RE: Sony Rootkit Removal

[Egaladeist]

There's been a couple of threads lately concerning Sony and Rootkits...here is the place to have them removed...

http://cp.sonybmg.com/xcp/english/form14.html
SONY BMG MUSIC ENTERTAINMENT - cp.sonybmg.com/xcp

this is a ' complete ' removal of the rootkit...not a partial you can find on other sites.


This only removes the cloaking...

November 2, 2005 - This Service Pack removes the cloaking technology component that has been recently discussed in a number of articles published regarding the XCP Technology used on SONY BMG content protected CDs. This component is not malicious and does not compromise security. However to alleviate any concerns that users may have about the program posing potential security vulnerabilities, this update has been released to enable users to remove this component from their computers.

http://cp.sonybmg.com/xcp/english/updates.html
SONY BMG MUSIC ENTERTAINMENT - cp.sonybmg.com/xcp

Both are Free.

[dalek]

It didn't take long for some one to come along and find a "hack" for this rootkit problem.

Sony's change of heart may have come to late. Hackers are already debating how the DRM's rootkit can be used for malicious ends.

On a site dedicated to hacking Blizzard Entertainment's popular "World of Warcraft" online game, posters have discussed using the rootkit to hide their code.

"For only $14.99 you get a well done RING0 rootkit that is able to hide vs Warden/Hackshield," wrote a poster identified as "Outlaw." All some has to do, he said, was "1) Buy the CD, 2) Run the CD, 3) rename 'myhack.exe' to '$sys$myhack.exe.'"

Blizzard installs a client -- dubbed spyware by some -- called "Warden" that sniffs out World of Warcraft cheaters by scanning active processes and comparing them to known cheat software. Not surprisingly, Warden doesn't "see" any files that are hidden with Sony's content protection rootkit; all a hacker need do is add the '$sys$' prefix to filenames.

Outlaw recommended the Sony rootkit to other hackers. "The design of the rootkit is not that good but I don't think there is a single public kit out there that is more usable for the job then this one.

"1) Blizz can not ban you for using it, 2) The kit is more or less stable, 3) The kit is 100% virus free, 4) Even a half brained ape could use it."

.



http://www.techweb.com/article/showA...3402718&pgno=1

The hole is getting deeper for Sony.

[rapier57]

Yes, Sony did release the remover, but it has been examined by Mark Russinovich at Sysinternals:

http://www.sysinternals.com/Blog/

and found wanting. May blue screen your system. Exercise caution. Russinovich provides a pretty clean manual alternative.

[dalek]

Anybody else interested,Sony Petition

[Aspman]

http://www.theinquirer.net/?article=27508

Sony Sued

[Cemetric]

It seems that EMI is now also named as having programs installed when running a CD on the PC...

But not using rootkits they claim .. yeah but they do use something and the uninstaller is on the CD ...mmm

LINK

C.

[the_JinX]

Originally posted here by Aspman
http://www.theinquirer.net/?article=27508

Sony Sued

Great.. Those italians are fast !!

[Aspman]

Got a CVE number now too

http://www.cve.mitre.org/cgi-bin/cve...=CVE-2005-3474

[cabby80]

Not only have ALCEI sued but they have now reported it to the Italian Police - Cyber crimes unit

http://www.smarthouse.com.au/Enterta.../News/Q7P7L4N2

[foxyloxley]

then there was the trojan that has been 'cloaked' using ...............

you guessed it, Sony's rootkit

http://www.vnunet.com/vnunet/news/21...ploit-sony-drm

Then this :

Computer Associates blacklists Sony DRM
Pressure mounts on Sony to abandon insecure technology

http://www.vnunet.com/vnunet/news/21...lists-sony-drm

and following the links on the left ................ it's ALWAYS those Lefties

Sony is the new evil
Sony latest experiment with digital right management technology comes straight out of a horror movie. While Sony has the most noble of intentions (to protect its copyrights), it has created a monster and in an effort to cover up its tracks is spinning a web of lies.

source

Is it the end of Sony .....................Nah
Is it the end of unannounced intrusive S/W ...........Nah, they'll do it better NEXT time