RE: Sony Rootkit Removal

Printable View

November 4th, 2005, 03:26 AM
Egaladeist

RE: Sony Rootkit Removal

There's been a couple of threads lately concerning Sony and Rootkits...here is the place to have them removed...

http://cp.sonybmg.com/xcp/english/form14.html
SONY BMG MUSIC ENTERTAINMENT - cp.sonybmg.com/xcp

this is a ' complete ' removal of the rootkit...not a partial you can find on other sites.

This only removes the cloaking...

Quote:

November 2, 2005 - This Service Pack removes the cloaking technology component that has been recently discussed in a number of articles published regarding the XCP Technology used on SONY BMG content protected CDs. This component is not malicious and does not compromise security. However to alleviate any concerns that users may have about the program posing potential security vulnerabilities, this update has been released to enable users to remove this component from their computers.

http://cp.sonybmg.com/xcp/english/updates.html
SONY BMG MUSIC ENTERTAINMENT - cp.sonybmg.com/xcp

Both are Free.
November 7th, 2005, 11:56 PM
dalek

It didn't take long for some one to come along and find a "hack" for this rootkit problem.

Quote:

Sony's change of heart may have come to late. Hackers are already debating how the DRM's rootkit can be used for malicious ends.

On a site dedicated to hacking Blizzard Entertainment's popular "World of Warcraft" online game, posters have discussed using the rootkit to hide their code.

"For only $14.99 you get a well done RING0 rootkit that is able to hide vs Warden/Hackshield," wrote a poster identified as "Outlaw." All some has to do, he said, was "1) Buy the CD, 2) Run the CD, 3) rename 'myhack.exe' to '$sys$myhack.exe.'"

Blizzard installs a client -- dubbed spyware by some -- called "Warden" that sniffs out World of Warcraft cheaters by scanning active processes and comparing them to known cheat software. Not surprisingly, Warden doesn't "see" any files that are hidden with Sony's content protection rootkit; all a hacker need do is add the '$sys$' prefix to filenames.

Outlaw recommended the Sony rootkit to other hackers. "The design of the rootkit is not that good but I don't think there is a single public kit out there that is more usable for the job then this one.

"1) Blizz can not ban you for using it, 2) The kit is more or less stable, 3) The kit is 100% virus free, 4) Even a half brained ape could use it."

.

http://www.techweb.com/article/showA...3402718&pgno=1

The hole is getting deeper for Sony. :cool:
November 8th, 2005, 12:02 AM
rapier57

Yes, Sony did release the remover, but it has been examined by Mark Russinovich at Sysinternals:

http://www.sysinternals.com/Blog/

and found wanting. May blue screen your system. Exercise caution. Russinovich provides a pretty clean manual alternative.
November 8th, 2005, 12:23 AM
dalek

Anybody else interested,Sony Petition :p
November 8th, 2005, 10:10 AM
Aspman

is this the first?

http://www.theinquirer.net/?article=27508

Sony Sued
November 8th, 2005, 10:24 AM
Cemetric

It seems that EMI is now also named as having programs installed when running a CD on the PC...

But not using rootkits they claim .. yeah but they do use something and the uninstaller is on the CD ...mmm :rolleyes:

LINK

C.
November 8th, 2005, 11:16 AM
the_JinX

Re: is this the first?

Quote:

Originally posted here by Aspman
http://www.theinquirer.net/?article=27508

Sony Sued

Great.. Those italians are fast !!
November 8th, 2005, 04:30 PM
Aspman

Got a CVE number now too

http://www.cve.mitre.org/cgi-bin/cve...=CVE-2005-3474
November 9th, 2005, 05:16 AM
cabby80

Police Called In To Investigate Sony

Not only have ALCEI sued but they have now reported it to the Italian Police - Cyber crimes unit

http://www.smarthouse.com.au/Enterta.../News/Q7P7L4N2
November 10th, 2005, 07:28 PM
foxyloxley

then there was the trojan that has been 'cloaked' using ...............

you guessed it, Sony's rootkit :eek:

http://www.vnunet.com/vnunet/news/21...ploit-sony-drm

Then this :

Quote:

Computer Associates blacklists Sony DRM
Pressure mounts on Sony to abandon insecure technology

http://www.vnunet.com/vnunet/news/21...lists-sony-drm

and following the links on the left ................ it's ALWAYS those Lefties :D

Quote:

Sony is the new evil
Sony latest experiment with digital right management technology comes straight out of a horror movie. While Sony has the most noble of intentions (to protect its copyrights), it has created a monster and in an effort to cover up its tracks is spinning a web of lies.

source

Is it the end of Sony .....................Nah
Is it the end of unannounced intrusive S/W ...........Nah, they'll do it better NEXT time :eek:
November 10th, 2005, 07:36 PM
nihil

Quote:

Is it the end of unannounced intrusive S/W ...........Nah, they'll do it better NEXT time

But now everyone will be watching them like hawks? Sony just made it fashionable to "blow the whistle"?

:)
November 10th, 2005, 08:13 PM
phernandez

If this gets any juicier, it'll require another AntiOnline Spotlight :)

The most apalling thing about this whole mess is Sony's stance, which boils down to: Meh, no big deal.
December 8th, 2005, 07:30 PM
foxyloxley

cure worse than the problem

don't know if it's posted elsewhere :

BUT :
the 'cure' is also flawed
sony CD bug #2

Quote:

Sony BMG has admitted to a new security problem affecting nearly six million of its CDs, after the detection of vulnerability with the MediaMax patch it supplied on 6 December.

According to watchdog group the Electronic Frontier Foundation (EFF) the most recent CD software "could allow malicious third parties … to gain control over a consumer's computer running the Windows operating system".

The EFF hired security firm Information Security Partners to analyse MediaMax. The company found a new vulnerability with the software that could allow unauthorised users to take full control of the computer's operations.

Hmmm :
me definately can smell compensation setting in :p

[edit]
Sony rootkit under fire in court

Quote:

Several class action lawsuits are being filed against Sony BMG over its controversial XCP anti-piracy software.

One case was filed in early November in California in which consumer Alexander Guevara asked the judge to ban Sony from selling any additional music CDs protected by anti-piracy software such as the XCP technology.

XCP aims to regulate the number of copies that a consumer can make of a CD on his computer as well as limit the file formats in which the CD can be ripped.

and NOW they are concerned that if others do this that it MAY cause 'problems :eek:
vnunet.com analysis: Sony CD rootkit could spell doom

Quote:

"I think that record companies should stop playing with rootkits and other 'black hat' techniques [before they] cause major grief to the customers," Niemela warned on F-Secure's blog.
December 8th, 2005, 07:53 PM
foxyloxley

I double posted as I am not sure where this should go, if it needs moving, please do .....

Further to the above :

F-Secure have now released a root-kit detection and elimination tool.
it's FREE [always a good idea :)] and in its Beta form now from here

Quote:

The Cure - Innovative New Technology

Now, there is a cure, F-Secure BlackLight Rootkit Elimination Technology. And, it's time to find out, whether your computer is infected by invisible rootkits. Read more about this innovative counter-measure F-Secure BlackLightTM.

Quote:

What is F-Secure BlackLight?

F-Secure BlackLight Rootkit Elimination Technology detects objects that are hidden from users and security tools and offers the user an option to remove them. The main purpose is to fight rootkits and all kinds of malware that use rootkits. The F-Secure BlackLight Rootkit Elimination Technology works by examining the system at a deep level. This enables BlackLight to detect objects that are hidden from the user and security software.

source

Quote:

The latest threat to computer users can be invisible to conventional anti-virus and anti-spyware solutions.

This was the stark warning from security company, F-Secure as it launched a free tool that will search out the menaces known as Rootkit attacks that the company said have the potential to become a major problem.

A Rootkit is 'stealth' software that can hide malicious programs, such as viruses, Trojans, spyware and keyloggers. The problem is according to Patrik Runald, F-Secure's senior technology consultant is it can bypass conventional anti-virus and anti-spyware solutions.

Although upgraded security software should be able to detect an attack, Rootkits try to take advantage of unpatched PCs. Once the software is installed on a computer, even if security software is upgraded afterwards, the Rootkit continues to evade detection.