Sony Music Sued For Rootkit Ruse

[Mulboyne]

Pitchforkmedia: Sony Music Sued Over Anti-Piracy Software

...According to the Washington Post, a class action lawsuit filed in Los Angeles Superior Court November 1 alleges that the label's anti-piracy software, installed in several recently released CDs, is harmful to computers. The suit claims that when a copy-protected CD is loaded onto a hard drive, it installs a hidden program known as a "rootkit," which not only keeps track of the computer's activity, but depletes the drive's resources in the process...The rootkit also makes the computer more susceptible to viruses. Sony falsely states that its copy-protection software can be easily removed, when in reality, getting rid of a rootkit can be damaging...more...

3Yen: Former Apple Exec: No More DRM For Me, Ever

[Socratesabroad]

The Sony rootkit story is amusing. Sad, but still amusing.

What it does:
http://www.f-secure.com/v-descs/xcp_drm.shtml

Once installed, the DRM software will hide:
Files
Processes
Registry keys and values
No means of uninstalling the DRM software is given.

It should be noted that if the DRM software is active, the registry keys that start with the string '$sys$' will not be shown by most of the available registry editing tools. Also all files and directories that start with the string '$sys$' will not be visible.

Although the software isn't itself malicious, the hiding techniques used are exactly the same that malicious software known as rootkits use to hide themselves. The DRM software will cause many similar false alarms with all AV software that detect rootkits.

The hiding techniques used by the DRM software can be abused by less technical malware authors to hide their backdoors and other tools. If a malware names its files beginning with the prefix '$sys$', the files will also be hidden by the DRM software. Thus it is very inappropriate for commercial software to use these techniques.

So inappropriate that dishonest Warcraft players are using the same software to fool cheat detection software:
http://www.theregister.co.uk/2005/11/04/secfocus_wow_bot/

Argh! You've got this thing on your system and want it off. Caution!

Uninstallation of the DRM software can currently only be done by sending an uninstallation request to Sony through their customer support. The form can be found here:
http://cp.sonybmg.com/xcp/english/form14.html

[There are other alternatives, although caution is still clearly in order]

But here's the kicker for us FGs - check out Sony's EULA:
[T]he world according to the Sony-BMG EULA, which applies to any digital copies you make of the music on the CD:

3. If you move out of the country, you have to delete all your music. The EULA specifically forbids "export" outside the country where you reside.

5. Sony-BMG can install and use backdoors in the copy protection software or media player to "enforce their rights" against you, at any time, without notice. And Sony-BMG disclaims any liability if this "self help" crashes your computer, exposes you to security risks, or any other harm.

6. The EULA says Sony-BMG will never be liable to you for more than $5.00. That's right, no matter what happens, you can't even get back what you paid for the CD.

8. You have no right to transfer the music on your computer, even along with the original CD.

[gkanai]

Just wait! More fun DRM from Sony!!!

http://www.freedom-to-tinker.com/?p=925

Enjoy that "music"

[IkemenTommy]

It's a Sony

[emperor]

[dingosatemybaby]

This is generating some intense buzz among the slashdot folks. Sony's negative-karma meter is off the scale - it's currently in Bad-buzz Hell along with the RIAA and Karl Rove. Time to start shorting the stock?

[cstaylor]

Sony sucks... crap products, bad support, and now this spyware stuff.

[Mulboyne]

BusinessWeek: Sony's Escalating "Spyware" Fiasco

[gkanai]

Another fiasco for Sony is being documented on my own weblog

Sony Connect Player 1.0 review

[FG Lurker]

Another fiasco for Sony is being documented on my own weblog

Sony Connect Player 1.0 review

So....... Some guy freely chooses to put all his music into a proprietary format that only one maker supports. The maker has successfully locked him in and now he has no choice but to bend over and take it up the ass. That sucks, but I really don't feel sorry for him considering his own actions lead him to where he is now.

More than anything this is a good example of why open file formats are so important!!

[mr. sparkle]

This just in , on the heels of Sony's 'Rootkit" Digital Rights Management debacle with Windows:

I've just been informed (via the DAW-Mac list) that Toast 7 permanently plants something in the OS that triggers a spyware system in iTunes that prevents audio producers from making more than one CD copy of their own material. It also blocks ftp uploads to dot-mac accounts. Evidently it reports *all* CD copying to some unknown central location and misidentifies private CDs as commercial ones. This system can also evidently lock up the computer completely, preventing proper restarts and so forth. One DAW-Mac member had to completely rebuild his OS on a separate drive in order to get his machine working again.

BASTARDS....

[Buraku]

Not only is Sony no longer selling the RootKit CDs, Arend writes "According to a USAToday article, Sony is to pull their controversial rootkit CDs from store shelves." A nice gesture, but a little late. bos writes "Sony's DRM rootkit has been found by Dan Kaminsky to have infected at least half a million networks, according to an article by Quinn Norton for Wired News. Dan has even put together some pretty pictures of the breadth of the infection." With so many people infected, it's unfortunate that wiredog writes "From The Washington Post comes the news that serious security flaws have been found in the software that Sony is distributing to users who want to remove the Sony rootkit. The article says: 'Because of the way the tool is configured ... it allows any Web page that the user subsequently visits to download, install and run any code that it likes.'" Oops. Even Microsoft is getting into the act. ares284 writes "Microsoft said it would remove controversial copy-protection software that CDs from music publisher Sony BMG install on personal computers, deeming it a security risk to PCs running on Windows

When it rains, it pours. Researchers at Atlanta-based Internet Security Systems Inc. say they've uncovered yet another security flaw in Sony BMG's anti-piracy software that attackers could exploit to take total control over any vulnerable ma
http://blogs.washingtonpost.com/securityfix/2005/11/yet_another_fla.html
The discovery was made by ISS's X-Force Research and Development team, but the advisory just issued is a bit light on details, such as whether the company managed to develop an exploit for the flaw

[Mulboyne]

Bloomberg: Sony BMG Offers Free Music Downloads to Settle Suit
Sony BMG Music Entertainment, the world's second-largest record company, is offering free music downloads to help settle a lawsuit filed by computer users over its copyright-protection software. Sony BMG also agreed to stop making compact discs with the XCP and MediaMax software, which make computers more vulnerable to hackers and monitoring "spyware," according to documents filed with the U.S. District Court in New York on Dec. 28. The settlement, backed by plaintiffs, requires court approval...more...

[IkemenTommy]

McDonalds doing something similar

[Mulboyne]

Washington Post: Sony BMG Settles Anti-Piracy CDs Charges

U.S. regulators said Tuesday that Sony BMG Music Entertainment agreed to reimburse consumers up to $150 for damage to their computers from CDs with hidden anti-piracy software. According to the Federal Trade Commission, which announced the settlement with the big media company, its anti-piracy software limited the devices on which music could be played to those made by Sony Corp. or Microsoft Corp. It also restricted the number of copies that could be made and monitored consumers' listening habits to send them marketing messages. The FTC said the software also "exposed consumers to significant security risks and was unreasonably difficult to uninstall."

The settlement requires the company to allow consumers to exchange through the end of June the affected CDs purchased before Dec. 31, 2006, and reimburse them up to $150 to repair damage done when they tried to remove the software. It also requires Sony BMG to clearly disclose limitations on consumers' use of music CDs, bars it from using collected information for marketing and prohibits it from installing software without consumer consent. For two years, Sony BMG also must provide an uninstall tool and patches to repair the security vulnerabilities on consumers' computers and must advertise them on its Web site. The company also is required to publish notices describing the exchange and repair reimbursement programs on its Web site.

Sony BMG did not admit a law violation and the settlement is subject to public comment for 30 days, after which the FTC will decide whether to make it final.