Look out, an explosion coming in the world of computer security...

[Guest]

http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html

For those not geeky enough to understand what we're looking at:

Sony is installing a copy protection mechanism on music CDs that is sheer evil incarnate.  It installs itself, hides DEEP in your computer, creates massive security vulnerabilities for any external party who knows about this garbage and if you try and UNinstall it, it sabotages your computer on the way out.

It did this without any warning to the customer.

The big music publishers already have an evil reputation...but this is a whole 'nuther level, the use of malicious techniques right out of the "black hat hacker" playbook to punish people who are trying to do the right thing by buying CDs!

The bands victimized by this scandal will probably sue, it's that bad.

Worse, Sony bought this "malware" piece of "flaming garbage" as it's discoverer put it (see link above) from a British company who almost certainly have other customers past Sony.

My take: this is literally bad enough to tank CD sales.  It could drive bands straight into the arms of Steve Jobs and the itunes system directly, cutting out the major labels as "evil untrustworthy parasites".

It will also make people much more aware of computer security in general and put a major kink in the rush to "Digital Rights Management" (DRM) by showing just how flat-out wicked that can get.  And it's brought to you by the same morons who have been suing schoolkids for using Grockster or whatever...so now if you DON'T use online downloads and try to "be good" by buying the CDs, you're to have your system *raped* by chimpanzees masquerading as programmers?!

I just cannot *believe* the stupidity of all involved, in assuming this wouldn't come to light.  In the same way that the rottenness of the Diebold system shined a spotlight on electronic voting, this is going to expose the hazards of DRM.

This story just hit today in "geek circles".  I guarantee it'll make the national news within a week, probably less.  I also guarantee Sony will do a full recall and refund to existing customers, the British programmers who spawned this abortion are simply *dead* as a company, this is gonna be huge.

[roo_ster]

Thank the mighty Penguin of Doom that my home PC runs Fedora Linux Core 4.

My wife's laptop, OTOH, is vulnerable to this sort of malware as it runs WinXP.

Let Sony, MS, & First 4 Internet all sink into the raw sewage of their malware.

[mtnbkr]

Yup, it's pretty nasty.  It won't have much of an effect on CD sales I imagine since it only affects those who play their CDs on PCs and care enough to maintain those PCs.  Folks like my parents who never play CDs on a computer or my in-laws who replace their computer every couple years when the malware makes it unusable won't notice.  

I didn't see it mentioned, but I wonder how this affects a computer's ability to rip tracks to MP3?  That's the only time my CDs are near my computer.  I'm assuming the CDs either can't be ripped or the software doesn't get installed since you're not actually playing the CD musically.  I dunno...

I read the article kinda quick, so I missed the security issue other than a user inadvertently installing the software to their PC.  That can happen with any hidden software though, not just this crap.  That's more of a user issue to me, but one that's hard to avoid unless you're clued in.

Chris

[roo_ster]

mtnbkr:

According to the article, the malware

cloaking code hides any file, directory, Registry key or process whose name begins with $sys$. To verify that I made a copy of Notepad.exe named $sys$notepad.exe and it disappeared from view.

So, a malware-generator (other than Sony/First 4 Internet) could use that as an exploit to install their own malware.

"Buy a Sony CD and you get extra special vulnerabilities in your OS...at no extra charge!"

Sony ought to be roasted alive for this one.

[mtnbkr]

Gotcha.  I missed that bit.  Like I said, I read through it pretty quickly.  That is definately nasty, mainly because it's overbroad.  

Sony ought to be roasted alive for this one.

Yeah, good luck with that one.  Like I said earlier, the majority of people will never notice.  Either because they don't play music on their PC (like me) or because they have the security awareness of gnats.  

Chris

[Justin]

Well, that snaps it.  Looks like I'll be making the switch over to Linux for my home machine.

I mean it this time.

[mtnbkr]

Just curious, would software that monitors registry changes have caught this?  I run an adware/malware package that does that (can't recall the name offhand).  I know when I install/remove software, it annoys the crap out of me by confirming each registry change/add/delete.  

Chris

[Felonious Monk/Fignozzle]

Jim,
Thank you for posting this.  I've sent it to my political PitBull buddies.
It's gonna get a little warm for Sony soon...

[Headless Thompson Gunner]

No good will come of this.  If this type of copy protection becomes common, so will the techniques for circumventing it.  In the end, the difference will be that your PC will be more vulnerable to attack.

Sony will lose a lot of goodwill, and pirating will continue unabated.

I have too many CDs for it to be convenient to play/store/handle/find that many individual discs.  So I loaded them all onto a PC tied into my stereo.  It's really the only viable way to maintain a large music collection.  

If the music industry ever does manage to "mp3-proof" commercial CDs (doubtful), then I'll stop buying them.  Simple as that...

[Brad Johnson]

Sent the link it to a friend of mine who is a hardcore software developer and freelance "hacker-proofer" (i.e. he found out how much money he could make legitimately trying to break into other people's software and systems). He did a quick run-down of the article and some preliminary research (popped in a CD and checked). He says two things - A) it looks like a genuine problem and B) it is really scary that it slipped in under the radar.

Brad

[RadioFreeSeaLab]

Ah, thank you Linus Torvalds and the rest of the Linux community
Hopefully EFF jumps all over this one.

Well, that snaps it.  Looks like I'll be making the switch over to Linux for my home machine.

I mean it this time.

See http://www.ubuntulinux.com
Using it, love it.
Oh, and for those of you, like me, who don't have broadband and don't want to wait a week for Linux to download, Ubuntu will ship you a cd, or as many cds as you wish, for free.  100% free, no shipping costs, no nothing.  Get a few for the family.

[garrettwc]

I also guarantee Sony will do a full recall and refund to existing customers

I'm with mtnbkr, don't hold your breath on this one.

Time to download those linux isos.

[Standing Wolf]

After my last two Sony monitors, there's no more Sony anything in my house. Those slimy @#$%^&!s have ripped me off for the last time.

[Telperion]

Jim, didn't Arnold sign into law some anti-spyware bill last year?  It might be worth referring the matter to see if Sony is breaking the law in California.

[jefnvk]

Switching to Linux is a temporary solution to a permenant problem.  What happens when 10 years down the road, MS is no longer the big player, everybody and their kids and grandmas use Linux, and all those people who neither know nor care about security migrate over?

[mtnbkr]

Jefnvk, that's been my question all along.  The problem has never been with the platform, but with the people using it.  I can make a Windows box secure enough to avoid most, if not all, of the major security concerns, but it wouldn't make the average user happy.  Same thing for Linux...  The average user wants the bells and whistles that make a system insecure.  They'll accept this Sony malware if Sony tells them it'll enhance their media enjoyment.  Eventually it'll be ported to DVDs as well.  

To be honest, I miss the analog days.  Users had more control over tapes (audio and VHS).

Chris

[garrettwc]

True enough. We have to change the mindset of the end user first.

The typical Linux user at this point in time, is a more knowledgeable user. They will take the time to do the right things to protect their system. And being compilable source, Linux will let you do it.

The trouble with Windows is that even if you take the time to learn how to protect yourself, Windows may not allow you to do so because it interferes with the DRM strategy which Microsoft supports. We discussed this a little bit in the Windows Vista thread. A lot of Microsofts .Net framework just opens up more holes.

[Guest]

I think its amusing that someone can completely avoid this whole issue by limiting their music collections exclusively to illegally downloaded MP3s.

Having worked in retail during my highschool days i can flat out tell you that the average consumer is NOT intelligent enough to comprehend how this would work anyways. They will buy their CDs, play them, allow this crap to be installed, and never be the wiser. If the big box with the internet in it stops working they will just buy (CONSUME!) another one.

[Telperion]

As an interesting twist, I've read that online game cheaters (particularly World of Warcraft) have read about this and are purposely installing this rootkit in order to hide certain cheat files and programs from the game's cheat detection systems.

[Preacherman]

The BBC is already onto the story (http://news.bbc.co.uk/1/hi/technology/4400148.stm):

Last Updated: Thursday, 3 November 2005, 09:05 GMT

Sony attacked over anti-piracy CD

By Mark Ward
Technology Correspondent, BBC News website

Sony's music arm has been accused of using the tactics of virus writers to stop its CDs being illegally copied.

One copy protection system analysed by coder Mark Russinovich uses cloaked files to hide deep inside Windows.

The difficult uninstallation process left Mr Russinovich saying that Sony's anti-piracy efforts had gone "too far".

In response to criticism, Sony BMG said it would provide tools to users and security firms that would reveal the hidden files.

Search history

Mr Russinovich, a renowned Windows programming expert, came across the Sony BMG anti-piracy system when performing a scan of his computer with a utility he co-created that spots so-called rootkits.

Rootkits are starting to be used by a small number of computer virus writers because they allow malicious code to be inserted deep inside the Windows operating system, meaning that it will not be spotted by most anti-virus scanners.

Rootkits are used to hide malicious software once it is installed and ensure it is not found and removed by anti-virus programs

After extensive analysis Mr Russinovich realised that the "cloaked" software had been installed when he first listened to the CD album Get Right With the Man CD by country rockers Van Zant.

Although resembling a virus, Mr Russinovich found the hidden files had come from an anti-copying system called Extended Copy Protection (XCP) developed by UK software company First 4 Internet.

About 20 titles are thought to be using the XCP software and in May 2005 Sony said more than two million discs had been shipped using the technology. XCP is just one of several anti-piracy systems Sony is trying.

XCP only allows three copies of an album to be made and only allows the CD to be listened to on a computer via a proprietary media player. The hidden files are installed alongside the media player.

Ridding his computer of XCP proved difficult and briefly crippled Mr Russinovich's CD player.

Writing in his blog about the incident, he said: "Not only had Sony put software on my system that uses techniques commonly used by malware to mask its presence, the software is poorly written and provides no means for uninstall."

Mr Russinovich said the licence agreement that he accepted when he first listened to the CD made no mention of the fact that he could not uninstall the program or of the significant changes it made to his computer.

If Sony BMG released XCP copy-protected CDs in the UK this oversight could leave the music company open to prosecution under the Computer Misuse Act because it made "unauthorised" changes to a machine, said net law expert Nick Lockett.

"There would be no problem if there's a big screen coming up saying as part of the anti-piracy measures this CD will amend your operating system," he said.

Mr Lockett added that Sony might be inadvertently provoking piracy as consumers irritated by the anti-copying system rip the tracks to get around the restrictions.

Virus link

Mr Russinovich feared that diligent users trying to keep their systems clean of viruses could stumble across the hidden XCP files, delete them and inadvertently cripple their computer.

His worries were echoed by Mikko Hypponen, chief research officer at Finnish security firm F-Secure, who has been looking into XCP since it first came across it in late September.

"What we are scared of is when we find a new virus written by someone that relies on the fact that this [XCP] software is running on tens of thousands of computers around the world," he said. "The rootkit would hide that virus from pretty much any anti-virus program out there."

Mathew Gilliat-Smith, chief executive of First 4 Internet, said the techniques used to hide XCP were used by many other programs and added that there was no evidence that viruses were being written that took advantage of XCP.

He said the debate on the net sparked by Mr Russinovich's work had prompted the company to release information to anti-virus companies to help them correctly spot the hidden XCP files. Consumers can also contact Sony BMG for the patch to unveil, rather than remove, the hidden files.

He said that users were adequately warned about the copy protection software in the licence agreement and were told that it used proprietary software to play the CD.

"It's clearly packaged on the CD that its copy-protected," he said.

A spokesman for Sony BMG said the licence agreement was explicit about what was being installed and how to go about removing it. It referred technical questions to First 4 Internet.

Mr Gilliat-Smith said Mr Russinovich had problems removing XCP because he tried to do it manually something that was not a "recommended action". Instead, said Mr Gilliat-Smith, he should have contacted Sony BMG which gives consumers advice about how to remove the software.

Getting the software removed involves filling in a form on the Sony website, visiting a unique URL and agreeing to have another program downloaded on to a user's PC that then does the uninstallation.

He added that First 4 Internet had had no complaints about XCP since it started being used eight months ago. He also added that the latest generation of XCP no longer used cloaked files to do its job.

"We've moved away from using that sort of methodology," he said.

[matis]

Thought you might find this article interesting.  I'm calling my daughter after her school day today and telling her NOT to buy or use ANY Sony CDs on her computer.

It's a bit scary.


matis



Sony DRM is worse than you might think

Comment Active exploits and no help from Sony

By Charlie Demerjian: Thursday 03 November 2005, 09:40
SONY SCREWED UP WITH its rights removal to protect its profit margins philosophy and there is no way the use of rootkits can be justified.

Caught with its pants down, what did it do? Make things right? Heck no, it blamed the user, and doesn't do anything more than window dressing to deflect what are valid criticisms.

If you read the Sony PR spin masquerading as a FAQ here, the tepid responses it give are laughable. Number one states that the technology is used to prevent copying, but that is true for only Windows boxes, so why the discrimination? It only affects legitimate users. If you want to copy the music, all you need to do is hold down the shift key when inserting it and you are free to copy. That or have a non-Windows computer.

To make matters worse, a cursory check of the file trading networks shows that the Van Zant album is available for download on a whim. The pirates who don't want to pay will have no trouble getting it, but those who abide by the law will get punished. Also, if you look at FAQ Number 4 under equipment compatibility, it cuts iPod users out of the mix. Hmm, Sony only sells Windows based computers, and sells a competitor to the iPod. Sense a conflict of interest there that you are paying for?

So to Number 2. "How do I know if a Sony/BMG disc is" DRM infected? It says it is clearly marked on the label, and yup, it's right, it is. I went over to Best Buy tonight and found it on the label plain and clear. There was also absolutely no listing of rootkits being forcibly installed on your PC, and not being uninstallable, however.

There was no warning that you had to play it through their player, or that it would spit out the disc if you had programs open that it did not like. If you don't like these terms and rights removals, and you try to return it, those few places that will take back open recordings tend to charge a restock fee. In the case of Best Buy tonight, it is 15%, I asked. I don't think Sony will refund you that money.

Number four tells you to consult the EULA when you want to copy the disc. Which madhouse did we step into that now means a CD needs a EULA? I stopped buying CDs so I wouldn't have to give money to rapacious weasels years ago, and none of the CDs I own have a EULA on them. It is madness. So, at Best Buy tonight, I tried to consult the EULA before I bought the Van Zant CD.

It wasn't on the CD package, not on the shelves near by, and the blue shirted aisle trolls had no idea what I was talking about. No, they could not provide me with one, I did ask though. So, if you are dumb enough to buy a Sony CD, and don't want to rootkit your machine, you can't find out beforehand, have to agree to a one sided contract that you can't read before you say yes, and can't get your money back. Wonderful, thank you Sony.

The last part of the FAQ is Number 6, which claims that its CDs are not spyware/malware infected. The prefix 'mal-' according to Merriam-Webster means 1) bad 2) abnormal 3) inadequate. -ware is short for software. This means malware is defined as bad software.

If you look at the Sony rootkit, it does several things. It strips you of your rights, it potentially causes your computer harm, it breaks your computer if you remove it, and eats your CPU time. All of these things are bad, no question there. It also does the end user no good in any way, shape or form, not even by the most demented stretch of the imagination. It only hurts those who spent money to buy it.

It does Sony no good either because the files are rippable on a whim by anything more intelligent than a half-drunk monkey. So, you have software that does you flat out harm, and no good for the producer. What isn't malware about this, and how can Sony claim this? This is the service pack from hell.

If you want to look at this another way, take a different example. Imagine that you walked up to a person that you know and said: "Hey friend, check out this new cool CD I made". He drops it in his computer, and without his permission, it installs a rootkit on his machine. Good joke, right?

Say you want to remove the Sony stuff. According to no less a source than The Washington Post, the bare minimum you have to do to remove the rootkitted DRM infection is give up your privacy. If you go to the Sony page, here, you have to give Sony your email at the very least, and according to the WP story, Sony then grills you about your reasons for not liking being rootkitted.

So, if you want to remove it, go here and click the link. Don't use Firefox though, it won't work, it's Internet Explorer only. If you are concerned enough about security, you probably know enough not to use IE. Once again, brilliant Sony, just brilliant.

The funniest part is that you don't actually remove the software with this tool, only make it visible, and you are still infected up and down with DRM. Should you be lucid enough to realise that you don't want this crap within a few miles of your system, you have to go through the grilling process above. Want to make it seem even more surreal? If you remove the malware and DRM infection, you can't play the CD anymore. Nope, the money you spent on Sony products is gone. Mal-way or the highway.

If you try to remove it yourself, you risk breaking your optical discs, or it kills them for you. Mark from Sysinternals is more than smart enough to figure out how to fix this, but are you? Off the top of your head, how do you do that again, no looking it up? To make matters worse, it installs itself so it runs in safe mode, and if it conflicts with something, you are really hosed. Sony's response? "This component is not malicious and does not compromise security.". There are already exploits out there that take advantage of this.

Sony compromised your system and will not directly allow you to remove it without compromising your privacy. It also will not replace your defective CDs with non-infected ones. If you hose your computer or network with this infection, and want to play your music, do not pass go, do not collect $200. Really, it won't help customers who simply don't want this, read #3 in the FAQ.

Sony is generously working with anti-virus companies on this. Now, this means to deal with the problem, you have to know it's there, and that's kind of hard because the malware rootkit that Sony infects you with is designed to prevent this.

Now, let's just pretend we don't realise that the the antivirus companies themselves are not complicit. If you want to mass-rootkit people, just ask Symantec beforehand. Look at what Cnet had to say about it. "The creator of the copy-protection software, a British company called First 4 Internet, said the cloaking mechanism was not a risk, and that its team worked closely with big antivirus companies such as Symantec to ensure that was the case." But there are active exploits already, as we pointed out earlier.

All this makes you wonder a lot about Microsoft's upcoming security software, doesn't it?

So, rather than come clean, Sony minimises the problem, blames the user, and refuses to help you out. If you have CDs infected with this rootkit and DRM, Sony has to replace them. They are, flat out, a danger to computing. Don't believe me? Look at that Washington Post article again. The head of F-Secure says that the Sony malware, when running on Windows Vista "breaks the operating system spectacularly". Nope, that can't be right, just ask Sony, because it said so in the FAQ. It won't fix the problem, they won't let you work around it legally and still listen to the music you paid for, and won't help you.

As of four hours ago, these things were still on the shelf at Best Buy.

To end on an up note, just think about these two things. What you are seeing is the light and happy side of rights removing DRM infections. There is a bill going through congress to remove more of your rights. Yes, they can't control the analogue hole, and can't legally force you to bow to them, so they are buying government to change the laws and accomplish both goals. No good will come to the end user because of this, but it sure will make a lot of people rich.

More happy news? These merchants are designing the next generation drives called Blu-Ray with much more DRM built into the hardware. It is bad enough to make me back the views of Bill Gates on the subject with absolute open arms. These are scary times people, and if we let Sony get away with this now, it will only get worse and harder to stop later. µ

See Also
Intel to cut Linux out of the content market


 
M A R K E T P L A C E
Online Storage - IBackup
IBackup offers secure online storage, online backup and remote access services for consumers and businesses, for Windows, Mac and Linux including hand...
Refurbished and Used Networking Equipment
Network Liquidators sells refurbished and used networking equipment for up to 95% off list, with a 1 year warranty. We buy and sell top brands like Ci...
IT Certification and .NET Developer Training
Industry leading MCSE, CCNA, CCNP, MCSD, A+ courses and more. Live instructor led training on CD. Hands-on labs, study guides, exam simulators, Around...
Unix and Linux Performance Tuning Simplified
Automated recommendations, graphs, and explanations for Solaris, Linux, AIX, and HP-UX.

Home     Discuss on our Forum     Flame Author
Recommend this article      Print

[mfree]

"He added that First 4 Internet had had no complaints about XCP since it started being used eight months ago. He also added that the latest generation of XCP no longer used cloaked files to do its job."

It's hard to complain about something you don't know about.

"'We've moved away from using that sort of methodology,' he said."

Good. A rapist can move away from that sort of methodology that makes him attack women, but that doesn't reduce the veracity of his previous crimes at all.

Sony needs to be taken to task about this.

[K Frame]

I'm not the most computer saavy guy in the world, so I had mtnbkr explain all this to me in terms that I readily understood.

All I can say is WOW!

Bill Gates is nasty, but I think we have a new leader in corporate evil.

[Zundfolge]

Switching to Linux is a temporary solution to a permenant problem.  What happens when 10 years down the road, MS is no longer the big player, everybody and their kids and grandmas use Linux, and all those people who neither know nor care about security migrate over?

You must understand how Linux works.

You can NOT install ANY software without the user being aware of it, because in order to install a piece of software the user must manualy enter their password.

So on a Linux machine when the Sony CD tries to install this malware, a little dialog box pops up asking for your user password at which point you can click "cancel", hit the eject button on the CD drive and fling that rotten piece of crap into the trashcan.


Now if a less savvy user goes ahead and installs it then all you have to do is delete that user's home folder and the offensive softare is gone (unless you gave a non savvy user root permission ... which most new linux distros don't do).





Anyone know if this crap will effect a Mac (which is Unix and operates similarly to Linux)?


At any rate, I think I'll keep getting my music the safe way, off p2p networks

[garrettwc]

Eventually it'll be ported to DVDs as well.

It won't take long apparently. From the link at the bottom of Matis post:

Intel to cut Linux out of the content market

On a side note, for all you legal eagles, when the bleep did fair use rights go away!? I thought this issue had been settled years ago over cassette tapes.