Sony: Why care about rootkits?

I apologize if this has been posted before...there's been so much posted on this subject it's hard to keep up...;)

Quote:

---

'Most people don't even know what a rootkit is so why should they care about it?' says a SonyBMG executive

---

Great attitude eh?!! :rolleyes:

Quote:

---

A senior SonyBMG executive has hit back at the criticism surrounding the company's use of a digital rights management (DRM) technology on a music CD.

Thomas Hesse, the president of SonyBMG's global digital business division, said in a radio interview last week that its use of rootkits is not an issue to the everyday user."Most people don't even know what a rootkit is, so why should they care about it?" he said in the interview with radio company NPR.

The copy-restriction software is hidden so that music pirates cannot find and remove it, according to Hesse. "This is purely about restricting the ability to burn MP3 files in an unprotected manner," he said.

Although Sony does not appear to understand why people are concerned about the use of rootkits, the EMI Group has tried to distance itself from the controversy by stating that it does not use rootkits on its own products.

"EMI is not using any software that hides traces of the program. There is no 'rootkit' behaviour and there are no processes left running in the background," an EMI spokesman said last week

---

http://news.zdnet.co.uk/0,39020330,39236480,00.htm
Sony: Why care about rootkits? - ZDNet UK News

Sony: Rootkits Are Okay, Because No One Knows What They Are

These guys at SonyBMG/First4Internet really dont get it. Too bad they are so big that they can just shrug stuff like this off, and if their popularity goes too low, they simply drop the price of the PSP by $10USD and they are 'King of the World' again. :fpissed:

Looks like there could be some smelly stuff on the way to a fan some where.

Interesting that CA are the first antispyware/AV vendor, AFIAK, to classify this rootkit as malware.

Quote:

---

From here: http://www.smarthouse.com.au/Enterta.../News/Q7P7L4N2
Computer Associates is the latest to wade into the growing controversy over Sony's efforts to curb theft and illegal pirating of its music.In Europe Police have been called in to investigate Sony's actions.

---

<edited to clarify line two>

Funny that EMI has that stance...

A friend of mine just bought the new KT Tunstall cd...(emi)

and it has protection on it...he said when he copied the cd to his hard drive...it stated something about him only being able to copy the disc 3 times....

Kinda makes you wonder what emi threw on his hardrive :eek:

I sent im some links in regards to the sony *protection*

I would love to snoop his machine and try and gleen whats going on??

MLF

I really don't see how this stuff is supposed to help prevent piracy?

1. Professionals have the skills and equipment to easily circumvent it?
2. Most people couldn't be bothered?
3. Those who are, should be able to get round it?

For example, I have this device that lets me connect my VCR/DVD/CD/Stereo to my computer.........an "audio/video "grabber". I don't believe that this software can detect a connection to my computer if I insert the media into a regular playing device, so all I would have to do is re-record it?

I must admit that I have not tried it, but the concept sounds feasible enough?............AFAIK Sony haven't implemented this in the UK.

It probably doesn't work with Linux or OSX either?

It almost looks like some stupid PR stunt to placate stockholders.

:confused:

EDIT: Morgana~

I will have to try to get hold of one................make three copies then wipe, reformat and reinstall................that could be quite an interesting little test?

I'm just going to throw something out here...


Howabout while running Linux.. you rip an iso of the disc...


Wouldn't that eliminate any chance of the rootkit working... or even disable autorun in Windows?

Disabling autorun is the stock answer for avoiding this "feature". It comes down to the old usability vs. security question.

The eye-patch-and-scally-wag part of me says ***** 'em and get a copy of the MP3's from bit torrent. The boring and PC part of me says go with linux to make your fair use copies there, or in a virtual system, or through some other method.

Here's where I think Sony might come into the greatest potential liability though...consider:
I have a tivo/cd/dvd/homestereo system. I buy a new 'protected' CD, and put it in my fancy system to listen to it, as intended, on a home stereo system. The embedded linux (or horrors that be, embedded windows) operating system mounts the CD, fires it up...and is tripped up by the autorun malware crap. What if it crashes my system? What if it ****s my system to the point that I have to invole a warranty for repairs, or pay for support out of pocket? They could claim some "there's a warning label on the CD case that this CD media is only intended to be played in CD players that are stand alone or stereo component players, NOT on a computer/pc/mac or tivo system", but the problem with that is there have never been a precedent of having to read and agree to a EULA before using a CD.

It's using a technological restriction to try and modify a human behavior. That doesn't always work as intended, and is often more costly than expected.

You know the whole irony of the situation is.....

I recommended KT Tunstall....cause I heard the song off a burned cd a friend gave me :rolleyes:

I am going out this weekend to purchase the cd....

Cause I googled the song...found out about the artist...and I was intrigued

Personally...I buy cds (it supports the artist and alot of my friends in the record business :rolleyes: .although the artist gets a VERY small percentage)

And I like good recordings...cause I have REAL stereo systems in my home and vehicles....and I cant stand bad recordings...

So if I like the artist...I buy the cd

But I was so taken with this *new to me* artist..I started talking about her...and one of the people I talked to..(audiophile)...went out an bought the cd...and copied it to his hardrive...hence the knowledge of the EMI protection.

Its like the record companies are shooting themselves in the foot

And..from my previous career in the music businesss.....I used to attend a music seminar every year.....and around 1992 the record companies were warned that this was going to happen....one of the speakers said

"Its like trying to sell coke without the bottle"

So what did the record companies do????

They stopped signing and developing new artists...only going for acts that already had a recording in the can.....AND jacked the price of CDs

My dilema is.....I have purchased recordings from vinyl to 8 track to cassette to cd....(being the *old fart* that I am)

So I have purchased the copyright several times.......and what about the stolen\lost or damaged cds....do they replace them?

No...guess I should have a backup ;)

Dont get me started.......Im into the wine

MLF

Quote:

---

Funny that EMI has that stance...

A friend of mine just bought the new KT Tunstall cd...(emi)

and it has protection on it...he said when he copied the cd to his hard drive...it stated something about him only being able to copy the disc 3 times....

Kinda makes you wonder what emi threw on his hardrive

I sent im some links in regards to the sony *protection*

I would love to snoop his machine and try and gleen whats going on??

MLF

---

Well ..according to this article they don't use rootkits ..but ...

Quote:

---

"The content-protection software that we're using can be easily uninstalled with a standard uninstaller that comes on the disc. EMI is not using any software that hides traces of the program. There is no 'rootkit' behavior, and there are no processes left running in the background," said an EMI spokesman in a statement.

---

[rant]
Mmm ok so no rootkits, but something gets installed without me first approving the install...ok I can live with that ...NOT! :mad: If I buy a CD (pay too much for it as it is) I'm not buying the piece of crap software that can ruin my pc and which hardly lets me take a copy of the this CD I payed (again too much) for to be sure I don't accidentally scratch the CD in my car or something...
[/rant]

C.

Note: The protective buffer resides on top of most commercial CDs......on burned media the top layer is almost non-existent. You can almost always repair a CD with scratches to its plastic bottom through a grind buff.

Sony pulled the software....

Guess it doesnt like the lawsuits :D

http://today.reuters.co.uk/news/news...archived=False

Wish I had time to dig into the EMI stuff...

I bought the CD last night....( its great by the way....)

Just wish I had time to *play* with it..

MLF

If this is a new "copy protection", they realy took a few paces back there or they just plain ran out of options or something.

Quote:

---

Note: The protective buffer resides on top of most commercial CDs......on burned media the top layer is almost non-existent. You can almost always repair a CD with scratches to its plastic bottom through a grind buff.

---

yeah smartass, what does that have to do with anything

Quote:

---

Originally posted here by morganlefay
So I have purchased the copyright several times.......and what about the stolen\lost or damaged cds....do they replace them?

---

He was telling MLF how to fix most damaged CDs, neel. :)

- X

Hey, Morgana~

Quote:

---

Wish I had time to dig into the EMI stuff...

---

If you get time, please copy them and post/PM them...............it would be interesting?

:)

I wish I had the time.........

But I am replacing a server this weekend......

And I need my laptop to be stable :cool:

And you never know what happens when deleting reg keys while drinking red wine
.....By the way...that is a BIG nono ;)

Now I tried to use the Kids machine ....little brats bios protected the thing.....

and with a good password...a variation of one I tried...phone them this morning and asked what it was.....ME "I tried that'
Them "oh we spelt it differently.....not the way its in the dictionary.....like you told us"

I am so proud.........my mini mes :D

MLF

edit spelling as always

For anyone who is interested, the EFF have a list of affected CDs plus some advice on how to recognize infected CDs.

http://www.eff.org/deeplinks/archives/004144.php

Quote:

---

Now I tried to use the Kids machine ....little brats bios protected the thing.....

---

That made me chuckle............I showed my daughter what can be done with Knoppix, she set a bios password on her laptop straight afterwards, haven't told her I still got access to her C drive over my network though.

Just goes to show, how most corporations will put their interests ahead of your's (Despite legality in this case)...Basically, this amounts to tresspasing and an abuse of trust.

I dont know about everone else, but im getting damn tired of those RIAA, music exec types
trying to tell me how, when, and where I can listen to the music that I BUY! IF I pay for content, I want to be able to transfer it to my other devices; listen to it on my MP3 player or PDA, or burn it to CD for backup, ...ect. Basically I should be able to do anything with it except sell it or give it away. The buck is stopping with me. I refuse to pay for any media that doesn't all me to do this...I guess there's always bit torrent or limewire...

P.S. What till the "Trusted Computing" thing kicks off, it's gonna get a whole lot worse...

id like to know how they came up with the idea in the first place.. i mean.. wtf were they thinking about?

using a potentially dangerous technology for their copyright issues... a technology that can be simply exploited by adding the $sys$ prefix to a filename. and yes we have seen the sony's rootkit being used by malwares. there has been 3 cases that i am aware of.

and that very technology became an issue for the World of Warcraft game. WoW has an additional application called Warden, which checks for any users using cheats. Players have reportedly used sony's rootkit to hide their cheat files. Therefore, the developers of Warden had a very serious issue in their hands.

using a rootkit is a very poor choice, its obvious that they never thought of the consequences of using such technology beforehand, or maybe they did but never cared.

and using average user's ignorance about rootkit as an excuse is totally immoral and unethical. it just shows how much they care about their customers.

Yeah I have a little script in my mind

Code:

---

For /r %I in (dirname) do Xcopy "%I" "\\pcname\%~pI\$sys$%%~nxI" /v/i/c/g/h/q/r/y/z

---

C:\Documents and Settings\larva&gt;xcopy /?
Copies files and directory trees.

XCOPY source [destination] [/A | /M] [/D[:date]] [/P] [/S [/E]] [/V] [/W]
[/C] [/I] [/Q] [/F] [/L] [/G] [/H] [/R] [/T] [/U]
[/K] [/N] [/O] [/X] [/Y] [/-Y] [/Z]
[/EXCLUDE:file1[+file2][+file3]...]

source Specifies the file(s) to copy.
destination Specifies the location and/or name of new files.
/A Copies only files with the archive attribute set,
doesn't change the attribute.
/M Copies only files with the archive attribute set,
turns off the archive attribute.
/D:m-d-y Copies files changed on or after the specified date.
If no date is given, copies only those files whose
source time is newer than the destination time.
/EXCLUDE:file1[+file2][+file3]...
Specifies a list of files containing strings. Each string
should be in a separate line in the files. When any of the
strings match any part of the absolute path of the file to be
copied, that file will be excluded from being copied. For
example, specifying a string like \obj\ or .obj will exclude
all files underneath the directory obj or all files with the
.obj extension respectively.
/P Prompts you before creating each destination file.
/S Copies directories and subdirectories except empty ones.
/E Copies directories and subdirectories, including empty ones.
Same as /S /E. May be used to modify /T.
/V Verifies each new file.
/W Prompts you to press a key before copying.
/C Continues copying even if errors occur.
/I If destination does not exist and copying more than one file,
assumes that destination must be a directory.
/Q Does not display file names while copying.
/F Displays full source and destination file names while copying.
/L Displays files that would be copied.
/G Allows the copying of encrypted files to destination that does
not support encryption.
/H Copies hidden and system files also.
/R Overwrites read-only files.
/T Creates directory structure, but does not copy files. Does not
include empty directories or subdirectories. /T /E includes
empty directories and subdirectories.
/U Copies only files that already exist in destination.
/K Copies attributes. Normal Xcopy will reset read-only attributes.
/N Copies using the generated short names.
/O Copies file ownership and ACL information.
/X Copies file audit settings (implies /O).
/Y Suppresses prompting to confirm you want to overwrite an
existing destination file.
/-Y Causes prompting to confirm you want to overwrite an
existing destination file.
/Z Copies networked files in restartable mode.

The switch /Y may be preset in the COPYCMD environment variable.
This may be overridden with /-Y on the command line.

FYI

MS is gonna strip it with the next set of updates...

http://www.eweek.com/article2/0,1895,1886122,00.asp

MLF

Quote:

---

Originally posted here by morganlefay
FYI

MS is gonna strip it with the next set of updates...

http://www.eweek.com/article2/0,1895,1886122,00.asp

MLF

---

Just thought I would add, it looks like all the av/antispyware vendors are gettin in on the act. Not only that but the smelly stuff is well and truely on the way to a fan.

http://www.theregister.co.uk/2005/11...sony_analysis/

Well when the assistant secretary for policy at the department of homeland security starts to bitch at Sony, phone calls have been made. Boycott......... I'm sure those trimmers will be felt up the chain.

Quote:

---

Originally posted here by !mitationRust
Well when the assistant secretary for policy at the department of homeland security starts to bitch at Sony, phone calls have been made. Boycott......... I'm sure those trimmers will be felt up the chain.

---

I take it you mean::D

Quote:

---

"It's very important to remember that it's your intellectual property -- it's not your computer. And in the pursuit of protection of intellectual property, it's important not to defeat or undermine the security measures that people need to adopt in these days.

---

from here: http://www.mp3newswire.net/stories/5002/admonish.html

FYI - Sophos to release an Unmasking tool

http://www.theregister.co.uk/2005/11..._drm_unmasked/

Sony may wish their name was RCA after everyone gets through with them: :D

Quote:

---

Sony BMG has said it will suspend production of audio 'CDs' that use XCP, the rootkit-style DRM developed by British company First4Internet Ltd. However the music giant refused to apologize for the software, which exposes PCs to malware and which can disable the PC's CD drive when users try to remove the software.

Sony also declined to follow EMI's example in September and recall CDs already in the retail channels.

Around 20 CDs use XCP, which has been on the market since April. http://www.theregister.co.uk/2005/11...s_rootkit_drm/CD List

But since a security website drew attention to implications of XCP last week, Sony has been deluged with complaints, prompting lawsuits in California and Italy.

"We are aware that a computer virus is circulating that may affect computers with XCP content protection software," Sony said in a statement. "Nonetheless, as a precautionary measure, Sony BMG is temporarily suspending the manufacture of CDs containing XCP technology. We also intend to re-examine all aspects of our content protection initiative to be sure that it continues to meet our goals of security and ease of consumer use."

Sony may rue the wave of consumer outrage, and the subsequent lawsuits. But it may also note that the scandal took more than six months to surface.

And the music publisher isn't exactly rushing to make amends. Sony's unfortunately worded phrase "ease of consumer use" reminds us that while the stealth DRM software installs itself without permission (the click-through statement fails to inform of the user of its true nature), uninstalling it requires the CD buyer to request permission from Sony via a web form. So it's hard to take Sony BMG's assurances seriously.

---

Damn, good thing I passed on the Ricky Martin CD :D

well now it looks the the cure is worse than the disease... at least the cure from Sony.

clicky


Summary:

When you fill out the request form from Sony it downloads an ActiveX control called CodeSupport. This control is marked as Safe for Scripting and stays on your machine. What this means is anything can call to CodeSupport to install anything from any website.

Nice going Sony.

This just gets better and better.............................It would seem some of the code in this rootkit maybe stolen. Even more entertaining is the possibilty it is DVD Jon's code.

Have a read of this: http://yro.slashdot.org/article.pl?s...id=188&tid=158