Printable View
It just keeps getting worse and worse for Sony.
The rootkit enabled virus writers and game cheaters to hide there programs, now by using Sony's removal tool you have opened up a huge hole that can be easily attacked through Active-X
http://www.freedom-to-tinker.com
Well, I should point to SONY and say, "Hey, folks, what do you expect? These are the same guys that brought you this poorly designed, badly implemented rootkit masquerading as DRM. Do you REALLY think they will provide a reliable, trustworthy method of removing it? Hmmm? Do ya?"
But I won't. No, don't push me! I mean it, I won't.
;)
maybe its time to start boy cotting them. i mean damn man these guys have the money to just say screw you and stuff. just boy cott them. thats the only power america has left against big companies
What would be the outcome if Joe Bloggs in the street did this?
The same should happen to the Sony exec that signed off on this.
From the people who brought you Pearl Harbour and the Burmah Railway?
;)
Why bother with Sonys rookit removal software? I've read that people are exchanging multiple e-mails with them because of problems they are having but it's wasted energy people should reformat their computer from scratch with the Windows cdrom the rookit disaster is a good example why many experts stress time and again the importance of making system backups so if the computer ever gets hosed or infected with something nasty and it's tough as hell to remove just fire up Acronis or Norton Ghost and copy Windows from the usb external drive or a second internal drive and save hours of work.
The people most affected by this aren't the techies who have access to those tools or understand the need for them. They are the average non-techie user who just trusts big corporations like SONY to treat them respectfully and with dignity. They are the ones that are going to be hurt the most from this.
Oversimplified solutions such as that suggested by Leonore aren't very realistic. In a perfect world, we'd all have backups and know what to do in these cases. It ain't a perfect world.
What will be needed in the next few weeks or months is a kind, compassionate and understanding techie community that is willing to help the regular folks out.
THEN, we'll take SONY down!
;)
For those interested in the removal instructions, this article explains it in good detail.
Rootkit Removal :cool:
A lot of the spyware removal forums are being deluged with users, suddenly concerned with this problem. (Thanks to the media)
These instructions aren't for the real novices either,as it involves tunneling down to the registry and deleting keys, so when they are trying to do this on their own, even with clear cut instructions, they are going to make mistakes.
So backing up is the thing to do. :)
i was reading the other night that microsoft will relise the ... software for removing sonny rotkit ... so is that this tool ? that they did relise and opens up a hole
each day more problems :confused:
Does anyone know if the removal tool that Symantec has for the Sony/DRM rootkit actually removes it totally from a system and/or does it still leave the computer vulnerable. I ran across this problem at work; Symantec AV detected the DRM software as spyware and quarantined it, it was suggested that it be removed and so we used the Symantec removal tool, I'm just wondering how good it is, given the problems I've heard people have after trying to remove this rootkit.
Hey Hey,
For those of you that haven't seen this yet... since it's related to this thread... Here's what US-CERT had to say
There are several links at the bottom of the KB article in reference to it (including the freedom-to-tinker link).... Also this points out that it's important to note that Sony only distributed the software... While there are still problems with that... this is First4Internet's software....Quote:
US-CERT is aware of several vulnerabilities regarding the XCP Digital Rights Management (DRM) software by First 4 Internet, which is distributed by some Sony BMG audio CDs. The XCP copy protection software uses "rootkit" technology to hide certain files from the user. This technique can pose a security threat, as malware can take advantage of the ability to hide files. We are aware of malware that is currently using this technique to hide.
One of the uninstallation options provided by Sony also introduces vulnerabilities to a system. Upon submitting a request to uninstall the DRM software, the user will receive via email a link to a Sony BMG web page. This page will attempt to install an ActiveX control when it is displayed in Internet Explorer. This ActiveX control is marked "Safe for scripting," which means that any web page can utilize the control and its methods. Some of the methods provided by this control are dangerous, as they may allow an attacker to download and execute arbitrary code.
More information about this vulnerability can be found in the following US-CERT Vulnerability Note:
VU#312073 - First 4 Internet XCP "Software Updater Control" ActiveX control incorrectly marked "safe for scripting"
US-CERT recommends the following ways to help prevent the installation of this type of rootkit:
Do not run your system with administrative privileges. Without administrative privileges, the XCP DRM software will not install.
Use caution when installing software. Do not install software from sources that you do not expect to contain software, such as an audio CD.
Read the EULA (End User License Agreement) if you do decide to install software. This document can contain information about what the software may do.
Peace,
HT
Hmmmm..... That's a lot like saying that the virus writer only distributed the software... This is Microsoft's flaw it exploits......Quote:
it's important to note that Sony only distributed the software... While there are still problems with that... this is First4Internet's software
Sony purchased the software knowing what it does and how it works and distributed it to unsuspecting customers without regard for potential harm to them in order to protect their profit.
That's plain wrong..... Sony aren't stupid, they knew what they were doing......
Take a look below. I'm not sure they new exactly what they were doing?Quote:
Sony aren't stupid, they knew what they were doing..
http://www.antionline.com/showthread...r=3#post872566
Jinx:
By that reasoning I can purchase a nuclear weapon and think to myself "What happens if I press this button marked 'Remote Detonation'?"
Since I didn't know the consequences am I not able to be held responsible? Sorry, but that's rubbish.... Sony wanted to acheive a goal. It was their responsibility to ask the appropriate questions regarding the 'hows and whys" prior to purchase. They can't claim ignorance - they have more than enough technically savvy staff - hell, they make computers..... :rolleyes:
They did an "I'm all right Jack" and it bit them in the ass. It was corporate negligence and should be punished appropriately.
Tiger,
Don't miss understand me, Sony should be stamped on, and hard. My last post was not to excuse Sonys actions. More to highlight thier stupidity.
Personaly, I think the company are criminaly negligant.
I'm down with that.... ;)Quote:
More to highlight thier stupidity
More like arrogance then anything else, by the tone of this article you have to admit that Sony did indeed know enough about this technology that it would be an invasion of personal privacy, so I am of the opinion, that they should be keel-hauled and raked over the corals over this. :mad: ArticleQuote:
'Most people don't even know what a rootkit is so why should they care about it?' says a SonyBMG executive
A senior SonyBMG executive has hit back at the criticism surrounding the company's use of a digital rights management (DRM) technology on a music CD.
Thomas Hesse, the president of SonyBMG's global digital business division, said in a radio interview last week that its use of rootkits is not an issue to the everyday user."Most people don't even know what a rootkit is, so why should they care about it?" he said in the interview with radio company NPR.
The copy-restriction software is hidden so that music pirates cannot find and remove it, according to Hesse. "This is purely about restricting the ability to burn MP3 files in an unprotected manner," he said.
Although Sony does not appear to understand why people are concerned about the use of rootkits, the EMI Group has tried to distance itself from the controversy by stating that it does not use rootkits on its own products.
"EMI is not using any software that hides traces of the program. There is no 'rootkit' behaviour and there are no processes left running in the background," an EMI spokesman said last week
Because, Mr Thomas Hesse, it is these very users, who are not pirates. These users are the most vulnerable to exploitation, by ruthless shits (much like your self) who would seek access to thier computers, in an underhand and illigal way. With the intention of steeling thier private and personal information. Your rootkit inreases the possibilities of this occuring.Quote:
Most people don't even know what a rootkit is, so why should they care about it?
The pirates you speek of are well aware of the techniques you employ and take measures to bypass your measures. Your not very bright are you? Even those of us that have, just a little technical knowledge are aware that your DRM does not work on Linux.
<rant off>
I feel much better now.
<soapbox on>
Folks, this whole SONY/First 4 Internet DRM thing just points out something that is totally scarey. Corporations and some developers are either stupid enough or unethical enough to release into the wild software of this crappy caliber and potential for destruction.
If we don't take some kind of grassroots action (boycotts, CD-burnings, community education, protests) to make enough of a counterpoint to this type of heavy-handed, irresponsible activity, other corporations and developers will soon follow SONY and First 4 Internet.
We (us in AO and other IT/IS Security communities) know what we are dealing with, and can respond or investigate appropriately. But we are an extremely small segment of the much larger population. The average music consumer will buy CDs with DRM software, install it not knowing the impact it will have on their system, and continue merrily along. All the while their system is impacted, exposed and owned. Problem is, they'll put this on home systems, work systems, school systems, all without any clue.
Getting good instructions for cleaning up the problem to the average user and expecting them to be able to competently perform the required steps is problematic. Trusting the source corporations to provide a simple removal process has proven to be almost more dangerous than the original problem.
This is a REAL threat to the stability and security of our networks and the internet.
Write, call or email congress persons, state legislators, governors, attorneys general, the media. Contact whoever you can think of. This threat cannot be minimized. Boycott all things SONY.
<soapbox off>
The great Bruce Schneier has a good take on this IMHO
http://www.wired.com/news/privacy/0,1848,69601,00.htmlQuote:
What do you think of your antivirus company, the one that didn't notice Sony's rootkit as it infected half a million computers? And this isn't one of those lightning-fast internet worms; this one has been spreading since mid-2004. Because it spread through infected CDs, not through internet connections, they didn't notice? This is exactly the kind of thing we're paying those companies to detect -- especially because the rootkit was phoning home.
...
You might expect Microsoft to be the first company to condemn this rootkit. After all, XCP corrupts Windows' internals in a pretty nasty way. It's the sort of behavior that could easily lead to system crashes -- crashes that customers would blame on Microsoft. But it wasn't until Nov. 13, when public pressure was just too great to ignore, that Microsoft announced it would update its security tools to detect and remove the cloaking portion of the rootkit.
...
Who are the security companies really working for? It's unlikely that this Sony rootkit is the only example of a media company using this technology. Which security company has engineers looking for the others who might be doing it? And what will they do if they find one? What will they do the next time some multinational company decides that owning your computers is a good idea?
These questions are the real story, and we all deserve answers.
The Register's take on this, which also makes references and links to other articles posted here, in addition to other articles:
http://www.theregister.co.uk/2005/11...staller_peril/
This also caught my eye under "Odds and Sods" with Sony, Porn and USB - heh:
http://www.theregister.co.uk/2005/11/17/sony_usb_offer/
Thhhhinners!
This should piss off shark:
Why not just pop the CD in a Linux or BSD box and then rip and play it however you want ;)
Buahahahaha.
This is going to cause a lot of problems with novice PC users.There are approx half a million infected PC's out there.Quote:
How do we remove rootkits? -- There is only one guaranteed way to remove a rootkit. You destroy the system and then rebuild it. There is no other way to reliable remove a rootkit — no other way whatsoever. You can't delete the file or even reinstall the operating system over the top of the existing OS — which is a horrible practice anyway. It is super important to nuke the system because a rootkit's primary function is stealth — what is it hiding? Do you know? Usually not. How can you reliably know what it was hiding, what it was compromising or what it was removing?
http://www.dozleng.com/updates/index.php?showtopic=7079
They say that the CD's were only available to the US and Canadian market, lucky us, and they critisize the Europeans and Asians for pirating CD's, well I guess they don't look the fools now. :mad:
Hi dalek
I think that some might have gotten loose in Australia and mainland Europe (didn't BMG used to be a German music distributor?)
The problem is that because of the differential pricing rip offs people over here can import from the USA and actually save money ..................I have done it several times just net shopping, and if you have relatives and friends as well? (OK..............they have no choice about being my relative :D ?)
There are some very greedy people in the UK, so as long as you are prepared to pay local price + FEDEX, that is OK? The difference is the local rip-off
:mad:
Hi nihil
Think I could save some if I got some of my relatives over there (UK) to order and then ship them back to me?...What with our dollar being what it is?...no maybe not eh! :pQuote:
The problem is that because of the differential pricing rip offs people over here can import from the USA and actually save money ..................I have done it several times just net shopping, and if you have relatives and friends as well?
By the time this CD problem as well as (P2P) sharing is all squared away, the format will change and we will be forced to assimiliate (resistance is futile). Also the pricing will never change, too many hands in the pie.
The consumer in the end loses, and the middlemen are the ones who laugh all the way to the banks. :mad: