the vendors that supplied them don't have engineers as competent as Microsoft's?
Yes, they could.

Show me a vendor with engineers less competent than Microsoft's.

I keed, I keed! Or do I?

Re:1) Accountability 2) Technical integrity

[PitaBred]

I trust the kernel devs with commit access to the source repositories. I also trust NVIDIA. That's a MUCH smaller chain of people to trust, with much more well-known motives and identities.

Re:1) Accountability 2) Technical integrity

[Anonymous Coward]

"Signed" means "paid Microsoft off". It doesn't mean "trustworthy". Once you realize that it becomes clear that "signed" software may actually be something to be avoided.

Fixed in Vista - WTF?

[shadow_slicer]

Thanks to this security review, this vulnerability is not present in Windows Vista

So they fixed it in Vista, but didn't send out a security update for the other systems?

Re:Fixed in Vista - WTF?

[Unclescar]

So they fixed it in Vista, but didn't send out a security update for the other systems? No, like everything else, they broke this in Vista. No doubt they will release a "fix" that will reactivate this feature at a later date.

Re:Fixed in Vista - WTF?

[Anonymous Coward]

Remember that whole new driver model in Vista that required everything to be rewritten?

Re:Fixed in Vista - WTF?

[Zerimar]

I think the idea is that the flaw exists in Vista, but because Vista is quite a bit smarter about how hit handles itself, the code can't exploit the kernel.

you mean...

[realkiwi]

... XP has been around for 6 years? And Dell is still offering it?

Re:you mean...

[jo42]

...that's because Vista is a Pile of Horse Poop (c)(tm).

MS have known about this bug but didn't update.

[Rashkae]

FTFA, the bug was fixed in Vista, becasue "Microsoft and Macrovision worked together during the development of Windows Vista RTM [release to manufacturing] to review the security of the Vista version of the driver."

Hackers only started exploiting this 3 weeks ago, but MS must have known about this for 6 months at least. Macrovision even offers an update for WinXP on their web site based on the same fix, but MS never pushed the update through their security update mechanism, and even now, isn't commiting to it.

So, to recap for those keeping score at home, you now have to download patches for Windows system files from Macrovision's website! MS bashers have a goldmine to work from here.

Re:MS have known about this bug but didn't update.

[Anonymous Coward]

How about I just delete the defective-by-design DLL???

Re:MS have known about this bug but didn't update.

[jo42]

The 'fixed' secdrv.sys in SECDRVSYS.zip from Macrovision's web site is dated 2006-09-13.

So it has been over a year...

Re:MS have known about this bug but didn't update.

[Dan East]

Hackers only started exploiting this 3 weeks ago ...that we know of. It is likely that on some irc channel a couple of hackers are congratulating themselves on having kept this exploit under wraps for the last half decade.

Dan East

Re:MS have known about this bug but didn't update.

[ThinkFr33ly]

You're jumping to conclusions. We simply don't know all the facts at this point.

What we do know is that the bug doesn't affect Vista for two reasons. First, some of Vista's new security functionality prevent the privilege elevation regardless of the version of the DLL in question. Second, Microsoft included a newer version of the DLL with Vista, and this version of the DLL doesn't have the potential to attempt the elevation to begin with.

One possible explanation for this is that Microsoft didn't discovered the exploit and then tell Macromedia to write a new driver so they could include it in Vista, but instead that Macromedia provided Microsoft with a new version that *happened* to fix the issue in question and that version was included in Vista. Microsoft was unaware of the exploit, and therefore saw no reason to push that newer version down to old versions of Windows.

The driver model for Vista is quite different than the model for XP/2003. It's entirely possible that the act of re-writing the driver for Vista eliminated the bug without Macrovision even knowing about it, or that the new driver model makes that kind of bug impossible.

The point is, you're assuming that Microsoft and Macrovision knew about the bug and kept it quiet... but you're basing that off basically nothing.

Re:MS have known about this bug but didn't update.

[Rashkae]

Actually, I'm basing it on a quote provided in my comment, not to mention that Macrovision *already* has a fix, which someone else here already claims to be over a year old. And we also know that this has been a known "in the wild" exploit for 3 weeks before MS even bothered to release a security announcment, even though the fix already existed.

Nothing indeed, pfeh. *Fail*

Re:MS have known about this bug but didn't update.

[orkysoft]

Well, they could have guessed that something was up when Macrovision offered an update on their website.

It must have been very curious why Macrovision offered the update, but it was not in Windows Update. That meant that very few Windows users would install the update.

Comparing the old to the new version might have offered some clues as to what's going on, and allow them to find a way to exploit the old version.

Re:MS have known about this bug but didn't update.

[hweimer]

This is a privilege escalation bug, meaning you need to have access to the machine in the first place. Microsoft usually doesn't care about them (the GDI bug was fixed about six months after the MoKB post) for two reasons: First, most people work with administrator rights anyway, and second, this is only relevant in true multi-user environments, which have never been the top priority for them.

Re:Why are they shipping this in business computer

[Hatta]

How are they shipping this on computers anyway? Isn't Macrovision that crap that makes it impossible to dub VHS tapes without the gain going crazy and looking awful?

Heh

[Anonymous Coward]

Safedisc is crap anyway. At least up to v2.x can easily be defeated by a generic unpacker, and all versions are vulnerable to loopback mounting e.g. with daemon tools + CureRom.

Re:Why are they shipping this in business computer

[MarkGriz]

More to the point, why in the world would this file even be included on Windows Server 2003?
Not all business prohibit games, but I doubt there are any sysadmins playing games on their server machines.

Re:Why are they shipping this in business computer

[petermgreen]

That is macrovisions most famous defective restricted media system (mainly because it was one of the first defective restricted media systems created) but it is far from thier only one.

Re:ZOMG SIX YEARS?!?

[A little Frenchie]

can you lose control of your computer with that tool tip display bug? i don't think so

Re:Why are they shipping this in business computer

[Anonymous Coward]

I didn't realize this .sys file was included w/ Windows.... I had always assumed it was put onto my system by a game I installed.

Either way I used SysInternals' (Now owned by Microsoft) AutoRuns to disable it (along with WGA and a few other things).

Re:Yay DRM + Vista

[n0084ever]

... just another 'feature', and reason to upgrade to Vista

/sarcasm off

Gee...

[jskline]

You'd think by now people would have begin to move over to something non-microsoft but this too shall be not true. Too many sheep in the fields and Mr. Ballmer seems to be herding his sheep rather well.

Re:Why are they shipping this in business computer

[Anonymous Coward]

You obviously ain't a sysadmin.

Re:Why are they shipping this in business computer

[gEvil (beta)]

Not all business prohibit games, but I doubt there are any sysadmins playing games on their server machines.

You severely overestimate the brainpower of a Windows sysadmin.

What is the vulnerability?

[Monty845]

It should be required that any story about a security hole indicate whether user interaction is required for the system to be comprimised... If I have to download/run something then I could care less... only if the vulnerability can be exploited remotely with NO interaction on my part do I care... There are many stories that hype threats were it all boils down to the user running something they shouldn't have.

How is this vulnerability exploited?

Re:What is the vulnerability?

[argent]

During the weekend I found an interesting sample exploiting a possibly new and undocumented vulnerability for Windows XP and 2003. The exploit is a local privilege escalation that allows users with a restricted account to gain a SYSTEM shell with higher privileges. In my tests the exploit seems to work successfully against a fully patched Windows XP-SP2 and also Windows 2003-SP1. At this time, Vista does not seem to be affected by the problem.
-- Elia Florio

Local privilege escalation.

Re:What is the vulnerability?

[garylian]

Reading the actual article FTW!

It came packaged with every copy of Windows XP (and Server 2003) that M$ has sold.

Re:What is the vulnerability?

[iibagod]

If you aren't made aware of which exploits require user interaction, then how do you know you're NOT vulnerable? I assume you interact with your computer...

Re:What is the vulnerability?

[sexconker]

You couldn't care less.
Couldn't.
The phrase is "couldn't care less".

It means you care the minimum amount possible.
Saying you could care less means you do care.

I could care less about my health.
I couldn't care less about vegetables.

Re:What is the vulnerability?

[I'm Don Giovanni]

You're correct, but there is a warped way of looking at things where "I could care less" would be proper.
"I couldn't care less" typically means that it's impossible for me to care less because my care level about the issue in question is zero.
But "I couldn't care less" could also mean that the issue in question is so important to me that there's no way I could care less about it. The corallary of this would be that the issue doesn't mean much to me, so while I might care a bit about it, I wouldn't have any problem caring less either, so "I could care less" would mean that the issue in question isn't important. :p

Re:What is the vulnerability?

[jafiwam]

Way to not get or refuse to answer the question! Escalation is one small step in the process, the OP was asking about that overall process, not the one step in the .sys file.

Local privilege escalation an be executed against the user account used with IIS (for example) no?

Or, perhaps the guest account, or whatever is used to display default printer shares on an otherwise unshared machine.... etc.

One would think if there is evidence there is zero day stuff out in the wild using this, someone could have captured the attack profile and stated a basic fact about that profile; do you gotta be doing something stupid sitting there in front of it to get this or not?

Re:What is the vulnerability?

[argent]

Then he should have asked about the attack, not the vulnerability. From the message I replied to: "only if the vulnerability can be exploited remotely with NO interaction on my part do I care". That's not a question about the whole process, it's a question about this particular hole.

This is not a remote execution hole. Whatever code it was found in may have contained exploits for other vulnerabilities, or this may have been part of a rootkit dropped by an otherwise unrelated exploit. But this vulnerability itself is not exploitable remotely. Most likely this was part of the payload of an already reported exploit or a variant thereof.

do you gotta be doing something stupid sitting there in front of it to get this or not?

That depends entirely on the other vulnerabilities exploited by the attack Elia Florio was investigating. There are so many active attacks that which particular one this was buried in is not really relevant. There's one out that attacks the recent patch to Word (so patch your copy), there's been a bundle of attacks targeting instant messaging systems and browser plug-ins, there's the recent flood of URI quoting holes targeting Windows' ShellExec call, and even one that attacks "Clippy" (yay, another already-installed ActiveX hole... Microsoft's ten years of denial about the way their HTML control uses ActiveX continues apace: their security fix is another bandaid. Personally, I trashed agentdpv.dll instead: it's not like I'm ever going to want that horrid thing).

The bottom line is that this is not a new remote execution vulnerability. Don't do anything different as a result of this, unless you're doing something hazardous like browsing the web with IE. :)

Windows 2000 is still immune. :)

[argent]

Makes me doubly glad I've stuck with Windows 2000 all these years.

DRM doesn't help producers make money

[LKM]

I'm not a big fan of the "oh noes! DRM is the suxors!" crowd, because I'm rational enough to see both sides of the DRM issue: producers want to get paid

Here's what you're missing: DRM hurts precisely those people who actually do pay the producers.

If I buy a DVD in a store, I get the hassle of DRM, and putting it on my iPhone is going to be complicated. If I just download the movie from the Internet, I just open it in QuickTime and export to iPhone. If I buy music in the iTunes Music Store, I can't easily use it on my PC at work, unless I authorize it with my iTunes login, only to forget to de-authorize it if I get a new computer or reinstall the OS. If I just download music, I have none of these issues.

Now, I do buy DVDs, and I do buy music from the iTunes store, and I do buy a lot of stuff with DRM. But I do not buy these things because they have DRM, but despite of it. DRM is actually an incentive to not give the producers money; without DRM, they'd see a lot more money from me.

shaking my head...

[logicassasin]

Wow... It's 2007 and some people still don't get it.

Many people (myself included) would love nothing more than to move away from M$ products but, sadly, are trapped in them because of the applications we use. I can't use linux for music production and the particular apps I use don't exist under MacOS (Sonar 6 and FL Studio). While I can certainly do Flash authoring under OSX, I can't under Linux. One of my PC's has an old Matrox Mystique220 with Rainbow Runner Studio in it. There are no Linux drivers for it. That PC runs Win98SE and servers as my video editing box (TBird 1.3GHz/512MB RAM). The RR Studio has a feature that makes it quite unique; it ignores Macrovision encoding on VHS. Because of this, I have a nice little niche business of transferring old VHS tapes to DVD or VCD. Won't work anywhere else but Win98SE, so I stick with it.

My programming/scripting machine runs Linux (Mandriva 2007 Spring) and my tinkering machine runs FreeBSD 6.0, so I'm partially M$ free.

Re:shaking my head...

[jskline]

I know the feeling man. I am also a musician and have a 16 channel audio production machine set up now with 2000 only because the drivers in Linux have too much of a latency issue and are unreliable. And; yea, I'm also a Cakewalk user as well as MOTU, and others and it stinks that I'm still stuck. I hear soon tho we'll finally be able to ditch Windows for some of this. Someone claims to have gotten Cakewalk working in WINE I think thou I have yet to find out who and how.

However my other machines are now Ubuntu and Fedora Core and I do own an iMac so it has MacOSX on it. I think I'm reasonably covered for all the stuff I do.

Re:shaking my head...

[couchslug]

Thanks to your post I was inspired to Google, and there are many other capture cards that ignore Macrovision.
There are forums like doom9 and videohelp where you can go for much more info.

Re:shaking my head...

[PitaBred]

Have you looked into Jack?

Software freedom is the cure.

[jbn-o]

How can an operating system be considered "secure" if the inclusion of a third-party component makes it insecure?

This has to do with the software being proprietary, not coming from a third party.

How can an operating system be considered "secure" if it has proprietary software installed? It can't. Proprietary software security is unverifiable by anyone you can trust and therefore unworthy of being considered secure. Apparently bugs will go unfixed for years because only the proprietor is allowed to fix the bugs. However, the proprietor is unmotivated to fix bugs until the proprietor is pushed (through publicly announced exploits, better competition, and so on). All the while you, the user, are denied complete control over your computer.

The cure is simple: install nothing but free software on your computer. Give yourself the freedom to inspect, change, and share the software, hire someone else to do it for you, or leverage the talent of a community of hackers improving free software all the time. This is not about making everyone a programmer, it's about giving people the freedom to control their computers while building a society of cooperation and social solidarity. Proprietary software denies you your software freedom, so deny proprietary software a place on your computer.

Re:Software freedom is the cure.

[LO0G]

That's cool - fortunately no open source software uses the systrace facility, which has at least one well known vulnerability that affects apps that use the facility.

The base comment is the one that's unreasonable (an OS can't be considered secure if it allows 3rd party applications to make it insecure).

By that standard, no general purpose operating system in use today can be considered "secure".

If the operating system allows the use of 3rd party code that runs with supervisor privileges, then the 3rd party coe can render the operating system insecure.

Re:Software freedom is the cure.

[mrsteveman1]

The cure is to balance usability with security, not run to FOSS every time some vulnerability is discovered in Windows.

Re:Software freedom is the cure.

[I'm Don Giovanni]

"How can an operating system be considered "secure" if it has proprietary software installed? It can't. Proprietary software security is unverifiable by anyone you can trust and therefore unworthy of being considered secure."

huh, I didn't know that software verification had been perfected such that FLOSS was "verifieable" as "secure".
The fact is, FLOSS "security is unverifiable by anyone I can trust and therefore unworthy of being considered secure."
I don't know who is "verifying" the security of FLOSS. Linus? He's just one guy, who can't verify the security of every distro out there.
Red Hat? Don't make me laugh. Why would I trust them over any "proprietary" software maker to "verify" that their code is "secure"?
Ubuntu? The same group that released an OS update that wiped user's home directories? Are they the ones that I should "trust" to "verify" the "security" of their distro?
The "million eyes" thing is a kanard. FLOSS is no more secure than proprietary, and the security update stats for Linux, windows, and Mac over the last two years show this. Hell, the increasing frequency of Firefox security updates shows it as well.

Re:Software freedom is the cure.

[Anonymous Coward]

How can an operating system be considered "secure" if it has proprietary software installed? It can't. Proprietary software security is unverifiable by anyone you can trust and therefore unworthy of being considered secure. [...] The cure is simple: install nothing but free software on your computer. Give yourself the freedom to inspect, change, and share the software, hire someone else to do it for you, or leverage the talent of a community of hackers improving free software all the time. This is not about making everyone a programmer, it's about giving people the freedom to control their computers while building a society of cooperation and social solidarity. Proprietary software denies you your software freedom, so deny proprietary software a place on your computer.

Wrong. See Reflections on Trusting Trust. Most people just download the binaries of FOSS, because compiling yourself is pretty inconvenient. How do you know that the binary was produced from that source? Even if you download the source and compile it yourself, how do you know there wasn't a backdoor hidden in your compiler? Let's say you wrote your own compiler. Well, you either had to compile that compiler you wrote (in which case you're exactly in the same situation as before), or you had to run the your code through an interpreter, which may be a software VM style interpreter, or at the very least, if you wrote the code in machine code, had to be interpreted by the CPU. How do you know there isn't a backdoor hidden in the interpreter? You'd have to either write your own interpreter in software (which either has to be compiled or interpreted, which brings you back to the same problem), or you'd have to build your own hardware-interpreters (aka your own CPUs) from components.

In other words, you're trading security for convenience. Maybe there exists some people who care enough about security that they'd build their own CPUs from scratch. Most people don't have the skills or are too lazy. Maybe of those people, some care enough about security to write their own interpreter/compiler software. But most of them are too lazy or don't have the skills. Of that latter subset, maybe some of them care enough about security that they'll actually read the source code. But most of that subset is too lazy or don't have the skills. Of this even smaller subset, maybe some of them care enough about security that they'll have a policy of only using FOSS, and depend on the community to verify the source code for them. Others will be too inconvenienced to do even that. Of those, maybe some will be willing to use a mix of open and proprietary software, balancing convenience versus security. And yet again, there exist people too lazy to do that, and who just use whatever software came with their computer.

Re:Software freedom is the cure.

[Bert64]

You don't know and trust anyone capable of auditing code? That's a pity.

With proprietary software there is only one entity that can verify the code, with open source there are many. There's no guarantee that either of them will, but 50000 chances are better odds than 1 chance.

As for security updates, this is an unfair comparison. Open source development, including finding and patching of security holes is done in the open, so any security issue becomes known about. Proprietary vendors on the other hand, typically do not disclose any vulnerabilities which are discovered internally, instead preferring to silently patch them, or not as the case may be. Several such issues have been found by reverse engineering mystery patches. The article as well points out another. The macrovision issue was found and fixed in vista, but they didn't patch it in xp or 2003 because then they would have to explain why the secdrv.sys file was being modified, and someone would have reverse engineered the patch to make an exploit. Instead, they leave it unfixed and gamble it wouldn't be discovered, that gamble didn't pay off in this case but how many other issues have they silently fixed which haven't been discovered and disclosed yet?

Re:Software freedom is the cure.

[Bert64]

You don't, your gambling that one of the people or organisations that looked at the code would have found and disclosed any malicious code located there.

The difference is:

With proprietary code, only one organisation has seen the code and they have no incentive to disclose any malicious code because it's them who put it there.

With open code, many organisations and individuals could have seen the code, and the vast majority of them have no incentive to keep any malicious code under wraps, in fact many will be users who would be very angry about finding such malicious code and would be highly vocal about it.

And in terms of someone writing malicious code, they are less likely to add such code to a program where the source is given out, as there is a much greater chance of it being found, which would result in a complete loss of credibility for the author.

Re:Software freedom is the cure.

[ChaosDiscord]

huh, I didn't know that software verification had been perfected such that FLOSS was "verifieable" as "secure".

You're missing the point.

If you wanted to verify the security of, say, Red Hat Enterprise Linux 5, you can download the source and start reading. It'll be slow, and may not be practical. But you're free to do it. You can pay someone else that you trust to do the review for you. And while reviewing the entire system probably isn't feasible, you can certainly review subsets that you consider important. You don't have to trust Linus or Red Hat or anyone else.

If you're like to verify the security of, say, Windows XP on the other hands, you're out of luck. You trust Microsoft or you don't. If you're really brave (and willing to violate the EULA you probably agreed to), you can reverse engineer it, but that adds a whole new level of difficulty to the problem.

And lets say you find a security vulnerability. With open source software you can fix it yourself, or pay someone else to fix it, and be on your way. With closed source software you're stuck waiting, or boldly trying to patch a binary (probably in violation of that EULA again). If the software is particularly old (perhaps because you need an old version), with the open source version you can fix it yourself; but with closed source software you may be out of luck if they've dropped support.

If someone else finds a security hole, it's much easier for you to check the problem yourself and confirm that the offered fix actually closes the hole with open source software than with proprietary software. A proprietary software company may promise that the bug is fixed, but have done a half-assed job. You're back to reverse engineering to check.

Openness leads to security. The ability to read and modify the source can make you safer. Maybe you're not making use of that capability, but others are.

Remove secdrv.sys.

[argent]

The only purpose of secdrv.sys is to run games that depend on "SafeDisc" copy protection. If you don't play games on your computer (or you shouldn't... corporate users take note) you don't need it, and if you do you only need it to play games using this particular scheme.

This is a local privilege escalation exploit. An attacker will have to use some other exploit to get onto your computer before using this one to get system privileges. This is another reason for corporate administrators to eliminate the driver, since it can be used by employees to bypass local policies.

Re:Remove secdrv.sys.

[sqlrob]

No, it's to run SOFTWARE with SafeDisc. Although it is probably a game, there's nothing that says it will definitely be a game.

Re:Remove secdrv.sys.

[argent]

What kind of crazy company uses hardware-based copy protection for anything but games?

Got a list of guilty parties so we know who to stay the hell away from?

Re:Remove secdrv.sys.

[sqlrob]

Intuit, at the very least. Quickbooks uses some sort of protection, but I'm not sure what offhand.

Re:Remove secdrv.sys.

[Anonymous Coward]

Many high-end DAW apps do, also I believe some professional CAD stuff. There used to be a release group that specialised in only doing highend audio stuff like ProTools, they had to have this focus really because some of the protections are seriously hardcore. E.g. rather than just doing dongle checks they run critical code on the dongle itself thereby requiring a full, accurate emulator to be written and patched in.

Re:Remove secdrv.sys.

[argent]

OK, so you can only remove this file on 99% of the desktops in a typical company, instead of 100%. :)

I'm a pirate.

[Bellewether]

...and more of my discretionary income goes towards games than anything else. There was an article here this week (http://yro.slashdot.org/article.pl?sid=07/11/03/048256) about the most profligate music pirates being the biggest music *buyers* as well- same principle.

However...the industry, especially PC gaming, has lost quite a few purchases from me because of copy protection. Just a few examples:

I loved Neverwinter Nights. Would have bought the Infinite Dungeons mod, but it requires an always-on net connection while you play to verify you're not a pirate. Screw that.

Starforce? Any Starforce'd game is automatically disqualified from my consideration.

I don't buy games that use Securom or Safedisc anymore, either. As a pirate, I find it inconvenient to have to download bypasses so I can run stuff on my Daemon Tools-happy gaming box. I almost bought Civ 4 and its expansions recently, but the DRM dissuaded me- though it won't stop those who torrented it from downloading a workaround.

I import games. Over the past year or two I've imported multiple games that would never have been released in the U.S.- the Touhou series, both Ouendans... but I won't do so for any console that has to be modded, because it's too much of a pain. If it weren't for that, I would have bought SO much crap for my PS2- guess I'll never buy any of those Cave shooters.

I'm a huge Megaten fan and will gladly buy FES the day it hits stores, assuming it's released stateside, even though FES is generally considered mediocre. If it weren't for emulation, I might not even be a fan of the series. Atlus acquitted itself pretty poorly with its release of the first two Persona games in the U.S.; it was actually the fanslation/romhacking scene's English patches for SMT1 and 2 that got me into the series. (I remember a comment from another Slashdotter who wrote the same thing in another copy-protection thread, too.)

The funny thing is, if I wanted to bypass any of this copy protection, I easily could. Every time this is discussed on Slashdot there are comments from Slashdotters who legitimately purchase games and then download cracked versions because the crippled, boxed versions are too much hassle. Me, I prefer to wean myself off the companies who resort to copy protection. There are plenty of other games out there which are just as good and don't involve all the bullshit- more than I have the free time to play, in fact. I'll just buy some of those instead.

And the games that I DO pirate? Those are the ones I wouldn't have bought anyway- though you only have my word on that. Ever spend time on a forum for an Atlus game? Atlus fans know damn well that they're not dealing with automatic-trillion-sellers like Madden 200X: Same Shit, New Roster or World War 2 Shooter: The Shootening. They (we) will tell other fans to buy, and buy a *new* copy, *before* price drops, *because we want Atlus to release more games we like*.

So: can somebody explain to me why all this antipiracy stuff is necessary? Or even prove to me that it isn't outright counterproductive? Last I heard, Galciv and Stardock were doing just fine.

Re:I'm a pirate.

[p0tat03]

Perhaps you're a rare one, but I don't buy the whole "wouldn't have bought it anyway". IMHO if you play more than 20 minutes into a game without throwing your burned disc out a window, you're being dishonest to yourself about your intentions. It's funny, but I haven't pirated a game in ages, and in fact I never feel the need to. I have found numerous trustworthy review sources that guide what I buy. I don't fall into the preorder frenzy, and I always wait for my trusted sources to give their reviews before I go get the game. The whole "games suck nowadays, piracy is just an extended demo" holds no water in my eyes - I haven't found myself regretting a game purchase in a long time.

Re:I'm a pirate.

[operagost]

Atlus fans know damn well that they're not dealing with automatic-trillion-sellers like Madden 200X: Same Shit, New Roster or World War 2 Shooter: The Shootening.

You should try Cookie Cutter RPG 2: Electric Boogaloo.

Re:I'm a pirate.

[Bellewether]

"IMHO if you play more than 20 minutes into a game without throwing your burned disc out a window, you're being dishonest to yourself about your intentions."

Ever waste a little time playing flash games? Good enough to screw around with for a little while, but generally not so good that you'd pay anything to their creators. For me, the games I pirate are kinda like that.

I don't blame you for being skeptical- if I'm right on the fence about whether or not a game is good enough to buy, being able to pirate it might just tip the balance. The thing is, I can't think of a single example of that happening off the top of my head, whereas I could rattle off a whole list of games I abstained from buying- some of which would have been definite, first-day-in-stores purchases- because of DRM. My original post was tl;dr enough as it is, though.

Re:ZOMG SIX YEARS?!?

[Anonymous Coward]

Don't worry - the astroturfers need to be able to spend their mod points somewhere.

There's just not much positive spin Microsoft marketing can put on this, that's why a dumb dig at a FOSS project gets modded up.

Re:Why are they shipping this in business computer

[sqlrob]

Copy protection != games. Business related software can certainly be protected (cf. Quickbooks)

"The article goes on to play down danger...."

[Anonymous Coward]

From the summary...

"The article goes on to play down danger and claim that Vista is safe, but...." There is no "but", Vista is safe from this particular vulnerability.

Other apps some times use the same copy protection

[Joe The Dragon]

Non Game apps some times use the same copy protection that games use and some M$ apps do use copy protection as well.

Re:Why are they shipping this in business computer

[truthsearch]

There are many files included with Windows that corporate desktops don't require. One of my past employers chose to remove any unnecessary files. Even with a large Microsoft contract, Microsoft refused to disclose the details of every bundled DLL and EXE. So a small team of people deleted each file, one by one, and tested every desktop app in use in the company, until they determined the set of files they didn't need. It's almost silly, but if you're determined Microsoft leaves little choice. (I would have used one of those apps that shows every DLL in memory, but the idea is the same.)

This of course causes problems later, like when a patch or service pack requires a DLL that it never needed before. Or one of the custom apps adds a new feature and needs an OS file that's not part of any standard desktop in the company.

Microsoft isn't interested in giving customers exactly what they need. They prefer to generalize the OS to maximize revenue. These are just some of the negative consequences.

Don't You Just Love

[Nom du Keyboard]

Don't you just love how Microsoft is in bed with DRM, and in the end it always comes back to bite!

unemployed?

[Anonymous Coward]

don't assume everyone is an unemployed cellar-masturbator. the only answer is mac OSX.

Re:unemployed?

[Anonymous Coward]

Windows = n00b linux = cellar masterbater OSX = Flaming or unwilling to come out yet. lol now where do we turn?

I've played this game from both sides.

[argent]

Every time this is discussed on Slashdot there are comments from Slashdotters who legitimately purchase games and then download cracked versions because the crippled, boxed versions are too much hassle.

I did that around 1981 when I went to the local "unlicensed software distributors" at the University to get a cracked copy of Wizardry written out on top of my gold-labeled store-bought floppy because the copy protection had made the original unplayable... which meant I may have had the only "legal" cracked copy in existence. I ran into the author of the game online many years later, and he thought that was pretty amusing.

Several years later a friend and I released a game for the Amiga and since the publisher required copy protection we came up with a copy protection scheme for it that didn't require modifying the OS or bypassing the driver, and allowed the protected disks to be created using a regular script. Since we knew that copy protection was a speedbump, we came up with some speedbump-quality protection that would still do a better job at blocking the most common cracking tools than the "professional" and more intrusive protection schemes.

What we did was take advantage of the way the Amiga identified disks by using a unique ID in the disk header. All copy protection cracking tools we knew of generated a new ID by default, so that the user wouldn't get an error from the OS if they left the original and the copy both in the drives after they exited the program. We stored an obfuscated copy of the ID in file comments, and ran in "demo mode" if they didn't match. It didn't pop up any warning screens, it just wouldn't let you get past the 'attract mode' display. This meant that most people just using a "raw" copier would get an apparently "damaged" copy that still kind of worked... we figured this was unintrusive and at least as good a speedbump as you got from a scheme that had defeat code preprogrammed into the copying tools, for the week or so before it got figured out and our scheme got added to the rest.

We provided our publisher with detailed instructions, explanations, and a set of disks to use to create the copies if they didn't use an image duplicator. They fobbed production off on another company who blithely used one of the cracking tools we were targeting to do the production run. If they'd used a normal image duplicator or our scripts everything would have been fine, but instead all the shipped copies came up in demo mode. Of course the game had to be recalled, and we missed the Christmas launch.

Copy protection (whether you call it copy protection or DRM) increases the costs and risks of production and just plain doesn't do anything more than flashing a "don't pirate this game" splash screen would.

Re:I've played this game from both sides.

[ReeceTarbert]

Of course the game had to be recalled, and we missed the Christmas launch.

Any chance to know the name of the game? Just curious, you know... ;-)

RT
--
Your Bookmarks. Anywhere. Anytime.

Re:I've played this game from both sides.

[99BottlesOfBeerInMyF]

My favorite copy protection was in the game "Escape Velocity." I'm not referring to the mechanism, just the way it was implemented. Unregistered version beyond 30 days did not stop working, or do anything annoying, except occasionally a special, unkillable space ship would show up tell you they hate pirates and attack you... forcing you to jump to another star system or two and escape. Coders that go to that kind of effort inspire me to not only buy the game, but encourage others to do the same.

Re:I've played this game from both sides.

[Lothsahn]

And after a while, that ship appears ALL THE TIME.

I bought the game, but my friend didn't. :) I think it's the only game he DIDN'T crack, because it was so ingenious, he actually kept trying to run from the ship, instead of cracking the game.

Re:I've played this game from both sides.

[Dracolytch]

"Copy protection (whether you call it copy protection or DRM) increases the costs and risks of production and just plain doesn't do anything more than flashing a "don't pirate this game" splash screen would."

Unless, like me, the only means of distribution is over the 'net. In which case, copy protection is the only viable means to differentiate your product from free software.

~D

Re:I've played this game from both sides.

[Anonymous Coward]

Did you sue the provider for not following your instructions?

Re:I've played this game from both sides.

[argent]

I'm not sure what you're getting at here:

Unless, like me, the only means of distribution is over the 'net. In which case, copy protection is the only viable means to differentiate your product from free software.

Are you saying that copy protection makes your product better? More competitive? What do you mean by "differentiate" here?

Re:I've played this game from both sides.

[argent]

Tracers. Dead simple graphics, most of our effort was spent on playability and being a "well behaved" program.

http://amigareviews.classicgaming.gamespy.com/tracers.htm

I can't take responsibility for the box art or backstory, the publisher tossed our concept and redid the whole thing from scratch. Which was probably to the good, since the original backstory we came up with was sufficiently unmemorable that I actually can't remember it. :)

Re:I've played this game from both sides.

[Dracolytch]

It means that if you don't put copy protection on your program, and the only way to distribute your program is via download, without copy protection there would be no means to distribute an unlockable trial version. You'd essentially be giving the game away, and hope people would pay you. Either that or have to produce two versions of the game (One trial one full), and then manage that mess.

~D

Re:I've played this game from both sides.

[innocent_white_lamb]

You'd essentially be giving the game away, and hope people would pay you.
 
That actually worked pretty well for me, back in the late 80's/early 90's. I wrote a fax cover sheet generating program, mostly for my own use and the use of the people in the office where I worked at the time. Just to see what would happen, I released it as $20 shareware. Somewhat to my surprise, over the course of the next few years I had a fairly substantial number of outfits send me $20. Mostly lawyers offices, travel agencies and manufacturing plants.

Re:I've played this game from both sides.

[argent]

I think you're combining two unrelated issues here, and neither of them involve any kind of technical copy protection or DRM scheme.

First, unless your build process is really broken, building two versions of a program for distribution out of the same source tree is trivial.

Second, registration and copy protection are really separate issues. Copy protection involves some kind of obfuscation of a shared secret, typically in hardware or in the OS (though sometimes, as in my case, simply in an unobvious place that requires some effort to find), that locks an instance of an application to a particular system or other asset that can't readily be copied. Registration doesn't require the additional speedbump of copy protection... a registration key can be a simple cryptographic token that can be stored in unobfuscated form in a configuration file and saved and restored by the user. That way the user isn't subject to the risk of his purchase vanishing if he reformats his hard disk or damages the distribution CD, and you as good a speedbump as if you used some kind of copy protection technique: the fact that you can tie it back to the original purchaser is more than enough of an incentive to discourage trading.

I did the day it issued, it appears to be fine

[Anonymous Coward]

Per my subject line above: It appears to work properly so far but "don't quote me on that", as far as 100% for all things working, software-wise, thusfar ON BOTH MACHINES I HAVE IT ON.

E.G. -> I have had my XP SP2 @ work & Server 2003 SP2 doing this (patch in place from MacroVision) & so far, all appears to be fine!

(I say, for the MOST part, because unfortunately, I did have an "external USB 2.0 drive enclosure" with a WD 74gb 10k rpm disk stop working @ home on my Win2k3SP2 rig though, but I don't think it is related to THIS driver (or, @ least I do not think so)).

Not Exactly A Bug

[Anonymous Coward]

This issue is most likely related to the way they secure their code by assembling and creating run time executable code and then injecting it into a random portion of its own allocated kernel memory to further avoid debugging. I have seen these games fail because of this with memory protection bit turned on. I suspect their own use of randomness and polymorphic code opens the driver to malicious use and make it harder to detect between intended and malicious intent. I am curious if they can fix this without removing some of their own security.

What I have always found interesting is that it does not fail with software executable protection turned on but does with hardware. This implies Windows understands how this drivers functions and allows it. The issue may be worse that one thinks. Thanks again DRM.

Local Exploit Only, and Very Unlikely

[ThinkFr33ly]

This can only be exploited locally, so the chances it will affect any significant number of people are very small.

Since virtually everybody who uses Windows XP runs as admin, there would be no reason to use this exploit, since if you get code to run on the target machine, it's already running as admin.

For Windows Server, a bad guy with local access is going to be rare, and most admins don't usually download and run random code on their servers. The one exception might be a server used as a terminal services provider, but I can't imagine that's particularly common. Plus, standard domain policy best practices would prevent unsigned/unapproved code from being run by any non-admin anyway, so it's really not an issue.

Lastly, Vista isn't affected, both because it includes the newer version of the DLL, and because the privilege elevation itself would not be possible thanks to some new security measures in Vista's kernel.

So while it makes a great "DRM Sucks!" story, the security ramifications of this bug are essentially zero.

Re:Local Exploit Only, and Very Unlikely

[Anonymous Coward]

Ring zero is kernel space, the highest privilege level - higher than Administrator. Normally an attacker would have to install a driver or suchlike to achieve this, a suspicious behaviour that can be flagged by AV etc, this avoids that and lets them proceed directly to rootkitting. Also as soon as a "minor" remote access exploit comes along this magically becomes an extremely serious remote root. OK so it could be worse, but local privilege escalation exploits are always bad and should be fixed quickly; history is littered with the corpses of sysadmins who thought otherwise.

Re:Local Exploit Only, and Very Unlikely

[Shadow-isoHunt]

Since virtually everybody who uses Windows XP runs as admin, there would be no reason to use this exploit, since if you get code to run on the target machine, it's already running as admin. Which is different than running as SYSTEM.

Re:Local Exploit Only, and Very Unlikely

[organgtool]

Since virtually everybody who uses Windows XP runs as admin, there would be no reason to use this exploit, since if you get code to run on the target machine, it's already running as admin.

Running as admin in a corporate environment is very rare, with the exception of some small companies. Any company that lets their non-sysadmin employees run as the Admin user deserve what they get. So when a company gets attacked through a hole in their workstations' OS that supports DRM in games (something that most companies don't even use), then I would say that it is a very big deal - especially when MS knew about that bug and fixed it in their new OS but not their older OS'es.

Re:Local Exploit Only, and Very Unlikely

[ThinkFr33ly]

Which is different than running as SYSTEM. Effectively, it is not. The only real difference is that the SYSTEM account has access to terminate/modify certain processes directly, where as Administrator must essentially request that they be done by SYSTEM.

For instance, there are some processes that run as SYSTEM that you can't kill in Task Manager, but that can be killed via certain administrative commands that are then run as SYSTEM.

In fact, SYSTEM typically has FEWER privileges than Administrator because some network operations can't be done by SYSTEM, but can be done by Administrator.

Re:Local Exploit Only, and Very Unlikely

[SillyNickName]

virtually everybody who uses Windows XP runs as admin

Ha, that's funny. Not in corporate environments they don't.

most admins don't usually download and run random code on their servers

The code doesn't haven't to be random, just bad. Maybe even signed by Microsoft itself as this case shows. (Apparently one of the ways to get trojans and other bad code onto a windows box is to pay Microsoft to "sign" it for you.)

Lastly, Vista isn't affected,

No, this is an old vulnerability. Vista has new and improved vulnerabilities.

Re:Why are they shipping this in business computer

[Anonymous Coward]

But they don't use macrovision. I don't know a single pro app that require you to insert the software CD each time you launch it, like games do.

I work in the audio industry and all the protections I can recall are dongles (USB dongles nowadays) and online/phone activation. Pro apps using dongle will install their OWN driver, it's not bundled with Winblows.

What about VirtualBox?

[Spy der Mann]

Many people (myself included) would love nothing more than to move away from M$ products but, sadly, are trapped in them because of the applications we use.

There is a solution. Linux + (Windows inside VirtualBox).

Haven't tested it yet because I've come to hate windows so much that I don't want ANY of it installed in my system. But I've read a couple of VirtualBox reviews, and they're all positive.

Re:Why are they shipping this in business computer

[sqlrob]

Drivers can still be installed for that software.

Quickbooks is the non-game copy protected software I was thinking of as my example.

Macrovision is legally vulnerable

[Animats]

If anyone incurs costs as a result of this, they can sue Macrovision. Macrovision isn't protected by Microsoft's EULA. (Nor can it be; there's a legal concept called "privity" that applies to third party issues like this.) The end user has no contractual relationship with Macrovision. So there's nothing protecting them from a negligence lawsuit.

Macrovision is as vulnerable as Sony was.

Re:Macrovision is legally vulnerable

[SillyNickName]

Macrovision is as vulnerable as Sony was.

Meaning "not very"?

Re:Why are they shipping this in business computer

[operagost]

Someone is lying outright.

Secdrv.sys is included with Windows Vista, but Microsoft's newest operating system is safe from attack, said Quach. "Microsoft and Macrovision worked together during the development of Windows Vista RTM [release to manufacturing] to review the security of the Vista version of the driver," she said. " Thanks to this security review, this vulnerability is not present in Windows Vista." Microsoft went a step further and credited its Security Development Lifecycle (SDL) approach for beefing up the driver.

If they discovered security issues during the Vista development, why didn't they issue a driver update for XP and 2003? Why the wait?

On SERVER 2003?

[BobMcD]

Why on earth is this bundled with a Server OS?

This is the kind of patently stupid thing that we really ought to result in damages being awarded...

Seriously, the entire corporate world has been vulnerable for the LAST SIX YEARS because they wanted to make it minutely harder to pirate a video game?

Could not the Macrovision games simply been coded to add this cruft to a server upon inserting the game CD? s/Could/Should/g

There absolutely HAS TO BE a violation of duty here.

Re:On SERVER 2003?

[dbIII]

Why on earth is this bundled with a Server OS?

The cynical answer is that it isn't really a server OS. That said it's about the best thing to use to run applications designed for the Microsoft platform and it's always the applications that really matter.

A six year vunerability with Macrovision software is not that suprising. They sell a bit of abandonware. For example their linux version of flexlm uses an implementation of linuxthreads that was abandoned over six years ago and will not work with any recent distro of linux.

One simple question

[funkatron]

Why is this a driver? From what I gather all it does is read some data from a disk and use it to decide if some software can run or not. This looks like something that could easily be done in user space. Maybe I've missed some fundamental aspect of its workings though.

Add this to login script to roll out the update

[mattb47]

I just added a bit of code to my company's Windows domain login scripts to roll out the fix.

You'll need to download Macrovision's fix from the their site here:

http://www.macrovision.com/promolanding/7352.htm

Then extract the ZIP and put it somewhere on a network server where it's publicly accessible.

You could then do the update via login script or GPO or whatever suits your fancy. Probably need admin privs to do this.

You probably also want some code to determine if the system is XP or Server 2003. If it's not, you don't need the update. I use the OS detection routines from here:

http://www.amset.info/loginscripts/os-id.asp

Enough setup, here's my quick and dirty code:

rem
rem Update stupid Macrovision SecureDisc driver, if needed
rem

if exist "%windir%\system32\drivers\safedisc-fix-11-09-07.txt" goto safedisc_driver_updated

echo.
echo Fixing Macrovision SecureDisc vulnerability...
echo.

rem
rem replace location here with the proper location for your Macrovision update files
rem

pushd "\\someserver\someshare\macrovision-secdrv-update\"
rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 .\SecDrv.inf
echo Macrovision safedisc driver updated on %date% > "%windir%\system32\drivers\safedisc-fix-11-09-07.txt"

popd

:safedisc_driver_updated

Re:Why are they shipping this in business computer

[Bert64]

Your forced to have a full install of directx too, including the joystick/gamepad support, directplay (for network gaming) and all the sound/video stuff...
Why would you need all this on a corporate desktop, let alone a supposed "server".
None of my unix servers have anything that's not relevant to whatever the server is hosting, the only server i have which has *ANY* gaming or graphics related software on it is a quake server!

Re:Why are they shipping this in business computer

[Bert64]

Windows "server" is a joke anyway, your forced to have a gui, browser, mail client, media player, gaming support libs (directx) etc, which is a complete hassle to remove and often needs to be patched.
A server should always have the bare minimum software installed, less to go wrong, less to have security problems, less overhead, and you don't have the hassle of patching anything that's not installed.

Re:Why are they shipping this in business computer

[Bert64]

That's why the large number of Linux distributions, often cited as a problem, is so good. You can customise to your hearts content, and remove what you don't need, or better yet never install it.
And any half decent package manager will pull in extra dependencies if they start being required.
All my linux machines are built to spec, only what's required is installed and nothing else.

Re:Why are they shipping this in business computer

[truthsearch]

I recommended switching to Linux (or actually performing some research into switching) to a few managers there. Once I got past the usual lip service the end result was "well, we're a Microsoft shop." The conversation always ended there.

And that's one of the reasons I no longer work there.

Alternate solution. :)

[argent]

if not exist "%windir%\system32\drivers\secdrv.sys" goto ok
del "%windir%\system32\drivers\secdrv.sys"
echo "Removed Safedisc driver"
:ok

Re:Why are they shipping this in business computer

[PitaBred]

Still doesn't use the Macrovision copy protection. Macrovision copy protection is for games only, as it validates a CD-ROM. There's NO serious business software that requires the CD to be inserted to run.

Re:Why are they shipping this in business computer

[roguetrick]

Bad example, I don't see a reason you would install quickbooks on a server.

Re:Why are they shipping this in business computer

[totally bogus dude]

I don't think it comes with DirectX. Maybe I'm wrong. Once upon a time when the ArmA demo was first released, we happened to have a new Bladecenter sitting idle so I set up an ArmA server on that, and I needed to install DX for it to run. So if it does come with DirectX, then it's an old version.

But I do agree that Windows "server" comes with a lot of useless shit. A lot of my earlier VMs are seriously disc constrained, because it didn't occur to me that an out-of-the-box installation of Windows 2003 would need almost 5 gigs of disc space. And that's before it actually DOES anything. Most of the space seems to go to redundant copies of every DLL on the system just in case it needs to fix anything which has magically become "corrupted". What a joke.

Re:Why are they shipping this in business computer

[Bert64]

It certainly does come with directx, i believe 2003 even comes with a newer version than XP did... You can try by starting the dxdiag tool on a default 2003 install.

And your right, 5gig for a base install is pathetic. Even worse on your VMs, because that's 5gig multiplied by the number of VMs you have.

As for redundant copies of DLLs, this was microsoft's hyped "self repair" feature from windows 2000... As sun pointed out at the time, it's better for your system to prevent itself from being corrupted than to try and clean up the mess after the fact. I don't think any unix systems keep backup copies of everything, but then unix users typically don't run masses of software as root unnecessarily.
Besides, keeping a backup copy and copying it back has many flaws, if your installing something malicious you just need to corrupt the backup aswell, and it now becomes harder to remove your malware because windows will keep copying it back. It also becomes harder to remove unwanted windows components for the same reason, if you delete ie or outlook express it just gets copied back. And ofcourse if the program that does the copying gets corrupted, or part of the boot process leading up to that, your screwed anyway.

Trusted Computing will save DRM

[PhoenixOne]

This is exactly the problem Trusted Computing wants to fix. By making non-DRM media a bigger hassle, you'll be happy to spend $30 on the DVD, another $15 to put it on your iPhone, $0.25 each time you use one of the soundtrack songs as your ringtone, etc.

Office component install? Try uninstall

[phorm]

We have been pained enough by MS-Office suddenly demanding you to pop in the origial CD/DVD-ROM to get a particular module

You want to see something really funny? Try installing a copy of Office 97. Now try to uninstall without the disc in the drive. It will require the disc. No I'm not kidding, it needs the original disc to remove the software from your PC.

How pointless and frustrating is that?